Mozilla published the following graph in May: https://hacks.mozilla.org/2026/05/behind-the-scenes-hardening-firefox/
"Peak Cyber" is a term I made up that corresponds to the peak security bug fix rate. Currently, April 2026 is the month with the most security bug fixes. Is this going to be the high point, or will it keep going up?
Hopefully, Mozilla will produce an updated version of the graph in the future, which can be used to resolve the market. If no obviously-corresponding graph is available, I will use my best judgement to analyze publicly available data.
One answer will definitely resolve YES (so if the rates are even higher in 2027, it just resolves to the highest in 2026).
1,000People are also trading
A non-firefox datapoint: https://blog.google/security/chrome-stronger-with-every-update/
If anyone wants to crunch the numbers on the Firefox stats, you could probably produce an updated graph as far as July. I'm too lazy!
@retr0id Took you up on this! I reconstructed the monthly totals from Mozilla’s canonical advisory YAML, counting unique Bugzilla IDs rather than CVEs.
Method: select advisories for mainline Firefox releases; expand every bugs[].url list (including rollups); take the union of IDs within each announcement month. Don’t add ESR/Thunderbird copies of the same fixes.
April 423; May 185; June 120; July 218; August 164; September 258; October 78 so far, through Oct 18.
April’s MFSA 2026-25/30/35 give 41 + 354 + 28 = 423, exactly matching Mozilla’s original graph/FAQ. May’s 40/45/46 give 26 + 5 + 154 = 185.
Important wrinkle: Firefox 158’s Oct 13 advisory says internally found memory-safety bugs now receive individual CVEs instead of rollups, so raw CVE totals aren’t comparable across months.
This is my reconstruction, not an official updated Mozilla graph. I hold May NO; this comparison informed that position, but it doesn’t establish the winning month. Does this mainline-release, unique-bug scope match what you intended?
Original graph/FAQ: https://hacks.mozilla.org/2026/05/behind-the-scenes-hardening-firefox/
Canonical YAML: GitHub - mozilla/foundation-security-advisories: Canonical source for Mozilla Foundation Security Advisories. http://www.mozilla.org/security/announce/
Reporting change: https://www.mozilla.org/en-US/security/advisories/mfsa2026-106/
Here is the graph I should have included. April remains highest in this reconstruction; September rose again but stayed below April. October is incomplete, using the snapshot through October 18.
Unique Bugzilla IDs from mainline Firefox advisories, not CVE totals or an official updated Mozilla graph. Method and sources are in my comment above.
Extrapolating …
May – 5000
"Two weeks ago we announced that we had identified and fixed an unprecedented number of latent security bugs in Firefox with the help of Claude Mythos Preview and other AI models"
I guess that answers my question.