Threat video1:00
CVE-2026-10702 IonStack Firefox-to-Root: Detection & IOCs
VEGA chained a Firefox JIT bug with GhostLock for a one-click Android 17 root. 9 detection rules, 38 IOCs, 43 ATT&CK techniques and a free Splunk SPL rule.
Read the full threat intel for CVE-2026-10702 IonStack Firefox-to-Root: Detection & IOCs →
Chapters
- 0:00The hookAbout two zero-days chained into one-click Android root.
- 0:04The storyIn June, researchers demonstrated the chain.
- 0:11Attack pathA malicious URL, clicked, triggers IonMonkey miscompilation and code execution in the sandbox.
- 0:26AttributionNo threat actor: this was defensive research.
- 0:31Indicators of compromise7 indicators to hunt: 3 syscalls, 1 path and 1 hosting, and more.
- 0:38MITRE ATT&CK techniques43 ATT&CK techniques, from reconnaissance to impact.
- 0:43Remediation5 steps now: Update Firefox to version.
- 0:50Detection rules9 detection rules, in SPL, KQL and Sigma.
Transcript
0:00About two zero-days chained into one-click Android root.
0:05In June, researchers demonstrated the chain.
0:08Browser to kernel root in one-click.
0:12A malicious URL, clicked, triggers IonMonkey miscompilation and code execution in the sandbox.
0:18Then a fifteen-year-old Linux rtmutex flaw escalates to full root.
0:27No threat actor: this was defensive research.
0:317 indicators to hunt: 3 syscalls, 1 path and 1 hosting, and more.
0:3843 ATT&CK techniques, from reconnaissance to impact.
0:435 steps now: Update Firefox to version.
0:519 detection rules, in SPL, KQL and Sigma.
0:56Threadlinqs. The unified security engineering platform.