Firefox JIT Flaw CVE-2026-10702 Enables Single-Visit RCE in Tor Browser

Wed, 29 Jul 2026 13:07:14 +0000

Engineer — Act: A public PoC on GitHub for a no-interaction arbitrary code execution flaw in Firefox’s renderer means drive-by exploitation is immediately practical; update Firefox to 151.0.3 across all managed endpoints and verify Tor Browser is similarly patched or blocked.
SOC/IR — Plan: With a public PoC now circulating, watering-hole operators may weaponize this quickly; build or tune detections for unexpected child processes spawned from the Firefox renderer process and prepare a hunt query scoped to the weeks before the 151.0.3 fix shipped.
Leader — Skip
Signals: CVE-2026-10702 — CISA KEV: not listed, EPSS 0.01, public PoC on GitHub

Browser-Rce on CuraSec