Firefox SpiderMonkey JIT Type Confusion (CVE-2026-10702)

Published: 2026-09-03 • Researcher: Nebula Security (NebuSec / CyberMeowfia)

Target software Mozilla Firefox (SpiderMonkey JIT engine)

Affected versions Firefox on Android (pre-patch)

Status PoC

Severity Medium · CVSS 4.3

CVSS 4.3/10

Severity: Medium
CVE: CVE-2026-10702
Category: binary
Affected product: Mozilla Firefox (SpiderMonkey JIT engine)
Affected versions: Firefox on Android (pre-patch)
Disclosed: 2026-09-03
Patch status: Unverified

Metadata

Field	Value
Date Added	2026-09-03
Author / Researcher	Nebula Security (NebuSec / CyberMeowfia)
CVE / Advisory	CVE-2026-10702
Category	binary
Severity	Medium
CVSS Score	4.3
Status	PoC
Tags	Firefox, SpiderMonkey, JIT, type confusion, browser, sandbox escape, IonStack, JavaScript

Affected Target

Field	Value
Software / System	Mozilla Firefox (SpiderMonkey JIT engine)
Versions Affected	Firefox on Android (pre-patch)
Language / Platform	HTML, JavaScript
Authentication Required	No (visit malicious page)
Network Access Required	Remote (browser navigation)

Summary

CVE-2026-10702 is a type confusion vulnerability in the Firefox SpiderMonkey JIT compiler. Nebula Security developed a browser-based exploit as part of their IonStack chain (Firefox sandbox escape stage). The exploit is delivered as an HTML page that triggers JIT compilation bugs to achieve code execution within the browser renderer. As a standalone bug, CVSS is 4.3 (Medium); its significance increases when chained with kernel exploits for full device compromise.

Environment / Lab Setup

Output

Browser:      Mozilla Firefox (Android, pre-patch)
Target:       Pixel 10 Pro / blazer (for IonStack chain)
Delivery:     HTML page loaded in browser

References

Notes

Part of Nebula Security IonStack chain (CVE-2026-10702 Firefox sandbox escape + CVE-2026-43499 kernel LPE = browser-to-root). Auto-ingested from https://github.com/NebuSec/CyberMeowfia on 2026-09-03.

ansi.js

javascript raw GitHub ↓ Download

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
(function () {
  const colors = {
    31: "#d32f2f",
    32: "#2e7d32",
    33: "#f9a825",
  };

  window.renderAnsiToFragment = function (input, ownerDocument) {
    const doc = ownerDocument || document;
    const fragment = doc.createDocumentFragment();
    const text = String(input || "");
    const pattern = /(?:\x1b|\\033|\\x1b)\[([0-9;]*)m/g;
    let offset = 0;
    let color = "";

    function append(value) {
      if (!value) {
        return;
      }
      if (!color) {
        fragment.appendChild(doc.createTextNode(value));
        return;
      }
      const span = doc.createElement("span");
      span.style.color = color;
      span.appendChild(doc.createTextNode(value));
      fragment.appendChild(span);
    }

    for (;;) {
      const match = pattern.exec(text);
      if (!match) {
        break;
      }
      append(text.slice(offset, match.index));
      offset = pattern.lastIndex;

      const raw = match[1] || "0";
      const parts = raw.split(";");
      for (let i = 0; i < parts.length; i++) {
        const code = Number(parts[i] || "0");
        if (code === 0) {
          color = "";
        } else if (Object.prototype.hasOwnProperty.call(colors, code)) {
          color = colors[code];
        }
      }
    }

    append(text.slice(offset));
    return fragment;
  };
}());