RealFeedApp Firefox vulnerability works until October 26
Researchers demonstrated that the Z.ai model GLM 5.3 can read files from a visitor's computer and transmit them to an attacker by exploiting a vulnerability in Firefox that was published but not yet shipped. The attack targets all Firefox versions released between September 17 and October 26, requiring no further user interaction.
- Field
- computer security
- What they did
- The open-weight AI model GLM 5.3 created a webpage that, when visited by a Firefox user, silently read files from their computer and sent them to an attacker without any further user interaction, exploiting the time between a security fix being published and shipped.
- Why it matters
- This demonstrates how the 'patch gap'—a known weakness where fixes exist but are not yet installed—can be used to compromise specific browser versions, requiring only information available at the time of release rather than advanced frontier models.
#glm#firefox#security#patch gap#llm#exploit
