Defending the patch gap against automated attackers
B · Useful, limited A first-hand Mozilla engineering post by Bobby Holley on concrete process changes in Firefox security releases, published the same day as Epoch's patch-gap exploit report; credible and specific on measures, but its main figure is self-reported and its claims about attacker models are not quantified.
Summary based on the full text·Original: about 5 minutes to read
In short
A Mozilla blog post (29 October 2026) by Bobby Holley. Since February the Firefox team has used early access to frontier models from Anthropic and OpenAI to find bugs, and has shipped more than seven times as many security fixes as in the same period of 2025. The risk that remains is the patch gap: attackers reverse-engineering a public fix before users update. Mozilla has shortened releases to weekly, keeps regression tests private until a fix ships, scans every commit, and plans to time fixes so that the pieces of an exploit chain are never exposed at once.
Key numbers
- more than seven timesFirefox security fixes shipped since February against the same period in 2025
- every weeknew Firefox release cadence after the cycle was cut in half this year
- at least a few dayspre-release testing each new browser version needs, which keeps a patch gap open
As reported by the source.
English·Web page·opens blog.mozilla.org
What it reports
- Frontier-model access has let Firefox apply successive model generations to its code. Holley says attackers' models are several generations behind and the bugs they can find have "largely been picked clean".
- Mozilla has seen evidence that models like GLM 5.3 can exploit some fixes for bugs found by more advanced models.
- Measures already in place: weekly releases (cycle cut in half); regression tests held back because GLM 5.3 is "much less effective" without them; scanning of all new commits.
- New structural defence: an attacker needs at least a renderer exploit and a sandbox escape. Mozilla will group fix classes so that their patch gaps do not overlap, forcing attackers to find at least one new flaw from scratch.
- October saw a sharp rise in disclosures and exploit activity across the internet. Mozilla says Firefox is better placed than most software, which has not had the same preparation.
- Mozilla will keep Firefox open source; tools that reconstruct source from binaries make closed code at best a speed bump.
How they got it
A policy and engineering statement from Mozilla's Firefox team. No data beyond the fix-count ratio is published; the GLM 5.3 observations are not quantified.
Limits
- The seven-times figure is self-reported, with no base number.
- The claim that attacker-accessible models are generations behind sits uneasily with Epoch's same-day report that GLM 5.3 compromised six recent Firefox releases.
- The separation of patch gaps is planned, not yet in operation.
- No timeline for the new approach.
Why it matters for companies
Read with Epoch's report, this shows a vendor changing release engineering in response to model-driven attacks: faster shipping, secret tests, scheduling fixes so exploit chains cannot be assembled from public code. For any firm that ships software to devices, the patch window is now a design decision. For firms that only consume software, the takeaway is shorter: install browser and client updates within days, not weeks.
Summary based on the full text. Read the original for the full argument and data.Read the original on blog.mozilla.org