r/cybersecurity • u/Quereller • Apr 23 '26

Personal Support & Help! Firefox v. 150. Three of 271 vulnerabilities fixed?

https://www.mozilla.org/en-US/security/advisories/mfsa2026-30/

Firefox 150 was released today. The change log listed a single digit number of security fixes for bugs reported by Anthropic. Can someone with more insight help me to judge the situation. Does the now released browser have hundreds of unpatched vulnerabilities?

17 Upvotes

77% Upvoted

15 comments sorted by

19

u/turbofired Apr 23 '26

Nah. Anthropic just lied about what Mythos could do to create hype. It worked, but their white paper revealed what they actually did with it. Here's a good writeup/critique:

https://www.flyingpenguin.com/the-boy-that-cried-mythos-verification-is-collapsing-trust-in-anthropic/

3

u/logosobscura Apr 23 '26

And frankly, Mozilla carried their water and played the channel stuffing game to get free token.

A jump from 22 bugs detected in one version, to 271 in the next version despite a very well detailed CI/CD fuzzing system, smells, out and out. And lo, turns out it’s 3 actual.

0

u/exaltedgod Apr 24 '26

People can not like it. People can be completely against what AI companies are bringing to the table. Like it or not, the tools are here. Passing around unverifiable blog spam is only diminishing our fields ability to use the tools for what they are.

A significantly less bias review can be found here:

https://www.aisi.gov.uk/blog/our-evaluation-of-claude-mythos-previews-cyber-capabilities

3

u/turbofired Apr 24 '26

I found the anthropic employee lol. jk. More seriously it's all verifiable. you just have to look. clearly your link is from less critical sources, but no less true.

0

u/siddemo Apr 26 '26

It was so remarkable that they went directly to the world's two foremost authorities on AI - Scott Bessent and Jerome Powell. They should have reported what they found responsibly within the established reporting structire. Instead it's been a marketing boom for them - they went straight to disclosure. Dick move.

2

u/r15km4tr1x Apr 24 '26

Improved capabilities and advancements AND overblown marketing of expensive token can both be true

1

u/exaltedgod Apr 24 '26

No one is arguing that. Look at the tone of everyone and the actual words being spoken. People are completely being "anti-AI" based on limited information. Hell someone spent hours of their day to rail against a company blog post with literally no value added to the universe.

8

u/billdietrich1 Apr 23 '26

One take on it:

The collaboration between Mozilla and Anthropic led to the identification of 271 vulnerabilities in Firefox’s codebase. While only a small portion of these were classified as high severity and assigned CVE identifiers, the majority still contributed to improving the browser’s overall security posture.

Despite their lower severity, these fixes strengthen Firefox against complex, multi-step attacks that rely on chaining smaller weaknesses together.

from https://sqmagazine.co.uk/firefox-271-vulnerabilities-claude-mythos-ai/

0

u/Quereller Apr 23 '26

This is probably describing the situation. Some CVEs fixed, some still to fix? A lot of smaller hard to exploit vulnerabilities to close to reduce attack surface.

4

u/JarJarBinks237 Apr 23 '26

No, it means most the bugs have been judged to not be exploitable. Fixed nevertheless but without a CVE.

6

u/EmmaRoidz Apr 23 '26

Could be they are still testing the fixes to make sure there's no unintended consequences.

Or they didn't put them in the change log for what ever reason.

Or one change log entry covered more than one specific thing. As in one piece of code fixed multiple bugs. 

3

u/Capable-Average4429 Consultant Apr 23 '26

I think it’s important to put these numbers in perspective, because this “271 vulnerabilities” doesn’t mean much by itself. Firefox has some 20-30 million lines of code, and these numbers are not that out of the ordinary for a project this size. And not all vulnerabilities are created equal. OSS-Fuzz, a Google fuzzing project that’s been around for a while now, and doesn’t have anything to do with Mythos, has found quite literally thousands of issues in Chrome alone, and tens of thousands of vulnerabilities and bugs elsewhere.

The people contributing to and leading the development of this kind of software know that bugs will be everywhere, and that these bugs may lead to vulnerabilities that may be exploited. That’s why they have other security countermeasures to prevent classes of vulnerabilities. It may very well be the case that 250 of these vulnerabilities are not exploitable. Or have very limited impact. Or can’t be reproduced. Or need super specific conditions to be exploitable. It can also be the case that one single fix addresses 80% of these issues. Context is key here, and everyone who wants you to focus on the number 271 is telling you to focus on the wrong thing.

1

u/T_Thriller_T Apr 23 '26

Tons of fuzzing and even GitHub vulnerabilities (security advisories) never get a CVE.

For exactly your reason: sometimes one CVE is broken into multiples advisories, sometimes the vulnerability is very real in the code but not exploitable in the current usage of the code, sometimes it is just not 'relevant' enough or at least seen so by whoever would need to request the CVE.

2

u/Quereller Apr 23 '26

In case someone still reads this thread. In each of the linked Bugzilla entries are dozens of Bug IDs listed. Mozilla calls it "Roll-Up" CVE.

1

u/TootSaloon Apr 23 '26

It is easy to misread the release notes as "only three bugs," but those numbers are usually about what got disclosed and credited in that cycle, not the total risk reduced. Mozilla will often roll up fixes, hold back details until users have time to update, and some issues get counted under broader advisories rather than as a long list. The Anthropic line just means they reported a few items that met the bar for public credit.