A browser exploit for about $1,000: the patch gap now has a price

Facts are attributed and linked to their sources. The analysis and opinions are the author's own.

What it is

On 29 October Epoch AI published a test in which GLM 5.3, an open-weight model Z.ai released in August, built exploits against all six Firefox releases from 17 September to 26 October, versions 156.0 to 158.0.1. In each case, visiting a web page was enough to read a local file and send it out. The marginal cost was about $1,000 per version, and total spending was over $100,000. Each attempt had up to 48 hours; the fastest took 12. No safeguards or refusals were triggered. The exploits relied on a sandbox-escape flaw that had not been published, fixed in Firefox 159.0 on 27 October. Epoch is clear about the limits. The exploits did not achieve code execution, and attempts against Chrome failed despite roughly $100,000 of spending.

Mozilla responded the same day. Bobby Holley wrote that, working with early access to frontier models, Mozilla has shipped more than seven times as many security fixes as in the same period of 2025. Firefox already halved its release cycle this year to ship weekly. It is now keeping regression tests confidential until a fix has shipped, because it found GLM 5.3 much less effective at patch-gapping without them, and scanning every new commit. Next, it plans to stagger fixes so that the patch gaps for different sandbox layers never overlap, leaving an attacker without the full chain needed to break in.

The same week Google launched Gemini 4 Carbon, which it says leads on vulnerability work, with 88.2% on SEC-bench Pro and 54.8% on ExploitGym. It is going first to a subset of cyber defenders through its Fairwind Program. And Moonshot has said the open weights of Kimi K3.1 Pro are due by 4 November. It removed cyberattack material from training before release, yet by its own count the released model still solved 81% of its in-house exploit tasks, according to The Next Web.

Why it matters

The patch gap is the time between a fix being published and being installed. It used to be protected by effort: turning a fix into a working exploit took skilled people days or weeks. Epoch has now put a price on that work, about $1,000 a version, using a model anyone can download and run without a provider's safeguards in the way.

Banks carry a long tail of browser engines: thin clients, branch kiosks, web views inside mobile apps and vendor products that bundle their own. Patch windows of 30 days for a "high" finding were set when exploit writing was scarce. They now sit next to a cost curve that falls every quarter.

When an exploit costs less than the meeting that approves the patch, the meeting becomes the weak point.

The defence is not to hope model makers refuse. Epoch saw no refusals at all, and open weights cannot be recalled. The defence sits in the patch process. Measure patch latency for browsers and embedded web views in days, put internet-facing rendering at the front of the queue, and treat vendor patch timelines as a risk item with an owner. Mozilla's weekly releases and staggered patch gaps show where suppliers are heading. The question is whether bank change processes can absorb a weekly cadence.

What I'd watch

• Whether other browser makers adopt Mozilla's approach of keeping patch gaps for different sandbox layers from overlapping.
• Whether Kimi K3.1 Pro's weights ship by 4 November, and what independent tests show about its exploit skills.
• Whether regulators shorten expected patch timelines for internet-facing software.