The patch gap – the window between a security fix becoming publicly visible and its delivery to users – is an old problem. What is new is how cheaply it can be exploited: research institute Epoch AI has shown that GLM 5.3, a widely available open-weight model from Z.ai, was able to compromise six recent Firefox releases. Once the setup was in place, each additional attack cost about $1,000 in API fees. In parallel, Mozilla has explained how it intends to close the gap structurally.
Both publications are dated October 29, 2026. For users, the key message is simple: Firefox 159.0, released on October 27, fixes the vulnerability that every successful attack depended on. Anyone still running an older version should update now.
What Epoch AI found about the patch gap in Firefox
According to Epoch AI’s report, GLM 5.3 was tasked with building a webpage that, when simply visited with Firefox, reads a local file from the victim’s computer and sends it to the attacker’s server. The test environment was Ubuntu 26.04 with default security settings and the official Firefox build. The attack worked against all six versions tested, released between September 17 and October 26: 156.0, 156.0.1, 157.0, 157.0.1, 158.0 and 158.0.1. Earlier releases were not systematically tested.
The method is what matters. The model only received information that was public at the time of each release. It searched the source code for security fixes that had already landed but had not yet shipped, picked suitable vulnerabilities and built a multi-stage exploit chain on its own. Mozilla’s practice of disguising security fixes as ordinary improvements did not stop it: GLM 5.3 was able to read the code and work out which changes were security-related.
The attacks were not effortless. Epoch describes one attempt in which the model used an upcoming fix to find a memory safety flaw and gained the ability to read and modify memory inside the browser, yet Firefox’s protections still prevented it from reading the target file. Only additional stages produced a working attack. It was given up to 48 hours per attempt; the fastest successful run took 12 hours.
The role of the unpublished vulnerability
One detail puts the result in context without defusing it. Every successful attack chained two main components. A vulnerability taken from the patch gap gave the model code execution inside the web content process, the part of the browser that renders pages. To escape the sandbox and reach the file system, it used a second, previously unpublished vulnerability that GLM 5.3 rediscovered on every attempt.
Epoch reported this flaw to Mozilla. According to Epoch, it has been patched since Firefox 159.0 on October 27, 2026. The researchers say they have not yet confirmed whether similar attacks still work against 159.0, but expect the fix to make them at least substantially harder. By their own account, they did not achieve arbitrary code execution on the system with recent Firefox releases – the outcome was reading files.
That is serious enough. Epoch points out that such an exploit could be used to steal passwords stored in the browser or authentication cookies. Firefox has more than 200 million active users, according to the report.
Costs, safeguards and Chrome
The numbers are the real core of the study. Epoch spent more than $100,000 in API costs on its Firefox research in total, including building a realistic offline environment. Once the setup was working, the marginal cost per compromised Firefox version was roughly $1,000. The team deliberately emulated an attacker with limited resources; for safety, the model had no internet access.
Another point stands out: no provider, including Z.ai itself, triggered safeguards or refusals. Epoch framed the task as a security exercise, but says its actions were otherwise indistinguishable from those of a real attacker.
The same setup has so far failed against Google Chrome, even though Epoch spent about $100,000 on those attempts as well. The researchers explicitly do not treat this as evidence that Chrome is safe; better elicitation or stronger open models could succeed. They cite Moonshot AI’s Kimi K3.1 Pro, available via API since October 23 with weights planned for early November. Limited benchmark data suggests it may outperform GLM 5.3 on offensive cyber tasks. It was not part of the experiments.
How Mozilla plans to close the patch gap
On the Mozilla blog, Bobby Holley describes the countermeasures. Since February, the Firefox team has been hunting bugs with early access to frontier models from Anthropic and OpenAI and has so far shipped more than seven times as many security fixes as in the same period of 2025. Attackers, he writes, have access to models several generations behind. The patch gap, however, can undermine that lead, because attackers can work backwards from a public fix to the flaw in the old code.
Mozilla lists three steps it has already taken:
- Shipping faster: the release cycle was cut in half earlier this year, and new builds now ship every week.
- Holding back tests: GLM 5.3 is much less effective when no regression test is present, so Mozilla has reintroduced the practice of keeping those tests confidential until the fix has shipped.
- Commit scanning: every new change to the codebase is scanned for newly introduced bugs before it reaches a release.
On top of that comes a more structural approach. Firefox uses multiple sandbox layers, so an attacker generally needs at least a renderer exploit plus a sandbox escape. Mozilla plans to group fixes for these layers and stagger them so that their patch-gap windows do not overlap. At any given time, only one of the required ingredients would be publicly visible, and attackers would have to find the other from scratch. Holley says getting this right requires coordination across engineering processes and will take some time.
What the patch gap means beyond Firefox
Epoch does not see the problem as limited to browsers. Wherever a security fix becomes visible before it reaches users, the same attack surface appears. The researchers are especially concerned about software that is updated less often, such as router firmware or phone operating systems. Closed source offers only limited protection, because AI models are getting very good at decompiling programs. As an example, Epoch cites a case from September in which a vendor published patched PHP builds more than six hours before the coordinated release of fixes for two critical vulnerabilities. According to Epoch, this could have contributed to thousands of exploit attempts before the official release, which then climbed into the millions. How quickly critical PHP flaws get attacked was also shown recently by PHP2Shell. Mozilla itself reports a sharp increase in vulnerability disclosures and exploit activity in October.
Epoch’s advice to developers: keep security fixes private until they are ready to ship, move faster from beta to release, and avoid patching multiple vulnerabilities at the same time if they can be chained together. As a rule, they say, assume that once a fix is in published code, attackers can and will use it against the current release.
The study fits a trend we have covered repeatedly: AI agents lower the barrier for attacks that used to require specialist knowledge – from the breach of more than 100 companies with Claude Code and DeepSeek to automated exploit chains like this one.
What users and admins should do now
- Update Firefox: check under “Help” and “About Firefox” that at least version 159.0 is installed, then restart the browser.
- Keep automatic updates on: the patch gap also affects users who delay updates. Every day on an old version widens the window.
- Organizations: do not hold back browser updates in managed environments for weeks, and monitor the rollout.
- Developers and maintainers: review your own release process. How long are security fixes publicly visible before users receive them? Are regression tests published alongside them?
Analysis
According to Epoch, the specific attack chain is harder to pull off with Firefox 159.0, and Mozilla is responding visibly and structurally. It remains open how well the findings transfer to other software and whether stronger models such as Kimi K3.1 Pro make such attacks even easier. What is clear: capabilities that only a few attackers had a year ago now cost about $1,000 per target. For vendors, that means keeping the time between fix and release as short as possible – and for users, not putting off updates.
