Firefox security team explains plans for better fingerprinting protection & answers tough questions on AI coding in recent AMA

Firefox’s security team recently held a detailed AMA on Reddit, answering more than 30 questions about the browser’s current security posture and future plans. This article explains the most important takeaways, specifically about fingerprinting and how they use LLMs to identify issues faster.

In the AMA, several questions were about how Firefox handles AI-assisted coding.

When asked how the company manages the challenges that AI coding tools bring, especially as codebases grow larger, the team explained that the same core review principles continue to apply. One developer rates and owns the patch, and a second developer reviews it. Both developers use AI as a tool, but they’re expected to fully understand the code that’s being submitted.

Furthermore, the team noted that AI is actually quite helpful for security. AI has uncovered more security issues than previous manual efforts, and developers can actually fix more vulnerabilities.

Following this, the next question was about whether Firefox is less secure than Edge/Chrome and other Chromium browsers. Some workplaces even restrict the usage of Firefox, assuming that it’s less secure than Chrome or Edge. The team pushed back on this by saying that Firefox isn’t just volunteer-maintained.

The team consists of several dedicated engineers who ship regular updates every two weeks, and the fact that Firefox is able to find and patch so many vulnerabilities is a positive sign. For organizations that are looking for full administrative control, Mozilla also offers Firefox Enterprise.

Another closely related question: How Firefox’s security actually compares to other browsers. The team said that AI-assisted vulnerability discovery is one of the biggest concerns right now. Attackers can easily find bugs, but on the other hand, Firefox developers can reverse-engineer the fixes, and they’ve also moved to a faster release cycle (two weeks) for better security.

One area where the team claims that Firefox stands out is “Wasmboxing.” The company is actively working on improving process isolation on mobile, and looking ahead, they expect the wave of LLM-discovered security issues to eventually stabilize.

A bit more on the fingerprinting improvements: The “Resist Fingerprinting” level isn’t enabled by default for everyone yet, since it’d break too many websites. For example, lying about your timezone to Google Calendar isn’t ideal. Instead, the team is adding protections piece by piece. These improvements will first land in Private Browsing Mode, and the safer improvements are expected to become available in regular browsing soon.

To track this work, there’s a Bugzilla link, and in a quantification announcement (basically a progress report), the release is expected later this month.

An important answer was about “Fortified Firefox.” It is not a completely separate browser. The team said that it would be available in some form in the normal browser, but the exact way to enable it and the user interface are still undecided. At first, it is more likely to be an advanced customization option rather than a simple checkbox. It is expected to include things like better per-site controls (for example, disabling the JavaScript JIT on specific sites) and other hardening features. The team is also looking at operating-system integration points, including on Android.

Note: This article only covers some important highlights from the AMA. There were several other questions answered, and you can view the entire AMA on Reddit here.

In other Firefox news, the company is testing a way to show when you last visited a website. More on that here.

We stand out from the tech-media crowd because we break news stories; we mainly bring you stuff that you won’t find anywhere in the mainstream tech media. Our stories have been picked up by some of the world’s most popular websites and media outlets—more info is available here.