The patch gap isn't specific to Firefox. It's common across software, including other browsers, phone operating systems, and router firmware. Any software where an upcoming fix is visible before it ships is potentially vulnerable to this kind of attack.
While we weren't able to reproduce these attacks against Google Chrome, we don't consider that strong evidence the attacks would fail with better prompting or more capable open-weight models. Closed-source software is increasingly exposed too, as models get better at decompiling binary code.
Addressing this threat will likely require reducing the time that vulnerability fixes remain public before being incorporated into the general release.
Read the full findings and methodology: https://epoch.ai/publications/open-weight-models-patch-gap