CVE-2026-10702 is a high-severity JIT compiler vulnerability in Firefox's MObjectToIterator function triggered when skipRegistration is set to true. Firefox's JIT compiler incorrectly labeled the operation as a read-only even though resolving a lazy property can allocate a replacement dynamic-slots buffer and free the old one. Global value numbering (GVN) then treated a later slots-buffer load as redundant and reused the earlier (now stale) pointer, creating a use-after-free condition. The Nebula Security exploit reclaims the freed allocation, leaks a hidden-class pointer, builds a fake object, and corrupts a Uint8Array to gain arbitrary memory read/write. On Android, it then changes memory protections and redirects a WebAssembly function entry point to ARM64 shellcode. The exploit requires no user interaction beyond visiting a malicious webpage and provides arbitrary code execution inside Firefox's sandboxed renderer process. Nebula Security used this as the first stage of a full browser-to-kernel chain called 'IonStack', combining it with a second-stage Linux kernel futex vulnerability (CVE-2026-43499, dubbed 'GhostLock') to achieve root on an ARM64 Android 17 device. The flaw was introduced in Firefox 147 via Bug 1995077 and is present through Firefox 151.0.2. Firefox ESR 140.12 is not affected. Mozilla's fix removes the custom read-only alias handling from ObjectToIterator and adjusts the related iterator operation. As of July 28, 2026, no in-the-wild exploitation has been confirmed.