Strengthening Firefox Security with Claude

Mozilla announced that by combining Claude Mythos Preview with its own agentic harness, it found and fixed 271 potential vulnerabilities in Firefox.

Initially, the noise from LLM-based security reports was high, but attaching a harness that generates and runs reproducible test cases turned it into a pipeline that filters out only real bugs. This system was built on top of existing fuzzing infrastructure, and was later parallelized across multiple VMs to scale up to file-level scanning.

This achievement was announced alongside the release of Firefox 150, and some patches were also included in 149.0.2, 150.0.1, and 150.0.2. Mozilla explained that over the course of April alone, a total of 423 security bugs were fixed, with internal rollup CVEs, external reports, and issues found by this harness all mixed together.

The issues found spanned the entire browser.

• Fake-object primitives related to WebAssembly GC and JIT
• IPC race conditions and sandbox escapes
• UAFs and overflows in XSLT, HTML table, and WebTransport
• Long-standing permission boundary and memory safety vulnerabilities

Mozilla stated that this approach is immediately applicable to other projects as well, and that it is considering integrating it into future CI pipelines to automatically scan patches as soon as they come in.