Epoch AI researchers report that open-weight GLM 5.3 built exploit chains against six Firefox versions released from September 17 to October 26 by exploiting the gap between public fixes and delivery to users. Successful attempts took at most 48 hours, with the fastest taking 12 hours, at about $1,000 in API costs each. A sandbox-bypass flaw used across successful attempts was disclosed and fixed in Firefox 159.0 on October 27, but the team did not establish whether equivalent attacks work on the new version. About $100,000 spent on Chrome did not produce an equivalent result, which is not proof of immunity. Reducing patch-delivery delays remains important.