Mozilla has patched a JavaScript engine bug that let attackers run code inside Firefox's renderer process, and the Tor Project has now backported the fix to the browser its users rely on for anonymity.

The flaw, tracked as CVE-2026-10702 and nicknamed IonBanana, was fixed in Firefox 151.0.3 on June 2 under advisory MFSA-2026-54. Tor Browser stable, which tracks Firefox ESR, shipped the backport in 15.0.19 on July 21 — the same day researchers published their write-up.

The bug is notable less for what it does than for who caught it. Nebula Security credits the discovery to VEGA, an autonomous research agent — and the company points out that Firefox's JIT had already been picked over by Anthropic's Mythos model and hardened by a large last-minute batch of pre-Pwn2Own fixes. IonBanana survived all of it.

Nebula reported the issue to Mozilla on May 20. Engineers acknowledged the issue, identified the root cause, and fixed it the same day. The researchers' takeaway is blunt: JIT compilers still have plenty of places for a banana peel to hide.

A lie about side effects

Firefox compiles hot JavaScript into machine code through IonMonkey. To make that code fast, optimizer passes like GVN (global value numbering, which eliminates redundant work) rely on each instruction's declared "alias set" — a summary of which memory it accesses.

One instruction lied. When the JIT scalar-replaces an Object.keys() call, it emits MObjectToIterator, which declared itself read-only. In reality, enumerating a function forces SpiderMonkey to lazily resolve the length, name, and prototype properties the engine doesn't create until they're requested. If the object's slot buffer is full, that resolution reallocates it.

The optimizer, convinced nothing had moved, kept reusing a cached pointer to the freed buffer. The result is a use-after-free reachable from JavaScript that contains no visible memory writes. Nebula chained it with a 15-year-old Linux kernel privilege-escalation bug (CVE-2026-43499) into a full exploit it calls IonStack.

Mozilla's fix removes the bogus alias set entirely rather than patching it.

What to do

Update Firefox to 151.0.3 or later and Tor Browser to 15.0.19. Enterprise fleets on ESR should confirm that their builds include the backport. Tor users who want defense-in-depth can set the security slider to Safest, which disables JIT compilation and closes off this entire bug class.