{"vulnerability": "CVE-2026-10702", "sightings": [{"uuid": "2c1d51dd-2765-4b7f-b784-a945f5c03e3d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-10702", "type": "seen", "source": "https://bsky.app/profile/hacker.at.thenote.app/post/3mru3kfmjqs2a", "content": "Researchers Show a Single Malicious Webpage Visit Can Compromise Tor Browser\n\nNebula Security says a patched Firefox JIT flaw could be triggered by simply visiting a malicious webpage and was also used to compromise Tor Browser.\n\nTracked as CVE-2026-10702, the bug provides arbitra\u2026\n#hackernews #news", "creation_timestamp": "2026-07-30T09:05:48.515911Z"}, {"uuid": "c4ce8f39-bf75-4c89-8c6b-56e1daaf2d35", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-10702", "type": "seen", "source": "https://thehackernews.com/2026/07/researchers-show-single-malicious.html", "content": "Nebula Security says a patched Firefox JIT flaw could be triggered by simply visiting a malicious webpage and was also used to compromise Tor Browser.\n\nTracked as CVE-2026-10702, the bug provides arbitrary code execution inside the browser's renderer process. Mozilla rated it High and fixed it in the Firefox 151.0.3 update.\n\n\"No settings or additional user interaction are required,\" Eten Zou,", "creation_timestamp": "2026-07-30T01:00:45.568548Z"}, {"uuid": "a4c7c5ca-f625-4ce7-b465-e763107ef051", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-10702", "type": "seen", "source": "https://bsky.app/profile/jbhall56.bsky.social/post/3mruh7rlgkc27", "content": "Tracked as CVE-2026-10702, the bug provides arbitrary code execution inside the browser's renderer process. Mozilla rated it High and fixed it in the Firefox 151.0.3 update. thehackernews.com/2026/07/rese...", "creation_timestamp": "2026-07-30T12:34:38.963739Z"}, {"uuid": "da3b0415-102b-45e7-85d4-0d048d549c4e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-10702", "type": "seen", "source": "Telegram/47AGWfAWFIwZKzQcl_sisfXazYjpo74QYaHVlY-riLjwoTE", "content": "", "creation_timestamp": "2026-07-30T14:00:04.807599Z"}, {"uuid": "9ac8a42b-ad31-4c41-b368-1d89f38f3d09", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-10702", "type": "seen", "source": "https://bsky.app/profile/hackmag.com/post/3ms66rux3qn2b", "content": "\ud83d\udfe2 A Single Visit to a Malicious Page Could Compromise Tor Browser\n\n\ud83d\udde8\ufe0f Researchers at Nebula Security have disclosed details of CVE-2026-10702, a vulnerability in Firefox\u2019s JIT compiler. To c\u2026\n\n#news", "creation_timestamp": "2026-08-03T09:30:19.895862Z"}, {"uuid": "c7ab58e5-cc9f-4eed-8908-ef0f27ab127d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-10702", "type": "seen", "source": "https://bsky.app/profile/jimguckin.bsky.social/post/3mruurt5mou27", "content": "CVE-2026-10702: A JIT flaw in Firefox's SpiderMonkey engine means visiting a malicious webpage is enough. No clicks, no downloads. Tor Browser inherited it.\n\nPatches exist. Firefox 151.0.3, Tor 15.0.19. If you haven't updated\u2026do it now\n\ngbhackers.com/hackers-can-...\n\n#InfoSec #Firefox #TorBrowser", "creation_timestamp": "2026-07-30T16:37:21.325666Z"}, {"uuid": "608dc8dc-8ecf-4d8a-a8f7-bdfd5e9bef32", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-10702", "type": "seen", "source": "https://bsky.app/profile/oxfemale.bsky.social/post/3mrzhsyfnza2f", "content": "Original text: \"IonStack Part I: Unsound IonBanana Peel in Ion Compiler, Slipping Through Firefox's SpiderMonkey JIT\" \u2014 Nebula Security, NebuSec (July 10, 2026). Code, tables and figures below are reproduced verbatim w\nhttps://core-jmp.org/2026/08/ionstack-part-1-cve-2026-10702-spidermonkey-jit-uaf/", "creation_timestamp": "2026-08-01T12:28:41.028619Z"}, {"uuid": "85e49888-d2f2-47a7-b8cf-dcefd744711c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-10702", "type": "published-proof-of-concept", "source": "Telegram/47AGWfAWFIwZKzQcl_sisfXazYjpo74QYaHVlY-riLjwoTE", "content": "", "creation_timestamp": "2026-07-31T00:00:29.617707Z"}, {"uuid": "9bd657c4-fc65-40a5-9b0e-73e63fd63630", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-10702", "type": "seen", "source": "Telegram/9Sw1HR_bxq2cTalbzEbNjiydHiXf9JBHmfm-uNYFs6ArOw", "content": "", "creation_timestamp": "2026-07-31T00:00:45.074097Z"}, {"uuid": "29fd15dc-fba3-4433-ad6d-9fe20333751e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-10702", "type": "seen", "source": "https://t.me/xakep_ru/19794", "content": "\u041e\u0434\u043d\u043e \u043f\u043e\u0441\u0435\u0449\u0435\u043d\u0438\u0435 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u043e\u0439 \u0441\u0442\u0440\u0430\u043d\u0438\u0446\u044b \u043c\u043e\u0433\u043b\u043e \u0441\u043a\u043e\u043c\u043f\u0440\u043e\u043c\u0435\u0442\u0438\u0440\u043e\u0432\u0430\u0442\u044c Tor Browser\n\n\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0438\u0437 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 Nebula Security \u0440\u0430\u0441\u043a\u0440\u044b\u043b\u0438 \u0434\u0435\u0442\u0430\u043b\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 CVE-2026-10702 \u0432 JIT-\u043a\u043e\u043c\u043f\u0438\u043b\u044f\u0442\u043e\u0440\u0435 Firefox. \u0414\u043b\u044f \u0430\u0442\u0430\u043a\u0438 \u0434\u043e\u0441\u0442\u0430\u0442\u043e\u0447\u043d\u043e \u0431\u044b\u043b\u043e \u043e\u0442\u043a\u0440\u044b\u0442\u044c \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u043f\u043e\u0434\u0433\u043e\u0442\u043e\u0432\u043b\u0435\u043d\u043d\u0443\u044e \u0441\u0442\u0440\u0430\u043d\u0438\u0446\u0443, \u0438 \u0441\u043e \u0441\u0442\u043e\u0440\u043e\u043d\u044b \u0436\u0435\u0440\u0442\u0432\u044b \u043d\u0435 \u0442\u0440\u0435\u0431\u043e\u0432\u0430\u043b\u043e\u0441\u044c \u043d\u0438\u043a\u0430\u043a\u0438\u0445 \u0438\u0437\u043c\u0435\u043d\u0435\u043d\u0438\u0439 \u043d\u0430\u0441\u0442\u0440\u043e\u0435\u043a, \u043a\u043b\u0438\u043a\u043e\u0432 \u0438\u043b\u0438 \u0434\u0440\u0443\u0433\u0438\u0445 \u0434\u0435\u0439\u0441\u0442\u0432\u0438\u0439. \u041f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u0442\u0430\u043a\u0436\u0435 \u0437\u0430\u0442\u0440\u0430\u0433\u0438\u0432\u0430\u043b\u0430 Tor Browser, \u0435\u0441\u043b\u0438 \u043e\u043d \u0440\u0430\u0431\u043e\u0442\u0430\u043b \u043d\u0430 \u0431\u0430\u0437\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0439 \u0432\u0435\u0440\u0441\u0438\u0438 Firefox.\n\nhttps://xakep.ru/2026/07/31/cve-2026-10702/", "creation_timestamp": "2026-07-31T11:00:03.201317Z"}, {"uuid": "28f449db-d95a-4da0-a0cf-3361e098d193", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-10702", "type": "seen", "source": "https://bsky.app/profile/securityonline.bsky.social/post/3mrwwbvzkry23", "content": "Firefox CVE-2026-10702 Exploit: Android Flaw Exposed", "creation_timestamp": "2026-07-31T12:09:34.771090Z"}, {"uuid": "52439d80-d480-416a-ae09-1cf7a8b9e081", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-10702", "type": "published-proof-of-concept", "source": "https://t.me/xakep_ru/19794", "content": "\u041e\u0434\u043d\u043e \u043f\u043e\u0441\u0435\u0449\u0435\u043d\u0438\u0435 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u043e\u0439 \u0441\u0442\u0440\u0430\u043d\u0438\u0446\u044b \u043c\u043e\u0433\u043b\u043e \u0441\u043a\u043e\u043c\u043f\u0440\u043e\u043c\u0435\u0442\u0438\u0440\u043e\u0432\u0430\u0442\u044c Tor Browser\n\n\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0438\u0437 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 Nebula Security \u0440\u0430\u0441\u043a\u0440\u044b\u043b\u0438 \u0434\u0435\u0442\u0430\u043b\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 CVE-2026-10702 \u0432 JIT-\u043a\u043e\u043c\u043f\u0438\u043b\u044f\u0442\u043e\u0440\u0435 Firefox. \u0414\u043b\u044f \u0430\u0442\u0430\u043a\u0438 \u0434\u043e\u0441\u0442\u0430\u0442\u043e\u0447\u043d\u043e \u0431\u044b\u043b\u043e \u043e\u0442\u043a\u0440\u044b\u0442\u044c \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u043f\u043e\u0434\u0433\u043e\u0442\u043e\u0432\u043b\u0435\u043d\u043d\u0443\u044e \u0441\u0442\u0440\u0430\u043d\u0438\u0446\u0443, \u0438 \u0441\u043e \u0441\u0442\u043e\u0440\u043e\u043d\u044b \u0436\u0435\u0440\u0442\u0432\u044b \u043d\u0435 \u0442\u0440\u0435\u0431\u043e\u0432\u0430\u043b\u043e\u0441\u044c \u043d\u0438\u043a\u0430\u043a\u0438\u0445 \u0438\u0437\u043c\u0435\u043d\u0435\u043d\u0438\u0439 \u043d\u0430\u0441\u0442\u0440\u043e\u0435\u043a, \u043a\u043b\u0438\u043a\u043e\u0432 \u0438\u043b\u0438 \u0434\u0440\u0443\u0433\u0438\u0445 \u0434\u0435\u0439\u0441\u0442\u0432\u0438\u0439. \u041f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u0442\u0430\u043a\u0436\u0435 \u0437\u0430\u0442\u0440\u0430\u0433\u0438\u0432\u0430\u043b\u0430 Tor Browser, \u0435\u0441\u043b\u0438 \u043e\u043d \u0440\u0430\u0431\u043e\u0442\u0430\u043b \u043d\u0430 \u0431\u0430\u0437\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0439 \u0432\u0435\u0440\u0441\u0438\u0438 Firefox.\n\nhttps://xakep.ru/2026/07/31/cve-2026-10702/", "creation_timestamp": "2026-08-01T00:00:33.640400Z"}, {"uuid": "c7482f14-1fca-46d2-a4a5-da45edd61665", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-10702", "type": "seen", "source": "https://bsky.app/profile/cyberveille-ch.bsky.social/post/3ms4j4wgsdi23", "content": "\ud83d\udce2 CVE-2026-10702 : Miscompilation JIT dans SpiderMonkey IonMonkey permettant une ex\u00e9cution de code arbitraire\n\nCet article pr\u00e9sente une analyse technique approfondie de CVE-2026-10702, une vuln\u00e9rabilit\u00e9 d\u00e9couverte par leur agent\u2026\n\n\ud83d\udfe1 v\u00e9rification factuelle moyenne\n#SpiderMonkey #Firefox #Cyberveille", "creation_timestamp": "2026-08-02T17:30:06.835955Z"}, {"uuid": "31793758-45c2-4539-925a-a274cca3d047", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-10702", "type": "seen", "source": "https://bsky.app/profile/o2cloud.bsky.social/post/3mnf44jhtx423", "content": "\ud83d\udd17 CVE : CVE-2026-10701, CVE-2026-10702", "creation_timestamp": "2026-06-03T12:25:14.766811Z"}, {"uuid": "806f5282-a24f-4dac-a79f-76314bb5e823", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-10702", "type": "seen", "source": "https://www.acn.gov.it/portale/w/risolte-vulnerabilita-in-prodotti-mozilla-6", "content": "", "creation_timestamp": "2026-06-03T04:52:24.000000Z"}, {"uuid": "dba82d5d-fd29-4670-8451-2c1a8c1f7569", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-10702", "type": "seen", "source": "https://bsky.app/profile/getpokemon7.bsky.social/post/3mp57ie4edc26", "content": "\u300cFirefox\u300d\u304c\u8907\u6570\u306e\u8106\u5f31\u6027\u3092\u4fee\u6b63 - iOS\u7248\u306e\u30a2\u30c3\u30d7\u30c7\u30fc\u30c8\u3082\n\nMozilla Foundation\u306f\u3001\u30d6\u30e9\u30a6\u30b6\u300cFirefox\u300d\u306e\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u30a2\u30c3\u30d7\u30c7\u30fc\u30c8\u3092\u30ea\u30ea\u30fc\u30b9\u3057\u305f\u3002iOS\u7248\u306e\u4fee\u6b63\u3082\u5b9f\u65bd\u3057\u3066\u3044\u308b\u3002\n\n\u73fe\u5730\u6642\u95932026\u5e746\u67082\u65e5\u306b\u8106\u5f31\u60272\u4ef6\u3078\u5bfe\u51e6\u3057\u305f\u300cFirefox 151.0.3\u300d\u3092\u30ea\u30ea\u30fc\u30b9\u3057\u305f\u3002\u3068\u3082\u306b\u91cd\u8981\u5ea6\u30924\u6bb5\u968e\u4e2d\u30012\u756a\u76ee\u306b\u3042\u305f\u308b\u300c\u9ad8\uff08High\uff09\u300d\u3068\u3057\u3066\u3044\u308b\u3002\n\n\u300cCVE-2026-10701\u300d\u306f\u3001\u30c6\u30ad\u30b9\u30c8\u306e\u63cf\u753b\u51e6\u7406\u3092\u884c\u3046\u30b3\u30f3\u30dd\u30fc\u30cd\u30f3\u30c8\u306b\u78ba\u8a8d\u3055\u308c\u305f\u8106\u5f31\u6027\u3067\u3001\u5883\u754c\u6761\u4ef6\u306e\u4e0d\u5099\u306b\u8d77\u56e0\u3002\u300cCVE-2026-10702\u300d\u306f\u3001JavaScript\u30a8\u30f3\u30b8\u30f3\u306e\u300cJIT\u300d\u30b3\u30f3\u30dd\u30fc\u30cd\u30f3\u30c8\u306b...", "creation_timestamp": "2026-06-25T19:54:37.981806Z"}, {"uuid": "fc899f29-1eb0-49fe-b657-fc014c9e1e15", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-10702", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/debian-linux-kernel-multiple-vulnerabilities_20260706", "content": "", "creation_timestamp": "2026-07-12T20:45:03.639232Z"}, {"uuid": "cd69a355-a5de-46ad-9a79-9108f5796f63", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-10702", "type": "seen", "source": "https://t.me/poxek/6234", "content": "IonStack: root Android 17 \u0441 \u043e\u0434\u043d\u043e\u0433\u043e URL\n\nNebula Security \u043f\u043e\u043a\u0430\u0437\u0430\u043b\u0430 IonStack \u2014 \u043f\u0443\u0431\u043b\u0438\u0447\u043d\u0443\u044e \u0434\u0435\u043c\u043e\u043d\u0441\u0442\u0440\u0430\u0446\u0438\u044e \u0446\u0435\u043f\u043e\u0447\u043a\u0438 Firefox \u2192 Linux kernel, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u043d\u0430 Android 17 \u043c\u043e\u0436\u0435\u0442 \u0434\u043e\u0432\u0435\u0441\u0442\u0438 \u043e\u0434\u0438\u043d \u043a\u043b\u0438\u043a \u043f\u043e URL \u0434\u043e root-\u0434\u043e\u0441\u0442\u0443\u043f\u0430. \u0412 \u0446\u0435\u043f\u043e\u0447\u043a\u0435 \u0434\u0432\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438: CVE-2026-10702, JIT miscompilation \u0432 JavaScript Engine Firefox, \u0437\u0430\u043a\u0440\u044b\u0442\u0430\u044f \u0432 Firefox 151.0.3, \u0438 CVE-2026-43499 GhostLock \u2014 use-after-free \u0432 rtmutex/futex-PI \u043a\u043e\u0434\u0435 \u044f\u0434\u0440\u0430 Linux.\n\n\u0422\u0435\u0445\u043d\u0438\u0447\u0435\u0441\u043a\u0438 \u044d\u0442\u043e browser-to-kernel full chain. \u0421\u043d\u0430\u0447\u0430\u043b\u0430 \u0431\u0430\u0433 \u0432 Firefox \u0434\u0430\u0435\u0442 \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0435 \u043a\u043e\u0434\u0430 \u0432 \u043a\u043e\u043d\u0442\u0435\u043a\u0441\u0442\u0435 \u0431\u0440\u0430\u0443\u0437\u0435\u0440\u0430, \u0437\u0430\u0442\u0435\u043c \u043b\u043e\u043a\u0430\u043b\u044c\u043d\u0430\u044f kernel LPE \u043f\u0440\u043e\u0431\u0438\u0432\u0430\u0435\u0442 \u0438\u0437\u043e\u043b\u044f\u0446\u0438\u044e \u0438 \u043f\u043e\u0432\u044b\u0448\u0430\u0435\u0442 \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0438. \u0423 GhostLock \u043c\u0435\u0445\u0430\u043d\u0438\u043a\u0430: \u043e\u0431\u044b\u0447\u043d\u044b\u0435 threading/futex syscalls \u043e\u0441\u0442\u0430\u0432\u043b\u044f\u044e\u0442 \u0432\u0438\u0441\u044f\u0447\u0438\u0439 \u0443\u043a\u0430\u0437\u0430\u0442\u0435\u043b\u044c \u043d\u0430 \u0441\u0442\u0435\u043a \u044f\u0434\u0440\u0430; \u043f\u043e \u0434\u0430\u043d\u043d\u044b\u043c Nebula, \u0443\u044f\u0437\u0432\u0438\u043c\u044b\u0439 \u0434\u0438\u0430\u043f\u0430\u0437\u043e\u043d \u2014 Linux 2.6.39-rc1 \u0434\u043e 7.1-rc1 \u043f\u0440\u0438 CONFIG_FUTEX_PI=y, \u0430 \u0438\u0445 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u044f \u0432 kernelCTF \u0431\u044b\u043b\u0430 \u043e\u043a\u043e\u043b\u043e 97% \u0441\u0442\u0430\u0431\u0438\u043b\u044c\u043d\u043e\u0439.\n\n\u0412\u0430\u0436\u043d\u043e\u0435 \u043e\u0433\u0440\u0430\u043d\u0438\u0447\u0435\u043d\u0438\u0435: \u044d\u0442\u043e \u043f\u0443\u0431\u043b\u0438\u0447\u043d\u043e\u0435 \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u044c\u0441\u043a\u043e\u0435 \u0434\u0435\u043c\u043e \u0438 \u043e\u0442\u043a\u0440\u044b\u0442\u044b\u0439 PoC, \u0430 \u043d\u0435 \u043f\u043e\u0434\u0442\u0432\u0435\u0440\u0436\u0434\u0435\u043d\u0438\u0435 \u043c\u0430\u0441\u0441\u043e\u0432\u043e\u0439 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438. Android-\u0447\u0430\u0441\u0442\u044c \u0437\u0430\u0432\u0438\u0441\u0438\u0442 \u043e\u0442 Firefox/Fenix \u0438 \u043a\u043e\u043d\u043a\u0440\u0435\u0442\u043d\u043e\u0439 \u043f\u043e\u0434\u0434\u0435\u0440\u0436\u043a\u0438 \u044f\u0434\u0440\u0430 \u043d\u0430 \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432\u0435; \u043d\u0430 \u0434\u0435\u043c\u043e-\u0441\u0430\u0439\u0442\u0435 Nebula \u043f\u0440\u044f\u043c\u043e \u043f\u0440\u0435\u0434\u0443\u043f\u0440\u0435\u0436\u0434\u0430\u0435\u0442 \u043e \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u044b\u0445 \u043f\u0430\u0434\u0435\u043d\u0438\u044f\u0445, \u0438\u0437\u043c\u0435\u043d\u0435\u043d\u0438\u044f\u0445 \u0432 \u0441\u0438\u0441\u0442\u0435\u043c\u0435 \u0438 \u043f\u043e\u0442\u0435\u0440\u0435 \u0434\u0430\u043d\u043d\u044b\u0445.\n\n\ud83d\udc31  GitHub PoC\n\n\ud83c\udf1a @poxek | \ud83c\udf1a @poxek_ai | \ud83d\udcf2 MAX", "creation_timestamp": "2026-07-13T13:00:04.366754Z"}, {"uuid": "4639a0b3-4671-4410-af1f-5249cff5f110", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-10702", "type": "published-proof-of-concept", "source": "https://t.me/poxek/6234", "content": "IonStack: root Android 17 \u0441 \u043e\u0434\u043d\u043e\u0433\u043e URL\n\nNebula Security \u043f\u043e\u043a\u0430\u0437\u0430\u043b\u0430 IonStack \u2014 \u043f\u0443\u0431\u043b\u0438\u0447\u043d\u0443\u044e \u0434\u0435\u043c\u043e\u043d\u0441\u0442\u0440\u0430\u0446\u0438\u044e \u0446\u0435\u043f\u043e\u0447\u043a\u0438 Firefox \u2192 Linux kernel, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u043d\u0430 Android 17 \u043c\u043e\u0436\u0435\u0442 \u0434\u043e\u0432\u0435\u0441\u0442\u0438 \u043e\u0434\u0438\u043d \u043a\u043b\u0438\u043a \u043f\u043e URL \u0434\u043e root-\u0434\u043e\u0441\u0442\u0443\u043f\u0430. \u0412 \u0446\u0435\u043f\u043e\u0447\u043a\u0435 \u0434\u0432\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438: CVE-2026-10702, JIT miscompilation \u0432 JavaScript Engine Firefox, \u0437\u0430\u043a\u0440\u044b\u0442\u0430\u044f \u0432 Firefox 151.0.3, \u0438 CVE-2026-43499 GhostLock \u2014 use-after-free \u0432 rtmutex/futex-PI \u043a\u043e\u0434\u0435 \u044f\u0434\u0440\u0430 Linux.\n\n\u0422\u0435\u0445\u043d\u0438\u0447\u0435\u0441\u043a\u0438 \u044d\u0442\u043e browser-to-kernel full chain. \u0421\u043d\u0430\u0447\u0430\u043b\u0430 \u0431\u0430\u0433 \u0432 Firefox \u0434\u0430\u0435\u0442 \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0435 \u043a\u043e\u0434\u0430 \u0432 \u043a\u043e\u043d\u0442\u0435\u043a\u0441\u0442\u0435 \u0431\u0440\u0430\u0443\u0437\u0435\u0440\u0430, \u0437\u0430\u0442\u0435\u043c \u043b\u043e\u043a\u0430\u043b\u044c\u043d\u0430\u044f kernel LPE \u043f\u0440\u043e\u0431\u0438\u0432\u0430\u0435\u0442 \u0438\u0437\u043e\u043b\u044f\u0446\u0438\u044e \u0438 \u043f\u043e\u0432\u044b\u0448\u0430\u0435\u0442 \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0438. \u0423 GhostLock \u043c\u0435\u0445\u0430\u043d\u0438\u043a\u0430: \u043e\u0431\u044b\u0447\u043d\u044b\u0435 threading/futex syscalls \u043e\u0441\u0442\u0430\u0432\u043b\u044f\u044e\u0442 \u0432\u0438\u0441\u044f\u0447\u0438\u0439 \u0443\u043a\u0430\u0437\u0430\u0442\u0435\u043b\u044c \u043d\u0430 \u0441\u0442\u0435\u043a \u044f\u0434\u0440\u0430; \u043f\u043e \u0434\u0430\u043d\u043d\u044b\u043c Nebula, \u0443\u044f\u0437\u0432\u0438\u043c\u044b\u0439 \u0434\u0438\u0430\u043f\u0430\u0437\u043e\u043d \u2014 Linux 2.6.39-rc1 \u0434\u043e 7.1-rc1 \u043f\u0440\u0438 CONFIG_FUTEX_PI=y, \u0430 \u0438\u0445 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u044f \u0432 kernelCTF \u0431\u044b\u043b\u0430 \u043e\u043a\u043e\u043b\u043e 97% \u0441\u0442\u0430\u0431\u0438\u043b\u044c\u043d\u043e\u0439.\n\n\u0412\u0430\u0436\u043d\u043e\u0435 \u043e\u0433\u0440\u0430\u043d\u0438\u0447\u0435\u043d\u0438\u0435: \u044d\u0442\u043e \u043f\u0443\u0431\u043b\u0438\u0447\u043d\u043e\u0435 \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u044c\u0441\u043a\u043e\u0435 \u0434\u0435\u043c\u043e \u0438 \u043e\u0442\u043a\u0440\u044b\u0442\u044b\u0439 PoC, \u0430 \u043d\u0435 \u043f\u043e\u0434\u0442\u0432\u0435\u0440\u0436\u0434\u0435\u043d\u0438\u0435 \u043c\u0430\u0441\u0441\u043e\u0432\u043e\u0439 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438. Android-\u0447\u0430\u0441\u0442\u044c \u0437\u0430\u0432\u0438\u0441\u0438\u0442 \u043e\u0442 Firefox/Fenix \u0438 \u043a\u043e\u043d\u043a\u0440\u0435\u0442\u043d\u043e\u0439 \u043f\u043e\u0434\u0434\u0435\u0440\u0436\u043a\u0438 \u044f\u0434\u0440\u0430 \u043d\u0430 \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432\u0435; \u043d\u0430 \u0434\u0435\u043c\u043e-\u0441\u0430\u0439\u0442\u0435 Nebula \u043f\u0440\u044f\u043c\u043e \u043f\u0440\u0435\u0434\u0443\u043f\u0440\u0435\u0436\u0434\u0430\u0435\u0442 \u043e \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u044b\u0445 \u043f\u0430\u0434\u0435\u043d\u0438\u044f\u0445, \u0438\u0437\u043c\u0435\u043d\u0435\u043d\u0438\u044f\u0445 \u0432 \u0441\u0438\u0441\u0442\u0435\u043c\u0435 \u0438 \u043f\u043e\u0442\u0435\u0440\u0435 \u0434\u0430\u043d\u043d\u044b\u0445.\n\n\ud83d\udc31  GitHub PoC\n\n\ud83c\udf1a @poxek | \ud83c\udf1a @poxek_ai | \ud83d\udcf2 MAX", "creation_timestamp": "2026-07-14T00:00:48.163195Z"}, {"uuid": "b4ceb374-f456-4fd6-b65b-412bbab5f235", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-10702", "type": "seen", "source": "https://t.me/zhatez/2805", "content": "IonStack: root Android 17 \u0441 \u043e\u0434\u043d\u043e\u0433\u043e URL\n\nNebula Security \u043f\u043e\u043a\u0430\u0437\u0430\u043b\u0430 IonStack \u2014 \u043f\u0443\u0431\u043b\u0438\u0447\u043d\u0443\u044e \u0434\u0435\u043c\u043e\u043d\u0441\u0442\u0440\u0430\u0446\u0438\u044e \u0446\u0435\u043f\u043e\u0447\u043a\u0438 Firefox \u2192 Linux kernel, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u043d\u0430 Android 17 \u043c\u043e\u0436\u0435\u0442 \u0434\u043e\u0432\u0435\u0441\u0442\u0438 \u043e\u0434\u0438\u043d \u043a\u043b\u0438\u043a \u043f\u043e URL \u0434\u043e root-\u0434\u043e\u0441\u0442\u0443\u043f\u0430. \u0412 \u0446\u0435\u043f\u043e\u0447\u043a\u0435 \u0434\u0432\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438: CVE-2026-10702, JIT miscompilation \u0432 JavaScript Engine Firefox, \u0437\u0430\u043a\u0440\u044b\u0442\u0430\u044f \u0432 Firefox 151.0.3, \u0438 CVE-2026-43499 GhostLock \u2014 use-after-free \u0432 rtmutex/futex-PI \u043a\u043e\u0434\u0435 \u044f\u0434\u0440\u0430 Linux.\n\n\u0422\u0435\u0445\u043d\u0438\u0447\u0435\u0441\u043a\u0438 \u044d\u0442\u043e browser-to-kernel full chain. \u0421\u043d\u0430\u0447\u0430\u043b\u0430 \u0431\u0430\u0433 \u0432 Firefox \u0434\u0430\u0435\u0442 \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0435 \u043a\u043e\u0434\u0430 \u0432 \u043a\u043e\u043d\u0442\u0435\u043a\u0441\u0442\u0435 \u0431\u0440\u0430\u0443\u0437\u0435\u0440\u0430, \u0437\u0430\u0442\u0435\u043c \u043b\u043e\u043a\u0430\u043b\u044c\u043d\u0430\u044f kernel LPE \u043f\u0440\u043e\u0431\u0438\u0432\u0430\u0435\u0442 \u0438\u0437\u043e\u043b\u044f\u0446\u0438\u044e \u0438 \u043f\u043e\u0432\u044b\u0448\u0430\u0435\u0442 \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0438. \u0423 GhostLock \u043c\u0435\u0445\u0430\u043d\u0438\u043a\u0430: \u043e\u0431\u044b\u0447\u043d\u044b\u0435 threading/futex syscalls \u043e\u0441\u0442\u0430\u0432\u043b\u044f\u044e\u0442 \u0432\u0438\u0441\u044f\u0447\u0438\u0439 \u0443\u043a\u0430\u0437\u0430\u0442\u0435\u043b\u044c \u043d\u0430 \u0441\u0442\u0435\u043a \u044f\u0434\u0440\u0430; \u043f\u043e \u0434\u0430\u043d\u043d\u044b\u043c Nebula, \u0443\u044f\u0437\u0432\u0438\u043c\u044b\u0439 \u0434\u0438\u0430\u043f\u0430\u0437\u043e\u043d \u2014 Linux 2.6.39-rc1 \u0434\u043e 7.1-rc1 \u043f\u0440\u0438 CONFIG_FUTEX_PI=y, \u0430 \u0438\u0445 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u044f \u0432 kernelCTF \u0431\u044b\u043b\u0430 \u043e\u043a\u043e\u043b\u043e 97% \u0441\u0442\u0430\u0431\u0438\u043b\u044c\u043d\u043e\u0439.\n\n\u0412\u0430\u0436\u043d\u043e\u0435 \u043e\u0433\u0440\u0430\u043d\u0438\u0447\u0435\u043d\u0438\u0435: \u044d\u0442\u043e \u043f\u0443\u0431\u043b\u0438\u0447\u043d\u043e\u0435 \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u044c\u0441\u043a\u043e\u0435 \u0434\u0435\u043c\u043e \u0438 \u043e\u0442\u043a\u0440\u044b\u0442\u044b\u0439 PoC, \u0430 \u043d\u0435 \u043f\u043e\u0434\u0442\u0432\u0435\u0440\u0436\u0434\u0435\u043d\u0438\u0435 \u043c\u0430\u0441\u0441\u043e\u0432\u043e\u0439 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438. Android-\u0447\u0430\u0441\u0442\u044c \u0437\u0430\u0432\u0438\u0441\u0438\u0442 \u043e\u0442 Firefox/Fenix \u0438 \u043a\u043e\u043d\u043a\u0440\u0435\u0442\u043d\u043e\u0439 \u043f\u043e\u0434\u0434\u0435\u0440\u0436\u043a\u0438 \u044f\u0434\u0440\u0430 \u043d\u0430 \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432\u0435; \u043d\u0430 \u0434\u0435\u043c\u043e-\u0441\u0430\u0439\u0442\u0435 Nebula \u043f\u0440\u044f\u043c\u043e \u043f\u0440\u0435\u0434\u0443\u043f\u0440\u0435\u0436\u0434\u0430\u0435\u0442 \u043e \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u044b\u0445 \u043f\u0430\u0434\u0435\u043d\u0438\u044f\u0445, \u0438\u0437\u043c\u0435\u043d\u0435\u043d\u0438\u044f\u0445 \u0432 \u0441\u0438\u0441\u0442\u0435\u043c\u0435 \u0438 \u043f\u043e\u0442\u0435\u0440\u0435 \u0434\u0430\u043d\u043d\u044b\u0445.\n\n\ud83d\udc31  GitHub PoC\n\n\ud83c\udf1a @poxek | \ud83c\udf1a @poxek_ai | \ud83d\udcf2 MAX", "creation_timestamp": "2026-07-26T07:01:46.240731Z"}, {"uuid": "52a35b11-12fa-4dbb-ba7a-fc2c9982849a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-10702", "type": "seen", "source": "https://t.me/zhatez/2805", "content": "IonStack: root Android 17 \u0441 \u043e\u0434\u043d\u043e\u0433\u043e URL\n\nNebula Security \u043f\u043e\u043a\u0430\u0437\u0430\u043b\u0430 IonStack \u2014 \u043f\u0443\u0431\u043b\u0438\u0447\u043d\u0443\u044e \u0434\u0435\u043c\u043e\u043d\u0441\u0442\u0440\u0430\u0446\u0438\u044e \u0446\u0435\u043f\u043e\u0447\u043a\u0438 Firefox \u2192 Linux kernel, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u043d\u0430 Android 17 \u043c\u043e\u0436\u0435\u0442 \u0434\u043e\u0432\u0435\u0441\u0442\u0438 \u043e\u0434\u0438\u043d \u043a\u043b\u0438\u043a \u043f\u043e URL \u0434\u043e root-\u0434\u043e\u0441\u0442\u0443\u043f\u0430. \u0412 \u0446\u0435\u043f\u043e\u0447\u043a\u0435 \u0434\u0432\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438: CVE-2026-10702, JIT miscompilation \u0432 JavaScript Engine Firefox, \u0437\u0430\u043a\u0440\u044b\u0442\u0430\u044f \u0432 Firefox 151.0.3, \u0438 CVE-2026-43499 GhostLock \u2014 use-after-free \u0432 rtmutex/futex-PI \u043a\u043e\u0434\u0435 \u044f\u0434\u0440\u0430 Linux.\n\n\u0422\u0435\u0445\u043d\u0438\u0447\u0435\u0441\u043a\u0438 \u044d\u0442\u043e browser-to-kernel full chain. \u0421\u043d\u0430\u0447\u0430\u043b\u0430 \u0431\u0430\u0433 \u0432 Firefox \u0434\u0430\u0435\u0442 \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0435 \u043a\u043e\u0434\u0430 \u0432 \u043a\u043e\u043d\u0442\u0435\u043a\u0441\u0442\u0435 \u0431\u0440\u0430\u0443\u0437\u0435\u0440\u0430, \u0437\u0430\u0442\u0435\u043c \u043b\u043e\u043a\u0430\u043b\u044c\u043d\u0430\u044f kernel LPE \u043f\u0440\u043e\u0431\u0438\u0432\u0430\u0435\u0442 \u0438\u0437\u043e\u043b\u044f\u0446\u0438\u044e \u0438 \u043f\u043e\u0432\u044b\u0448\u0430\u0435\u0442 \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0438. \u0423 GhostLock \u043c\u0435\u0445\u0430\u043d\u0438\u043a\u0430: \u043e\u0431\u044b\u0447\u043d\u044b\u0435 threading/futex syscalls \u043e\u0441\u0442\u0430\u0432\u043b\u044f\u044e\u0442 \u0432\u0438\u0441\u044f\u0447\u0438\u0439 \u0443\u043a\u0430\u0437\u0430\u0442\u0435\u043b\u044c \u043d\u0430 \u0441\u0442\u0435\u043a \u044f\u0434\u0440\u0430; \u043f\u043e \u0434\u0430\u043d\u043d\u044b\u043c Nebula, \u0443\u044f\u0437\u0432\u0438\u043c\u044b\u0439 \u0434\u0438\u0430\u043f\u0430\u0437\u043e\u043d \u2014 Linux 2.6.39-rc1 \u0434\u043e 7.1-rc1 \u043f\u0440\u0438 CONFIG_FUTEX_PI=y, \u0430 \u0438\u0445 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u044f \u0432 kernelCTF \u0431\u044b\u043b\u0430 \u043e\u043a\u043e\u043b\u043e 97% \u0441\u0442\u0430\u0431\u0438\u043b\u044c\u043d\u043e\u0439.\n\n\u0412\u0430\u0436\u043d\u043e\u0435 \u043e\u0433\u0440\u0430\u043d\u0438\u0447\u0435\u043d\u0438\u0435: \u044d\u0442\u043e \u043f\u0443\u0431\u043b\u0438\u0447\u043d\u043e\u0435 \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u044c\u0441\u043a\u043e\u0435 \u0434\u0435\u043c\u043e \u0438 \u043e\u0442\u043a\u0440\u044b\u0442\u044b\u0439 PoC, \u0430 \u043d\u0435 \u043f\u043e\u0434\u0442\u0432\u0435\u0440\u0436\u0434\u0435\u043d\u0438\u0435 \u043c\u0430\u0441\u0441\u043e\u0432\u043e\u0439 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438. Android-\u0447\u0430\u0441\u0442\u044c \u0437\u0430\u0432\u0438\u0441\u0438\u0442 \u043e\u0442 Firefox/Fenix \u0438 \u043a\u043e\u043d\u043a\u0440\u0435\u0442\u043d\u043e\u0439 \u043f\u043e\u0434\u0434\u0435\u0440\u0436\u043a\u0438 \u044f\u0434\u0440\u0430 \u043d\u0430 \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432\u0435; \u043d\u0430 \u0434\u0435\u043c\u043e-\u0441\u0430\u0439\u0442\u0435 Nebula \u043f\u0440\u044f\u043c\u043e \u043f\u0440\u0435\u0434\u0443\u043f\u0440\u0435\u0436\u0434\u0430\u0435\u0442 \u043e \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u044b\u0445 \u043f\u0430\u0434\u0435\u043d\u0438\u044f\u0445, \u0438\u0437\u043c\u0435\u043d\u0435\u043d\u0438\u044f\u0445 \u0432 \u0441\u0438\u0441\u0442\u0435\u043c\u0435 \u0438 \u043f\u043e\u0442\u0435\u0440\u0435 \u0434\u0430\u043d\u043d\u044b\u0445.\n\n\ud83d\udc31  GitHub PoC\n\n\ud83c\udf1a @poxek | \ud83c\udf1a @poxek_ai | \ud83d\udcf2 MAX", "creation_timestamp": "2026-07-27T00:01:30.707978Z"}, {"uuid": "66e0d8eb-1f00-4d22-8194-2af0e77a0ead", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-10702", "type": "published-proof-of-concept", "source": "https://t.me/zhatez/2805", "content": "IonStack: root Android 17 \u0441 \u043e\u0434\u043d\u043e\u0433\u043e URL\n\nNebula Security \u043f\u043e\u043a\u0430\u0437\u0430\u043b\u0430 IonStack \u2014 \u043f\u0443\u0431\u043b\u0438\u0447\u043d\u0443\u044e \u0434\u0435\u043c\u043e\u043d\u0441\u0442\u0440\u0430\u0446\u0438\u044e \u0446\u0435\u043f\u043e\u0447\u043a\u0438 Firefox \u2192 Linux kernel, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u043d\u0430 Android 17 \u043c\u043e\u0436\u0435\u0442 \u0434\u043e\u0432\u0435\u0441\u0442\u0438 \u043e\u0434\u0438\u043d \u043a\u043b\u0438\u043a \u043f\u043e URL \u0434\u043e root-\u0434\u043e\u0441\u0442\u0443\u043f\u0430. \u0412 \u0446\u0435\u043f\u043e\u0447\u043a\u0435 \u0434\u0432\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438: CVE-2026-10702, JIT miscompilation \u0432 JavaScript Engine Firefox, \u0437\u0430\u043a\u0440\u044b\u0442\u0430\u044f \u0432 Firefox 151.0.3, \u0438 CVE-2026-43499 GhostLock \u2014 use-after-free \u0432 rtmutex/futex-PI \u043a\u043e\u0434\u0435 \u044f\u0434\u0440\u0430 Linux.\n\n\u0422\u0435\u0445\u043d\u0438\u0447\u0435\u0441\u043a\u0438 \u044d\u0442\u043e browser-to-kernel full chain. \u0421\u043d\u0430\u0447\u0430\u043b\u0430 \u0431\u0430\u0433 \u0432 Firefox \u0434\u0430\u0435\u0442 \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0435 \u043a\u043e\u0434\u0430 \u0432 \u043a\u043e\u043d\u0442\u0435\u043a\u0441\u0442\u0435 \u0431\u0440\u0430\u0443\u0437\u0435\u0440\u0430, \u0437\u0430\u0442\u0435\u043c \u043b\u043e\u043a\u0430\u043b\u044c\u043d\u0430\u044f kernel LPE \u043f\u0440\u043e\u0431\u0438\u0432\u0430\u0435\u0442 \u0438\u0437\u043e\u043b\u044f\u0446\u0438\u044e \u0438 \u043f\u043e\u0432\u044b\u0448\u0430\u0435\u0442 \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0438. \u0423 GhostLock \u043c\u0435\u0445\u0430\u043d\u0438\u043a\u0430: \u043e\u0431\u044b\u0447\u043d\u044b\u0435 threading/futex syscalls \u043e\u0441\u0442\u0430\u0432\u043b\u044f\u044e\u0442 \u0432\u0438\u0441\u044f\u0447\u0438\u0439 \u0443\u043a\u0430\u0437\u0430\u0442\u0435\u043b\u044c \u043d\u0430 \u0441\u0442\u0435\u043a \u044f\u0434\u0440\u0430; \u043f\u043e \u0434\u0430\u043d\u043d\u044b\u043c Nebula, \u0443\u044f\u0437\u0432\u0438\u043c\u044b\u0439 \u0434\u0438\u0430\u043f\u0430\u0437\u043e\u043d \u2014 Linux 2.6.39-rc1 \u0434\u043e 7.1-rc1 \u043f\u0440\u0438 CONFIG_FUTEX_PI=y, \u0430 \u0438\u0445 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u044f \u0432 kernelCTF \u0431\u044b\u043b\u0430 \u043e\u043a\u043e\u043b\u043e 97% \u0441\u0442\u0430\u0431\u0438\u043b\u044c\u043d\u043e\u0439.\n\n\u0412\u0430\u0436\u043d\u043e\u0435 \u043e\u0433\u0440\u0430\u043d\u0438\u0447\u0435\u043d\u0438\u0435: \u044d\u0442\u043e \u043f\u0443\u0431\u043b\u0438\u0447\u043d\u043e\u0435 \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u044c\u0441\u043a\u043e\u0435 \u0434\u0435\u043c\u043e \u0438 \u043e\u0442\u043a\u0440\u044b\u0442\u044b\u0439 PoC, \u0430 \u043d\u0435 \u043f\u043e\u0434\u0442\u0432\u0435\u0440\u0436\u0434\u0435\u043d\u0438\u0435 \u043c\u0430\u0441\u0441\u043e\u0432\u043e\u0439 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438. Android-\u0447\u0430\u0441\u0442\u044c \u0437\u0430\u0432\u0438\u0441\u0438\u0442 \u043e\u0442 Firefox/Fenix \u0438 \u043a\u043e\u043d\u043a\u0440\u0435\u0442\u043d\u043e\u0439 \u043f\u043e\u0434\u0434\u0435\u0440\u0436\u043a\u0438 \u044f\u0434\u0440\u0430 \u043d\u0430 \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432\u0435; \u043d\u0430 \u0434\u0435\u043c\u043e-\u0441\u0430\u0439\u0442\u0435 Nebula \u043f\u0440\u044f\u043c\u043e \u043f\u0440\u0435\u0434\u0443\u043f\u0440\u0435\u0436\u0434\u0430\u0435\u0442 \u043e \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u044b\u0445 \u043f\u0430\u0434\u0435\u043d\u0438\u044f\u0445, \u0438\u0437\u043c\u0435\u043d\u0435\u043d\u0438\u044f\u0445 \u0432 \u0441\u0438\u0441\u0442\u0435\u043c\u0435 \u0438 \u043f\u043e\u0442\u0435\u0440\u0435 \u0434\u0430\u043d\u043d\u044b\u0445.\n\n\ud83d\udc31  GitHub PoC\n\n\ud83c\udf1a @poxek | \ud83c\udf1a @poxek_ai | \ud83d\udcf2 MAX", "creation_timestamp": "2026-07-28T22:00:05.712774Z"}, {"uuid": "22f473c3-88be-4c57-836d-cde154910f45", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-10702", "type": "published-proof-of-concept", "source": "https://t.me/zhatez/2805", "content": "IonStack: root Android 17 \u0441 \u043e\u0434\u043d\u043e\u0433\u043e URL\n\nNebula Security \u043f\u043e\u043a\u0430\u0437\u0430\u043b\u0430 IonStack \u2014 \u043f\u0443\u0431\u043b\u0438\u0447\u043d\u0443\u044e \u0434\u0435\u043c\u043e\u043d\u0441\u0442\u0440\u0430\u0446\u0438\u044e \u0446\u0435\u043f\u043e\u0447\u043a\u0438 Firefox \u2192 Linux kernel, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u043d\u0430 Android 17 \u043c\u043e\u0436\u0435\u0442 \u0434\u043e\u0432\u0435\u0441\u0442\u0438 \u043e\u0434\u0438\u043d \u043a\u043b\u0438\u043a \u043f\u043e URL \u0434\u043e root-\u0434\u043e\u0441\u0442\u0443\u043f\u0430. \u0412 \u0446\u0435\u043f\u043e\u0447\u043a\u0435 \u0434\u0432\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438: CVE-2026-10702, JIT miscompilation \u0432 JavaScript Engine Firefox, \u0437\u0430\u043a\u0440\u044b\u0442\u0430\u044f \u0432 Firefox 151.0.3, \u0438 CVE-2026-43499 GhostLock \u2014 use-after-free \u0432 rtmutex/futex-PI \u043a\u043e\u0434\u0435 \u044f\u0434\u0440\u0430 Linux.\n\n\u0422\u0435\u0445\u043d\u0438\u0447\u0435\u0441\u043a\u0438 \u044d\u0442\u043e browser-to-kernel full chain. \u0421\u043d\u0430\u0447\u0430\u043b\u0430 \u0431\u0430\u0433 \u0432 Firefox \u0434\u0430\u0435\u0442 \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0435 \u043a\u043e\u0434\u0430 \u0432 \u043a\u043e\u043d\u0442\u0435\u043a\u0441\u0442\u0435 \u0431\u0440\u0430\u0443\u0437\u0435\u0440\u0430, \u0437\u0430\u0442\u0435\u043c \u043b\u043e\u043a\u0430\u043b\u044c\u043d\u0430\u044f kernel LPE \u043f\u0440\u043e\u0431\u0438\u0432\u0430\u0435\u0442 \u0438\u0437\u043e\u043b\u044f\u0446\u0438\u044e \u0438 \u043f\u043e\u0432\u044b\u0448\u0430\u0435\u0442 \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0438. \u0423 GhostLock \u043c\u0435\u0445\u0430\u043d\u0438\u043a\u0430: \u043e\u0431\u044b\u0447\u043d\u044b\u0435 threading/futex syscalls \u043e\u0441\u0442\u0430\u0432\u043b\u044f\u044e\u0442 \u0432\u0438\u0441\u044f\u0447\u0438\u0439 \u0443\u043a\u0430\u0437\u0430\u0442\u0435\u043b\u044c \u043d\u0430 \u0441\u0442\u0435\u043a \u044f\u0434\u0440\u0430; \u043f\u043e \u0434\u0430\u043d\u043d\u044b\u043c Nebula, \u0443\u044f\u0437\u0432\u0438\u043c\u044b\u0439 \u0434\u0438\u0430\u043f\u0430\u0437\u043e\u043d \u2014 Linux 2.6.39-rc1 \u0434\u043e 7.1-rc1 \u043f\u0440\u0438 CONFIG_FUTEX_PI=y, \u0430 \u0438\u0445 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u044f \u0432 kernelCTF \u0431\u044b\u043b\u0430 \u043e\u043a\u043e\u043b\u043e 97% \u0441\u0442\u0430\u0431\u0438\u043b\u044c\u043d\u043e\u0439.\n\n\u0412\u0430\u0436\u043d\u043e\u0435 \u043e\u0433\u0440\u0430\u043d\u0438\u0447\u0435\u043d\u0438\u0435: \u044d\u0442\u043e \u043f\u0443\u0431\u043b\u0438\u0447\u043d\u043e\u0435 \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u044c\u0441\u043a\u043e\u0435 \u0434\u0435\u043c\u043e \u0438 \u043e\u0442\u043a\u0440\u044b\u0442\u044b\u0439 PoC, \u0430 \u043d\u0435 \u043f\u043e\u0434\u0442\u0432\u0435\u0440\u0436\u0434\u0435\u043d\u0438\u0435 \u043c\u0430\u0441\u0441\u043e\u0432\u043e\u0439 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438. Android-\u0447\u0430\u0441\u0442\u044c \u0437\u0430\u0432\u0438\u0441\u0438\u0442 \u043e\u0442 Firefox/Fenix \u0438 \u043a\u043e\u043d\u043a\u0440\u0435\u0442\u043d\u043e\u0439 \u043f\u043e\u0434\u0434\u0435\u0440\u0436\u043a\u0438 \u044f\u0434\u0440\u0430 \u043d\u0430 \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432\u0435; \u043d\u0430 \u0434\u0435\u043c\u043e-\u0441\u0430\u0439\u0442\u0435 Nebula \u043f\u0440\u044f\u043c\u043e \u043f\u0440\u0435\u0434\u0443\u043f\u0440\u0435\u0436\u0434\u0430\u0435\u0442 \u043e \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u044b\u0445 \u043f\u0430\u0434\u0435\u043d\u0438\u044f\u0445, \u0438\u0437\u043c\u0435\u043d\u0435\u043d\u0438\u044f\u0445 \u0432 \u0441\u0438\u0441\u0442\u0435\u043c\u0435 \u0438 \u043f\u043e\u0442\u0435\u0440\u0435 \u0434\u0430\u043d\u043d\u044b\u0445.\n\n\ud83d\udc31  GitHub PoC\n\n\ud83c\udf1a @poxek | \ud83c\udf1a @poxek_ai | \ud83d\udcf2 MAX", "creation_timestamp": "2026-07-29T00:00:12.170681Z"}, {"uuid": "a36f5745-e726-4a8e-9ab8-6abb236d6cfe", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-10702", "type": "seen", "source": "https://bsky.app/profile/bitnewsbot.bsky.social/post/3mrrwqg5e4m2x", "content": "Critical Firefox JIT flaw (CVE-2026-10702) enables remote code execution via a malicious webpage, patched in Firefox 151.0.3. The vulnerability also [\u2026]", "creation_timestamp": "2026-07-29T12:34:22.167662Z"}, {"uuid": "72cc6a5b-05b0-45bb-a17f-70f1aad06a55", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-10702", "type": "seen", "source": "https://bsky.app/profile/thedailytechfeed.com/post/3mrrwwl6wsc2d", "content": "Firefox CVE-2026-10702 enables remote code execution via malicious sites. Update to 151.0.3 now. #Firefox #CVE202610702 #CyberSecurity #BrowserSecurity #Mozilla #SoftwareUpdate thedailytechfeed.com/critical-fir...", "creation_timestamp": "2026-07-29T12:37:49.764080Z"}, {"uuid": "9537212a-67da-4379-89d6-b6278eefc059", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-10702", "type": "seen", "source": "https://t.me/thehackernews/9648", "content": "\ud83d\uded1 One malicious webpage visit was enough to compromise Tor Browser. No settings changes. No extra clicks.\n\nFirefox JIT flaw, CVE-2026-10702, runs code inside the browser\u2019s renderer process and forms the first stage of an Android 17 root chain.\n\nRead how the exploit works: https://thehackernews.com/2026/07/researchers-show-single-malicious.html", "creation_timestamp": "2026-07-29T13:00:06.341982Z"}, {"uuid": "c1453d77-1b92-468b-a2fc-3f51278077a4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-10702", "type": "seen", "source": "https://thehackernews.com/2026/07/researchers-show-single-malicious.html", "content": "Nebula Security says a patched Firefox JIT flaw could be triggered by simply visiting a malicious webpage and was also used to compromise Tor Browser.\n\nTracked as CVE-2026-10702, the bug provides arbitrary code execution inside the browser's renderer process. Mozilla rated it High and fixed it in the Firefox 151.0.3 update.\n\n\"No settings or additional user interaction are required,\" Eten Zou,", "creation_timestamp": "2026-07-29T13:00:55.592221Z"}, {"uuid": "dc71ec49-ffc7-4b55-bb5e-8000745748fa", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-10702", "type": "seen", "source": "https://bsky.app/profile/deafnews-auto.bsky.social/post/3mrryqeten32u", "content": "CVE-2026-10702: One Click Is All It Takes to Compromise Tor Browser", "creation_timestamp": "2026-07-29T13:10:08.898076Z"}, {"uuid": "02f51c75-0e85-4fe9-9fbf-fe1d92e1506e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-10702", "type": "seen", "source": "https://bsky.app/profile/thedailytechfeed.com/post/3mrs3q6lmsb2g", "content": "Tor Browser's CVE-2026-10702 flaw enables remote code execution. Update now to stay secure. #TorBrowser #CVE202610702 #CyberSecurity #Privacy #Mozilla #SpiderMonkey thedailytechfeed.com/critical-vul...", "creation_timestamp": "2026-07-29T14:03:45.931779Z"}, {"uuid": "c1caf7d3-f143-40f5-a7e6-84b0daa68a0f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-10702", "type": "seen", "source": "https://bsky.app/profile/newssecia.bsky.social/post/3mrs26ukw2n2p", "content": "\ud83e\udd16 CVE-2026-10702 (CVSS 8.8): Firefox JIT flaw allows RCE in the renderer via a single malicious webpage visit. Also affects Tor Browser. Patched in Firefox 151.0.3. PoC by Nebula Security.\nhttps://thehackernews.com/2026/07/researchers-show-single-malicious.html", "creation_timestamp": "2026-07-29T13:36:08.416550Z"}, {"uuid": "3f5835f9-0313-4dfa-990d-7a3e17942a73", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-10702", "type": "seen", "source": "https://bsky.app/profile/postac001.bsky.social/post/3mrs52qxpqy23", "content": "Firefox JIT\u8106\u5f31\u6027\uff08CVE-2026-10702\uff09\u306b\u3088\u308a\u3001\u60aa\u610f\u306e\u3042\u308bWeb\u30da\u30fc\u30b8\u8a2a\u554f\u3060\u3051\u3067Tor Browser\u304c\u4e57\u3063\u53d6\u3089\u308c\u308b\u3002\u30ec\u30f3\u30c0\u30e9\u30fc\u30d7\u30ed\u30bb\u30b9\u3067\u4efb\u610f\u306e\u30b3\u30fc\u30c9\u5b9f\u884c\u304c\u53ef\u80fd\u3002", "creation_timestamp": "2026-07-29T14:27:32.743641Z"}, {"uuid": "c795da3f-43a4-4e2c-84ee-d23ca95eb429", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-10702", "type": "seen", "source": "https://gist.github.com/alon710/6a6c10a8f46d4e89fabacfe7e2463a97", "content": "# CVE-2026-10702: CVE-2026-10702: JIT Miscompilation Type Confusion in Mozilla SpiderMonkey\n\n> **CVSS Score:** 4.3\n> **Published:** 2026-06-02\n> **Full Report:** https://cvereports.com/reports/CVE-2026-10702\n\n## Summary\nA type confusion vulnerability exists in the optimizing JIT compilation pipeline of Mozilla SpiderMonkey (Firefox) prior to version 151.0.3. An error in the JIT compiler's Range Analysis optimization pass allows the unsafe elimination of critical type guards. Under specific execution flows, an unauthenticated remote attacker can trigger a mismatch between predicted compile-time types and actual runtime types, resulting in memory corruption and arbitrary code execution within the browser's sandbox environment.\n\n## TL;DR\nA type confusion vulnerability in the Firefox SpiderMonkey JIT compiler allows remote code execution when an optimizing pass incorrectly removes critical type guards during range analysis.\n\n## Technical Details\n\n- **CWE ID**: CWE-843\n- **Attack Vector**: Network (AV:N)\n- **CVSS Base Score**: 4.3 (Medium)\n- **EPSS Score**: 0.00553 (0.553% probability)\n- **Exploit Status**: None (No public exploits or PoC exist)\n- **CISA KEV Status**: Not Listed\n\n## Affected Systems\n\n- Mozilla Firefox\n- NixOS (Firefox packages)\n- Ubuntu Linux (firefox-esr and firefox snap/deb packages)\n- Alpine Linux (firefox packages)\n- Wolfi / Chainguard (downstream node/browser engines using SpiderMonkey)\n- Homebrew (macOS environment packages)\n\n## Mitigation\n\n- Upgrade Mozilla Firefox to version 151.0.3 or higher.\n- Disable JIT compilation in environments where immediate patching is not possible.\n\n**Remediation Steps:**\n1. Determine all endpoints running Firefox versions older than 151.0.3.\n2. Apply updates via local package manager or enterprise-wide silent installers.\n3. For unpatched installations, configure 'javascript.options.ion' to false in about:config.\n\n## References\n\n- [https://bugzilla.mozilla.org/show_bug.cgi?id=2040903](https://bugzilla.mozilla.org/show_bug.cgi?id=2040903)\n- [https://www.mozilla.org/security/advisories/mfsa2026-54/](https://www.mozilla.org/security/advisories/mfsa2026-54/)\n- [https://access.redhat.com/security/cve/CVE-2026-10702](https://access.redhat.com/security/cve/CVE-2026-10702)\n- [https://bugzilla.redhat.com/show_bug.cgi?id=2484118](https://bugzilla.redhat.com/show_bug.cgi?id=2484118)\n- [https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-10702.json](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-10702.json)\n- [https://www.wiz.io/vulnerability-database/cve/cve-2026-10702](https://www.wiz.io/vulnerability-database/cve/cve-2026-10702)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-10702) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-07-29T14:31:27.772753Z"}, {"uuid": "9a83dc66-992d-4e4b-b8f4-4605fd7656a3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-10702", "type": "seen", "source": "https://bsky.app/profile/cerberusit.bsky.social/post/3mrsgddx3dr23", "content": "Tor Browser users expecting total privacy have had their day ruined by a patched Firefox JIT vulnerability known as CVE-2026-10702. Apparently, visiting a single dodgy web page was all it took for arbitrary code execution to crash the whole secret party. Protecting ourselves from...\n\nRead full story", "creation_timestamp": "2026-07-29T17:13:23.778968Z"}, {"uuid": "d0888a09-0e71-4969-a0f6-4e3b3ea55525", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-10702", "type": "seen", "source": "Telegram/9Sw1HR_bxq2cTalbzEbNjiydHiXf9JBHmfm-uNYFs6ArOw", "content": "", "creation_timestamp": "2026-07-30T00:00:03.712654Z"}, {"uuid": "f8ff4176-9526-45c7-9a71-cfda284a4a9c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-10702", "type": "published-proof-of-concept", "source": "https://t.me/thehackernews/9648", "content": "\ud83d\uded1 One malicious webpage visit was enough to compromise Tor Browser. No settings changes. No extra clicks.\n\nFirefox JIT flaw, CVE-2026-10702, runs code inside the browser\u2019s renderer process and forms the first stage of an Android 17 root chain.\n\nRead how the exploit works: https://thehackernews.com/2026/07/researchers-show-single-malicious.html", "creation_timestamp": "2026-07-30T00:00:28.895744Z"}]}