@attackanddefens[email protected] - Mozilla's Security Internals for Security Engineers, Security Researchers, and Bug Bounty Hunters.
Joined February 2020
- Tweets158
- Following8
- Followers1.5K
- Likes25
Pinned Tweet
Please report bugs. If you - or someone else - improves exploitability after initial report, the bounty will be increased. If you're second reporter, you will be pro-rated.
I guess I can only speak for our bounty program but come on industry, you can do better.
#bugbountytips
Do not report open redirects without fully analyzing and seeing potentials of it. Thanks to random guy who reported open redirect, our report for full SSRF leaking client secret of integration claimed dupe.
Again: do not report open redirects #bugbountytips
Attack and Defense retweeted
There is a post making rounds about how a fingerprinting script from Alibaba’s AliExpress interrupted someone’s bluetooth headphone connection. AliExpress was trying trying to discretely track users, but was thwarted by Firefox’s anti-fingerprinting technology.
6 Firefox entries at pwn2own.
5 withdrawals due to our 150.0.3 security release.
1 failed attempt.
0 Exploits.
No incidents.
Time to party :)
Reminder that our bug bounty program accepts PoCs (e.g. , verifiable in an address sanitizer builds that you can find here firefox-source-docs.mozilla.…).
No need to write a full exploit.
More here mozilla.org/en-US/security/c… :)
Great bug, thank you for the detailed report.
We just released 150.0.3 to fix this.
mozilla.org/en-US/security/a…
Sorry this broke your chain @qriousec, @trichimtrich, @lanleft_, and @wiz1340. Would love to compare notes if you still make it to Berlin.
When we said that we found and fixed hundreds of bugs in Firefox using AI, people were skeptical and said: Where are the bugs?
Well, here they are. We are unhiding 12 security bugs that are representative of the issues we have found.
hacks.mozilla.org/2026/05/be…
We just published our recent Firefox Security and Privacy highlights in the Q1 newsletter. Take a look —> attackanddefense.dev/2026/04…
See @LiveOverflow's documentary on Firefox and pwn2own and learn what it was like to fix not just one but TWO Firefox security bugs at rapid time. youtube.com/watch?v=YQEq5s4S…
The bug info is public, including test case and patches. If you want to follow along, look at bug bugzilla.mozilla.org/show_bu… (Day 1 exploit) and bugzilla.mozilla.org/show_bu… (Day 2)
Attack and Defense retweeted
After a long pause, a new video coming today!
Part 1 of small documentary about Pwn2Own…
Good news. We just published the Firefox Security Newsletter for 2025 Q4.
attackanddefense.dev/2026/01…
Mozilla is looking for a Staff Security Engineer, Product Security in Remote Canada/US/UK/Germany - mozilla.org/en-US/careers/po…
We just published the Q2 2025 edition of the Firefox Security and Privacy newsletter.
Highlights:
* CHIPS
* Webcompat improvements
* Better HTTPS error pages
* Firefox Relay integration
...and much more.
attackanddefense.dev/2025/07…
Did you know that all of our good stuff is also available elsewhere?
Follow us on Mastodon at infosec.exchange/@attackandd… or keep refreshing our site at attackanddefense.dev/
We just updated our bug bounty hall of fame to include the great security researchers from the last two quarters. Thank you for securing the best #Firefox yet :)
mozilla.org/en-US/security/b…
Attack and Defense retweeted
bugzilla.mozilla.org/show_bu…
This is a big change for DOM Clobberers. Firefox Nightly no longer allows native document properties to be overwritten by elements with a name attr, e.g.:
<img src=a name=currentScript>
<script>
alert(document.currentScript)// HTMLScriptElement
</script>
Attack and Defense retweeted
Good find. This is now fixed @FirefoxNightly. Sorry, no fun allowed.
We updated our Firefox Bug Bounty Hall of Fame for Q4 of 2024. 🏆👏
Thank you to the many folks who helped keep Firefox secure! mozilla.org/en-US/security/b…