Mozilla plans staggered Firefox fixes to blunt AI patch-gap attacks
Mozilla says it now ships weekly, withholds regression tests, and will stagger sandbox-layer fixes so their patch windows do not overlap.
52
Product
Firefox
- Mentions · 7d11
- Mentions · 30d40
- All mentions64
- First seenAug 11, 2026
- Last mentioned19h ago
Timeline
64 articles · newest firstEssay argues open-weight models have not caused a cyber step change
The author says a leaked Claude Mythos would have accelerated incidents, not collapsed infrastructure, and cites GLM-5.3 a month after release.
34
GLM 5.3 built Firefox exploit chains from public patch gaps
Epoch AI says each successful chain cost about $1,000 and Mozilla fixed the rediscovered bug in Firefox 159.0.
76
Malicious Firefox extensions impersonate Phantom, Jupiter, and Bitget
Socket says the add-ons stole recovery phrases and private keys; the Phantom copy sent secrets to Telegram and moved funds.
54
Qualys CISO urges tracking exposure window over MTTR
Qualys TRU says 357 of 48,172 flaws disclosed in 2025 were remotely exploitable and weaponized.
28
Mozilla advisory AV26-1100 covers Firefox, ESR and Thunderbird flaws
Canada’s Cyber Centre lists builds before Firefox 159, ESR 115.44 and 153.6, and matching Thunderbird versions.
42
Chrome 156 and Firefox 159 patch more than 200 flaws
CVE-2026-118306 can run arbitrary code outside Chrome's sandbox from a crafted HTML page; no in-the-wild exploitation is mentioned.
70
Malicious Firefox extensions impersonated Phantom, Jupiter, and Bitget
Socket says the removed listings sent recovery phrases to bonto.io, and Phantom’s package included a multi-chain drainer.
54
Fake Phantom, Jupiter, and Bitget Firefox add-ons stole wallet keys
Socket identified add-on IDs 3092199, 3092666, and 3092059; a live config served a 4,029-byte payload.
54
Chrome 156 and Firefox 159 patch critical memory-safety flaws
Google shipped 52 fixes, four rated Critical, and Mozilla fixed 167 bugs; both credited AI-assisted bug finding.
64
Firefox Smart Window adds AI form filling and webpage monitoring
The US and Canada desktop beta sends selected open-tab text to Google’s Gemini 3.1 Flash Lite.
36
SecPRBench measures agentic security review on real bug-introducing commits
Recall spans 32.5% to 78.1% across eight frontier models on 265 tasks from nine systems, led by Grok 4.6 and GPT-6 sol.
48
eMudhra exits certificate business after weak intermediate keys
Eight intermediate keys were trivial values; browsers blocked them, and the firm says nothing was breached.
78
eMudhra ends certificate business after weak private keys cracked
Eight intermediate keys were integers below 256, one of them 4; major browsers blocked the certificates within days.
76
Firefox 153 ESR still trusts Comodo AAA, list reply says
Jakub Wilk says his Firefox 153 ESR still trusted the Comodo AAA certificate despite Mozilla bug 1957685.
36
eMudhra CA signing keys were so weak anyone could recover them
Eight intermediates from an April 2025 ceremony used keys under 256; browsers blocked them, and about 30,000 customer certificates need replacement.
86
eMudhra intermediate CA keys were single-byte and factorable
Eight April 2025 intermediates, also cross-signed by Sectigo, used P-384 private keys of one byte.
78
Browsers block eMudhra intermediate CAs with recoverable private keys
Eight April 2025 intermediates used near all-zero keys; browsers blocked them between October 17 and October 20.
78
Firefox will keep security-fix tests private for a week after release
Sec-high and sec-moderate fixes must ship without tests until the Tuesday after a Tuesday release.
32
Weak eMudhra keys expose eight trusted intermediate certificates
All eight P-384 private keys were integers below 256 and could be recovered from public certificate data.
78
Mozilla, Google and Apple block compromised eMudhra certificates
Eight April 2025 intermediates used private keys smaller than 256; no abuse is evidenced, but many trust stores needed updates.
74
Tech giants block eMudhra certificates tied to 8 compromised keys
Six keys issued website TLS certificates and two were for code signing; fraudulent issuance is unconfirmed.
78
eMudhra intermediate CA key compromise triggers browser blocks
Eight intermediates chaining to major browser roots were blocked; attacks on users are not confirmed.
84
Chrome and Firefox drop eMudhra root after certificate compromise
Whether Edge, Internet Explorer, cURL, and other private root stores still trust eMudhra is unconfirmed.
62
Eight eMudhra intermediate CA keys compromised; browsers block them
Chrome and Firefox blocked the TLS intermediates within hours of an October 17 report, and no website certificate chaining to them was in Certificate Transparency beforehand.
86
Mozilla alerts Firefox users after eMudhra intermediate compromise
The notice reached the distros list a day before this oss-security forward and points to a Mozilla security post.
70
Mozilla blocks eight compromised eMudhra intermediate certificates
OneCRL reached standard Firefox users in under three hours; 158.0.1 and two ESR builds cover the rest.
74
Mozilla security advisory (AV26-1057)
Canada’s Cyber Centre urges updates for Firefox, Firefox ESR, and Thunderbird flaws fixed in October 2026 releases.
32
Bank of America had to bring in 1,000 contractors to patch all the bugs Mythos identified
Bank of America hired 1,000 contractors to patch Anthropic Mythos findings amid large AML penalties.
62
Firefox Enterprise Adds DLP and AI Controls to Block Sensitive Data Leaks
Mozilla launched Firefox Enterprise 158 with self-hosted admin controls, built-in DLP, and restrictions on AI data sharing.
42
CastleStealer Malware Uses Browser Protection Bypass and Remote Shell to Expand Attacker Access
CastleStealer now bypasses Chromium App-Bound Encryption and adds a remote shell on Windows.
62
CastleStealer Malware Bypasses Chromium ABE and Adds Remote Command Execution Capabilities
CastleStealer now bypasses Chromium app-bound encryption, runs remote commands, and exfiltrates data over encrypted TCP.
56
New Anthropic OSS Scanner Tool to Scan Open-source Repositories for Vulnerabilities
Anthropic launched OSS Scanner, a free AI service that audits opted-in open-source projects and emails maintainers findings.
48
Hackers Use Fake Firefox Wallet Extensions to Steal Crypto Recovery Phrases
Sixteen malicious Firefox extensions impersonated crypto wallets and stole recovery phrases via Cloudflare Workers.
62
16 Malicious Firefox Extensions Pose as Rabby and OKX Wallets to Steal Recovery Phrases
Sixteen malicious Firefox extensions impersonating Rabby and OKX wallets stole recovery phrases via Cloudflare Workers.
64
Earth Sirrush Uses PNG Steganography and Malicious Notepad++ Plugins to Deploy Espionage Malware
Russia-aligned Earth Sirrush hides espionage malware in PNGs and Notepad++ plugins against Ukrainian government and defense targets.
74
ClickFix Smuggles Payloads Through Browser Cache to Bypass Windows Run Limits
Microsoft says ClickFix attacks now smuggle VBScript through the browser cache to bypass Windows Run limits.
64
ClickFix Fake CAPTCHA Attack Executes Malware Hidden Inside Browser Cache
ClickFix sites hide VBScript in the browser cache and trick users into running it.
71
Microsoft Warns ClickFix Attacks Use Fake CAPTCHA Lures to Execute Malicious Commands
Microsoft warns a ClickFix campaign uses fake CAPTCHA prompts so Windows users run cached malware that steals browser credentials.
74
New Infostealer Can Steal Passwords, Cards, Cookies and Wi-Fi Keys From Windows PCs
K7 Labs analyzed a Python infostealer builder that steals Windows browser secrets, cards, cookies, Discord tokens, and Wi-Fi passwords.
48
Related CVEs
by mentions- CVE-2025-68788<1%—Linux kernel: fsnotify: do not generate ACCESS/MODIFY events on child for special files inotify/fanotify do not allow users…
- CVE-2026-111943<1%6.8On most platforms, Go uses the given system root certificates
- Critical sandbox-escape memory corruption in Google Chrome FileSystem
- Heap Buffer Overflow in ANGLE Graphics Layer in Google Chrome for Android (<154.0.8037.92)
- Use-After-Free Allowing Sandbox Escape RCE in Google Chrome Before 153.0.8010.47
- CVE-2025-277383%6.5Improper access control in Windows Resilient File System (ReFS) allows an authorized attacker to disclose information over a network
- Cryptographic issue in the Security Block-lists, Allow-lists, and other State component
- Out-of-Bounds Read in WebGL Enables Sandbox Escape in Chrome on Android
- CVE-2026-64508<1%—Linux kernel: bpf: Support for hardening against JIT spraying
- CVE-2026-64507<1%—Linux kernel: x86/bugs: Enable IBPB flush on BPF JIT allocation Enable hardening against JIT spraying when Spectre-v2…
Appears with
- Mozillavendor · 38
- Googlevendor · 22
- Chromeproduct · 20
- Microsoftvendor · 19
- Mozillaorganization · 14
- eMudhravendor · 13
- Applevendor · 13
- Windowsproduct · 10
- Microsoft Edgeproduct · 6
- Socketorganization · 6
- Anthropicorganization · 6
- Firefox ESRproduct · 6
- Discordproduct · 5
- Thunderbirdproduct · 5
- Anthropicvendor · 5
- NSSproduct · 5
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.