[kingkilr]

(Former Firefox Security Engineer)

I suspect it's because Firefox exploits have looked the same for the last several years -- there has not been a lot of novelty required to implement an exploit, given an arbitrary read/write primitive.

P0 does report vulnerabilities to Firefox though, and they obviously get fixed, they're just not particularly interesting to exploit.

[saagarjha]

> I suspect it's because Firefox exploits have looked the same for the last several years -- there has not been a lot of novelty required to implement an exploit, given an arbitrary read/write primitive.

Surely other browsers do not differ from this significantly?

[tedunangst]

An arbitrary write primitive in the chrome render process hasn't been game over for quite some time.

[saagarjha]

I mean, is it on Firefox?

[tedunangst]

Until a year ago(?), yes.

[arkadiyt]

Perhaps that'll change once Project Fission lands in the stable release