Imagine you are one of Firefox’s 200 million users: you open a webpage, it loads, you don’t click anything. That alone may seem harmless. New experiments show that merely loading a page could allow an attacker to read files on your computer and exfiltrate passwords or authentication cookies stored in the browser — with no download, pop-up, or permission prompt. In other words, an attacker could obtain enough data to impersonate you on some online services.
What the researchers did: GLM 5.3 and the patch gap
The tests used GLM 5.3, an open-weight model released by Z.ai in August. The model was able to reverse-engineer upcoming Firefox security fixes and generate a webpage which, when visited by a Firefox user, read a file from the visitor’s machine and sent it to the attacker without any further user interaction.
The interval between a fix being published and the update reaching users is called the patch gap. That window is a known weakness in release practices, and it matters increasingly as AI models improve at discovering and exploiting vulnerabilities.
Setup and costs
The researchers simulated an unsophisticated attacker with limited resources, relying only on information available at each release. Their total research spending on API calls exceeded $100,000, covering the setup of a realistic offline environment and initial testing. Once the environment was in place, each successful attack cost about $1,000 in compute. GLM 5.3 was given up to 48 hours to find an exploit; its fastest successful attempt required 12 hours.
Chaining bugs to bypass protections
GLM 5.3 chained multiple vulnerabilities. For example, it spotted an upcoming Firefox fix for a memory bug and then developed an approach to read and modify browser memory. Because Firefox’s security protections initially prevented direct reading of the target file, the model combined the initial exploit with additional stages: diagnosing crashes, abandoning unsuccessful approaches, and iterating until simply visiting the generated webpage sufficed to access the file.
All successful attacks targeted six Firefox versions released between September 17 and October 26. The researchers reported an additional unpublished vulnerability used to bypass protections to Mozilla; that vulnerability was patched in Firefox 159.0 on October 27.
Results against Chrome and future models
Similar attacks against Google Chrome did not succeed, despite roughly $100,000 in compute spent on those attempts. The researchers caution, however, that this does not prove Chrome is immune: different prompts, more capable open-weight models, or more sophisticated attackers could achieve different outcomes. The Kimi K3.1 Pro weights, expected in early November, have early benchmark data suggesting they might outperform GLM 5.3 on this type of task.
Implications and mitigation
Open-source projects are particularly exposed to patch-gap exploitation, and AI is improving at decompiling runnable programs back into readable code, allowing models to analyze fixes even when code is not public — Anthropic demonstrated Mythos doing this on Windows. While the researchers did not test open-weight models for that specific capability, they expect the overall threat to grow as open-weight models’ cyber skills improve.
Recommended mitigations include keeping security fixes private until they can be deployed, accelerating the path from beta to stable releases, and avoiding bundling multiple, chainable fixes into a single public release when possible.
Firefox and Google Chrome now release updates weekly, but the researchers note that may still be too slow: they could create exploits in under two days, and real attackers could be faster. The prudent assumption, they say, is that once a fix appears in published code, attackers can and will use it against the current release.
Conclusion
The experiments suggest that widely available open-weight AI models lower the barrier for exploiting patch-gap windows. This increases the urgency for developers and browser vendors to shorten the time between publishing fixes and delivering them to end users, and to reconsider release practices that expose chainable vulnerabilities.
