Counted every Chrome and Firefox security fix from the last 12 months out of the official repos. The numbers moved a lot this spring.
This report analyzes the volume of security fixes in Chrome and Firefox over the last 12 months, highlighting a significant increase in the number of bugs fixed starting in early 2026. The increase correlates with the adoption of AI-assisted vulnerability discovery pipelines, notably Project Glasswing and Anthropic's Claude Mythos Preview model. While the number of CVEs and bugs fixed has surged, this does not necessarily indicate an increase in exploitable vulnerabilities or risk. Other vendors like Apple and Android have not shown similar increases despite access to the same AI models, suggesting that internal pipeline changes drive the volume. The data is based on official Mozilla advisories and CVE records, not press releases.
AI Analysis
Technical Summary
The investigation counts security fixes from official Mozilla advisories and CVE records for Chrome and Firefox from August 2025 to July 2026. Firefox bug fixes per release were stable until early 2026, then spiked dramatically, with some releases fixing hundreds of bugs. Chrome showed a similar pattern, with milestones 149 and 150 fixing more CVEs than the previous 23 combined. This surge coincides with the deployment of AI-assisted vulnerability discovery tools, including Anthropic's Claude Mythos Preview and Google's Gemini-based pipeline. Attribution is clearer for Firefox, where some CVEs credit Anthropic's red team, while Chrome CVEs lack reporter fields. Apple and Android CVE counts remained flat despite participation in Project Glasswing, indicating that AI access alone does not increase fix volume; pipeline integration is key. The report emphasizes that CVE counts do not equate to risk and that some volume is due to backlog clearing. AI-assisted discovery is becoming a significant factor in vulnerability identification but remains a minority contributor in some projects.
Potential Impact
The impact is an accelerated pace of vulnerability discovery and patching in Chrome and Firefox starting in early 2026, driven by AI-assisted tools integrated into their internal security pipelines. This results in a higher volume of fixes per release, potentially improving overall software security by addressing more issues. However, the increased number of CVEs does not imply a proportional increase in exploitable vulnerabilities or active threats. Other major vendors with access to the same AI models have not shown similar increases, indicating that the impact depends on how the AI tools are integrated into the development and security workflows.
Mitigation Recommendations
No direct mitigation is required from end users or defenders based on this report. The increased volume of fixes reflects improved internal vulnerability discovery processes by vendors. Users should continue to apply official security updates from their software vendors as usual. There is no indication of new or unpatched vulnerabilities requiring emergency action. Monitoring vendor advisories for updates remains best practice.
Counted every Chrome and Firefox security fix from the last 12 months out of the official repos. The numbers moved a lot this spring.
Description
This report analyzes the volume of security fixes in Chrome and Firefox over the last 12 months, highlighting a significant increase in the number of bugs fixed starting in early 2026. The increase correlates with the adoption of AI-assisted vulnerability discovery pipelines, notably Project Glasswing and Anthropic's Claude Mythos Preview model. While the number of CVEs and bugs fixed has surged, this does not necessarily indicate an increase in exploitable vulnerabilities or risk. Other vendors like Apple and Android have not shown similar increases despite access to the same AI models, suggesting that internal pipeline changes drive the volume. The data is based on official Mozilla advisories and CVE records, not press releases.
Reddit Discussion
I got curious about whether the AI vulnerability-finding stuff actually shows up in shipped patches, so I counted them from the source repos instead of press releases. Two git clones: mozilla/foundation-security-advisories (Mozilla's own advisory files) and CVEProject/cvelistV5 (the official CVE records). Couple of short scripts, no scraping.
Firefox, real bugs fixed per release. Mozilla hides a lot of volume in rollup CVEs (one CVE id can cover 100+ Bugzilla entries), so I expanded those:
* 140 to 147 (Jun 2025 - Jan 2026): 17 to 26 bugs per release, very stable
* 148 (Feb 24): 65
* 149 (Mar 24): 112
* 150 (Apr 21): 413
* 151 to 153 (May-Jul): 156, 120, 217
Chrome, CVEs per milestone: sat between 14 and 32 for all of 2025. Then 86, 123, 370, 582, 499, 411 for milestones 146 through 151. Milestones 149+150 alone fixed more than the previous 23 combined, which Google has confirmed in their own blog. They're moving Chrome to a two-week release cycle partly because of this.
Some context on attribution, because it's messier than I expected:
The February Firefox jump is credited to Anthropic's red team running Opus 4.6 (22 CVEs, named in the advisories). The April spike is partly Mythos Preview: Mozilla says 271 of the 413 bugs in Firefox 150 came from their agentic harness. For Chrome, Google says their pipeline started on Gemini and was later extended with other models they don't name, and Chrome CVE records have no reporter field at all, so there's no way to attribute those from public data.
Apple is a founding member of Project Glasswing and their CVE output is completely flat over the same window. Same for Google's own Android CVEs, weirdly. So having access to the models clearly isn't what does it. What matters is whether a specific product team rebuilt their discovery pipeline around them.
Of course, CVE counts are not risk counts, and vendor announcements count different things than CVE records, so don't mix the two.
Charts and CSVs: hephaestos.fr/sec/en
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The investigation counts security fixes from official Mozilla advisories and CVE records for Chrome and Firefox from August 2025 to July 2026. Firefox bug fixes per release were stable until early 2026, then spiked dramatically, with some releases fixing hundreds of bugs. Chrome showed a similar pattern, with milestones 149 and 150 fixing more CVEs than the previous 23 combined. This surge coincides with the deployment of AI-assisted vulnerability discovery tools, including Anthropic's Claude Mythos Preview and Google's Gemini-based pipeline. Attribution is clearer for Firefox, where some CVEs credit Anthropic's red team, while Chrome CVEs lack reporter fields. Apple and Android CVE counts remained flat despite participation in Project Glasswing, indicating that AI access alone does not increase fix volume; pipeline integration is key. The report emphasizes that CVE counts do not equate to risk and that some volume is due to backlog clearing. AI-assisted discovery is becoming a significant factor in vulnerability identification but remains a minority contributor in some projects.
Potential Impact
The impact is an accelerated pace of vulnerability discovery and patching in Chrome and Firefox starting in early 2026, driven by AI-assisted tools integrated into their internal security pipelines. This results in a higher volume of fixes per release, potentially improving overall software security by addressing more issues. However, the increased number of CVEs does not imply a proportional increase in exploitable vulnerabilities or active threats. Other major vendors with access to the same AI models have not shown similar increases, indicating that the impact depends on how the AI tools are integrated into the development and security workflows.
Defensive Guidance
No direct mitigation is required from end users or defenders based on this report. The increased volume of fixes reflects improved internal vulnerability discovery processes by vendors. Users should continue to apply official security updates from their software vendors as usual. There is no indication of new or unpatched vulnerabilities requiring emergency action. Monitoring vendor advisories for updates remains best practice.
Technical Details
- Source Type
- Subreddit
- cybersecurity
- Reddit Score
- 0
- Discussion Level
- minimal
- Content Source
- reddit_link_post
- Post Type
- link
- Domain
- null
- Newsworthiness Assessment
- {"score":30,"reasons":["external_link","newsworthy_keywords:security fix","established_author","very_recent"],"isNewsworthy":true,"foundNewsworthy":["security fix"],"foundNonNewsworthy":[]}
- Has External Source
- true
- Trusted Domain
- false
Threat ID: 6a7c62d8bf8831d539823ef2
Added to database: 08/12/2026, 12:11:04 UTC
Last enriched: 08/12/2026, 12:11:16 UTC
Last updated: 08/12/2026, 16:41:08 UTC
Views: 5
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.