Researchers Show a Single Malicious Webpage Visit Can Compromise Tor Browser

Nebula Security says a patched Firefox JIT flaw could be triggered by simply visiting a malicious webpage and was also used to compromise Tor Browser. Tracked as CVE-2026-10702, the bug provides arbitrary code execution inside the browser's renderer process. Mozilla rated it High and fixed it in the Firefox 151.0.3 update. "No settings or additional user interaction are required," Eten Zou,

The article reports that Nebula Security disclosed a Firefox SpiderMonkey JIT miscompilation flaw, CVE-2026-10702, which allows arbitrary code execution in the browser’s renderer process simply by visiting a malicious webpage, and that this bug was also used to compromise Tor Browser because it inherits Firefox’s engine.[2][4][12] Mozilla rated the vulnerability High and fixed it in Firefox 151.0.3, after which Tor Browser integrated the upstream patch, making timely updates the main protection for users.[2][14] From a RealGround perspective, this illustrates how AI agents and applications built atop browser engines or embedded WebView components can inherit critical upstream vulnerabilities, creating an AI supply chain risk that requires SBOM-driven dependency tracking and prompt patch management. It also highlights the need for continuous red teaming of AI-assisted browsing and autonomous agents to test their exposure to drive‑by code execution paths and to ensure that agent security controls are not undermined by underlying browser flaws.