Mozilla says it withholds some Firefox regression tests until fixes ship, scans new commits for bugs and is introducing a structural defense against overlapping security gaps. The measures are its response to Epoch AI’s report that GLM 5.3 built working exploit chains against six Firefox releases in controlled tests.
What Epoch AI reported
Epoch defines a patch gap as the time between a security fix becoming public and reaching users. In tests using Firefox releases from September 17 to October 26, 2026, the organization reported successful exploit chains in all six versions it tested. The fastest successful attempt took 12 hours; each attempt could run for up to 48 hours. Epoch AI’s report
The model had no internet access. Researchers supplied the target browser version, basic tools and relevant public information, then gave an initial instruction to examine fixes that had not yet reached the stable release. Epoch says GLM 5.3 developed the exploit chains without further human input. The test objective was a webpage that could read a local file and send its contents to an attacker-controlled server after a visit, without another user action.
NeoTeo previously covered a separate GLM 5.3 security evaluation by Anthropic. That report covers a different test from Epoch’s Firefox experiment.
Mozilla’s current measures
Mozilla says it ships Firefox builds weekly, withholds some regression tests until fixes ship, and scans new commits for bugs before release. Regression tests check whether a code change has reintroduced a problem; keeping some tests confidential until a fix ships can limit what an attacker can learn from them. Mozilla CTO Bobby Holley described these measures in a post published October 29, 2026. Mozilla’s account
A structural defense against overlapping gaps
Mozilla is introducing a plan to coordinate fixes across browser security layers, with the aim of preventing patch gaps in different layers from overlapping. Mozilla says the approach requires engineering coordination and may take time to implement.
What Firefox 159.0 and Chrome show
Mozilla announced Firefox 159.0 on October 27, 2026, and its security advisory lists vulnerabilities fixed in that release. Epoch said Firefox 159.0 also patched the previously unpublished vulnerability used in its tests.
In separate attempts against Chrome using the same harness and techniques, Epoch did not produce an equivalent exploit, despite about $100,000 in API costs. That is the result of those reported attempts; it does not describe a broader test of every possible attack.
