Mozilla Fixed 423 Firefox Security Bugs in April After AI Helped Find Hundreds of Flaws

Mozilla fixed 423 Firefox security bugs across April 2026 releases after using Claude Mythos Preview and other security testing methods to find flaws in the browser. The largest batch came with Firefox 150, which included fixes for 271 vulnerabilities identified during Mozilla’s early evaluation of Anthropic’s Claude Mythos Preview.

The update matters because Mozilla says many of these bugs affected hardened areas of Firefox that traditional fuzzing does not always cover evenly. Some flaws involved old code paths, memory safety issues, browser internals, and sandbox-related behavior.

Mozilla has not described the 423 bugs as 423 exploited zero-days. Its own explanation says Firefox 150 fixed 271 vulnerabilities from the Claude Mythos Preview evaluation, while the full April total also included external reports, other internal findings, other AI-assisted results, and fuzzing work.

What Mozilla fixed

Firefox 150 arrived on April 21 with a high-impact security advisory. Mozilla credited several vulnerabilities to researchers using Claude from Anthropic, including use-after-free issues and WebAssembly-related flaws.

Mozilla later explained that Firefox 150 included three internal rollup CVEs. These rollups covered large groups of internally discovered bugs and helped Mozilla disclose the fixes without assigning a separate public CVE to every internal issue.

The April total increased further through follow-up Firefox releases, including Firefox 150.0.1 and Firefox 150.0.2. Those updates also addressed memory safety bugs, including some that Mozilla said showed evidence of memory corruption and could have allowed arbitrary code execution with enough effort.

At a glance

Detail	Information
Main product	Mozilla Firefox
Main release	Firefox 150
Firefox 150 release date	April 21, 2026
Total April fixes cited by Mozilla	423 security bugs
Claude Mythos Preview findings in Firefox 150	271 vulnerabilities
Other April inputs	External reports, other AI-assisted findings, internal research, and fuzzing

How Claude Mythos Preview changed the scale

Mozilla said it used an early version of Claude Mythos Preview as part of its collaboration with Anthropic. The model helped examine Firefox code and generate test cases that could reproduce real bugs.

This part is important because earlier AI security experiments often created too many false positives. Mozilla said the useful shift came from building an agentic harness that could move beyond guesses and produce proof-of-concept tests.

In simple terms, the system did not just claim that code looked unsafe. It tried to prove the issue by building a test case, then Mozilla’s security and engineering teams reviewed, triaged, fixed, tested, and shipped the patches.

Why the number is so high

The 423 figure covers all Firefox security bugs fixed in April, not only the bugs found by Claude Mythos Preview. Mozilla said 41 bugs came from external reports, while 111 more came from other internal sources.

That remaining internal group was split across additional Claude Mythos Preview findings shipped outside Firefox 150, bugs found with other AI models, and bugs found through conventional methods such as fuzzing.

Mozilla also separately credited three CVEs to Anthropic’s Frontier Red Team. Those were not part of the same 271-bug Firefox 150 Mythos batch, but they came from earlier Anthropic security work sent to Mozilla.

Some fixes involved serious bug classes

The patched flaws included use-after-free vulnerabilities, memory safety bugs, information disclosure issues, boundary condition errors, mitigation bypasses, and privilege escalation risks.

Mozilla’s Firefox 150 advisory lists high-impact vulnerabilities in areas such as DOM, WebRTC, WebCodecs, Canvas2D, WebRender, JavaScript, WebAssembly, networking, cookies, file handling, and device interfaces.

Follow-up advisories for Firefox 150.0.1 and 150.0.2 included memory safety fixes. Mozilla’s advisory language says some of those bugs showed signs of memory corruption, and attackers may have exploited some of them to run arbitrary code if they had enough time and effort.

Why this matters for Firefox users

For regular users, the main action is simple. Update Firefox as soon as possible and make sure the browser stays on the newest available version.

Security bugs in a browser matter because the browser handles untrusted web pages every day. A serious bug can sometimes trigger through normal browsing activity, especially when a victim visits a malicious or compromised page.

Mozilla’s own severity guide says high-impact vulnerabilities can involve sensitive data theft or code injection across sites with no more than normal browsing actions. Critical issues can allow attacker code execution during normal browsing.

Why this matters for software teams

• AI-assisted security testing can now find real browser bugs at large scale.
• Human review still matters because every bug needs triage, patching, testing, and release management.
• Projects need workflows that can handle sudden increases in valid security reports.
• Fuzzing remains useful, but AI-assisted source review can reach code paths that fuzzers may miss.
• Continuous integration may become a stronger place for AI-based patch scanning.

Mozilla wants to bring this into CI

Mozilla said its current scanning focuses mostly on selected code areas such as files and functions. The company now wants to move toward scanning patches as they land in the Firefox tree.

That would make the process more continuous. Instead of waiting for large review cycles, Mozilla could use AI-assisted analysis to inspect incoming changes and search for security bugs earlier.

This approach will not remove the need for security engineers. Mozilla said more than 100 people contributed to the effort through code changes, review, triage, testing, infrastructure, and release work.

What Firefox users should do now

• Open Firefox and check for updates from the browser menu.
• Restart the browser after the update installs.
• Use the latest Firefox 150 build or newer if available.
• Keep automatic updates enabled.
• Avoid delaying browser security updates, especially after major advisories.

Summary

1. Mozilla fixed 423 Firefox security bugs across April 2026 releases.
2. Firefox 150 included 271 vulnerabilities found during Mozilla’s Claude Mythos Preview evaluation.
3. The total also included external reports, internal research, other AI-assisted findings, and fuzzing results.
4. Mozilla did not present the full 423 count as 423 actively exploited zero-days.
5. Firefox users should update to the latest available version to receive the security fixes.

FAQ