Counted every Chrome and Firefox security fix from the last 12 months out of the official repos. The numbers moved a lot this spring.
Source Reddit Cybersecurity
Discussion
This report analyzes the volume of security fixes in Chrome and Firefox over the last 12 months, highlighting a significant increase in the number of bugs fixed starting in early 2026. The increase correlates with the adoption of AI-assisted vulnerability discovery pipelines, notably Project Glasswing and Anthropic's Claude Mythos Preview model. While the number of CVEs and bugs fixed has surged, this does not necessarily indicate an increase in exploitable vulnerabilities or risk. Other vendors like Apple and Android have not shown similar increases despite access to the same AI models, suggesting that internal pipeline changes drive the volume. The data is based on official Mozilla advisories and CVE records, not press releases.
r/cybersecurity (opens in a new tab)u/hephaestos_le_bancal0 points0 comments
I got curious about whether the AI vulnerability-finding stuff actually shows up in shipped patches, so I counted them from the source repos instead of press releases. Two git clones: mozilla/foundation-security-advisories (Mozilla's own advisory files) and CVEProject/cvelistV5 (the official CVE records). Couple of short scripts, no scraping.
Firefox, real bugs fixed per release. Mozilla hides a lot of volume in rollup CVEs (one CVE id can cover 100+ Bugzilla entries), so I expanded those:
* 140 to 147 (Jun 2025 - Jan 2026): 17 to 26 bugs per release, very stable
* 148 (Feb 24): 65
* 149 (Mar 24): 112
* 150 (Apr 21): 413
* 151 to 153 (May-Jul): 156, 120, 217
Chrome, CVEs per milestone: sat between 14 and 32 for all of 2025. Then 86, 123, 370, 582, 499, 411 for milestones 146 through 151. Milestones 149+150 alone fixed more than the previous 23 combined, which Google has confirmed in their own blog. They're moving Chrome to a two-week release cycle partly because of this.
Some context on attribution, because it's messier than I expected:
The February Firefox jump is credited to Anthropic's red team running Opus 4.6 (22 CVEs, named in the advisories). The April spike is partly Mythos Preview: Mozilla says 271 of the 413 bugs in Firefox 150 came from their agentic harness. For Chrome, Google says their pipeline started on Gemini and was later extended with other models they don't name, and Chrome CVE records have no reporter field at all, so there's no way to attribute those from public data.
Apple is a founding member of Project Glasswing and their CVE output is completely flat over the same window. Same for Google's own Android CVEs, weirdly. So having access to the models clearly isn't what does it. What matters is whether a specific product team rebuilt their discovery pipeline around them.
Of course, CVE counts are not risk counts, and vendor announcements count different things than CVE records, so don't mix the two.
Charts and CSVs: hephaestos.fr/sec/en