1. The bug’s reach is limited to Chromium‑based browsers
The discussion quickly settled on the fact that the CVE is a Chromium issue, not a Firefox one.
“This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.” – mpeg
“Firefox uses a different CSS engine that doesn’t automatically have this same use‑after‑free.” – mdt
2. Bug‑bounty payouts are far below the black‑market value
Many commenters compared the modest bounty that Google offered to the price a researcher could fetch on the gray market.
“I’d be surprised if it’s above 20 K$.” – duozerk
“What kind of bounty went to the researcher?” – mpeg
“The market is priced at the point that the most economic for the business.” – hsbauauvhabzb
3. Mozilla’s funding model and trust crisis
A large portion of the thread turned to why Firefox is perceived as “selling users’ data” and why users are turning to Brave.
“Mozilla is now an ad‑tech company… collects your data to sell to advertisers.” – autoexec
“Mozilla failed and now the best we have is Brave.” – ddtaylor
“I think Firefox is a very niche browser with rather insignificant market share.” – pear01
4. Rust vs C/C++: supply‑chain vs memory‑safety debate
The vulnerability sparked a broader debate about the safety of Rust’s unsafe code and the risk of third‑party dependencies.
“Rust has a lot of dependencies… supply‑chain attacks.” – pheggs
“Firefox uses Rust but still has unsafe.” – ceteia
“C++ is not immune to supply‑chain attacks either!” – chlorion
“Rust’s unsafe is core part of the language.” – ceteia
These four themes capture the main currents of opinion in the discussion.