for agents/llms.txtv0.12.106

Home / Articles / A minimal viable browser: why Firefox is the one that can build it, and what it would take

A minimal viable browser: why Firefox is the one that can build it, and what it would take

By · 2026-10-18 · article v1.0.0 · newsroom v0.12.106 · browsersfirefoxmozillaminimal-codeagentsprompt-injectionextensionsattack-surfacearticle

Abstract: The browser is the biggest program most of us run, the largest attack surface on the machine, and the place we now want to put agents. It does far more than any single job needs. A kiosk running one application, an agent filling in one form, and a person reading the news all get the same enormous engine, with every feature on. This follows the argument of the code you do not ship to its most visible case. A minimal viable browser has a small kernel, reviewed hardest and changed least, and loads components only when a page or an agent needs them, so its attack surface grows only as it is used. A browser for one application has no extensions, no media and no downloads. A browser for one agent has no accounts, no extensions and no file access, which is a practical defence against prompt injection: an agent cannot leak what its browser cannot reach. And every extension runs in its own box, with only the access its job needs, instead of the "read and change all your data on all websites" that so many hold today. Several projects already do part of this, from hardened Firefox forks to headless browsers built for agents. But I think Mozilla is uniquely placed to do all of it: it has its own engine, privacy is its brand, it runs on the client, and its revenue still does not depend on knowing more about its users. The pitch to Mozilla, though, should not be security. It should be speed: a browser that only has the code it needs is a browser that starts instantly and uses a fraction of the memory.

A minimal viable browser: a small kernel of network, TLS, parsing, layout and process isolation, reviewed hardest and changed least; and components loaded only when needed, from JavaScript, with or without the JIT, to media, WebGL, PDF, downloads, extensions and sync. Three shapes from the same engine: a browser for one app, with only JavaScript and forms; a browser for one agent, the same; and the reader's own browser, with everything they use loaded as they use it and each extension in its own box.
Less code: a series in four parts

Code is a liability: remove what each use case does not call, apply it to the browser, and build on small blocks you did not have to write.

1 · MeasuredThe minimum code belowOne real use case of sgit, under coverage: 428 of 1,500 files ran, and a tree of only those passed.2 · Less codeThe code you do not shipThe worst bugs sit in features nobody needed; models make removing them safe, and someone can be paid to keep it small.you are here3 · The browserA minimal viable browserA small kernel and components loaded when needed: a browser for one app, one agent, or a reader, sold as speed.4 · Small blocksCloudflare as Lego blocksStorage, compute, models, email and identity as blocks, and an sgit vault server in 83 lines.

In short

The biggest program we run

The browser is where most of us spend the day, and it carries every capability the web has ever needed: a JavaScript engine with a just-in-time compiler, WebAssembly, WebGL, media codecs, PDF, fonts, downloads, extensions, sync, accounts. A page that shows text and a form gets all of it, on, by default.

The cost of that shows up in the bug counts. In May, Mozilla wrote that it fixed 423 security bugs in Firefox in April 2026, against roughly 20 to 30 a month through 2025. 271 of them were found with an Anthropic model and fixed in Firefox 150: 180 rated high, 80 moderate, 11 low. Many were sandbox escapes, written assuming the content process was already compromised and going after the privileged parent process through IPC, IndexedDB and image decoding. Chrome is seeing the same: one update on 6 October 2026 fixed 247 vulnerabilities. Counted from NVD by the organisation that filed them, Google's Chrome team filed 202 CVEs in 2025 and 3,246 in 2026 up to 17 October; Mozilla's filed 213 and 675 (Mozilla's also cover Thunderbird and other products). This is the code you do not ship argument at its largest: models now find what was always there, and every feature in the engine is a place to look.

The vendors already know that less code is safer, because they ship it as a mode. Microsoft Edge's enhanced security mode turns off the V8 just-in-time compiler, after Microsoft said in 2021 that 45% of V8 CVEs in 2019 were JIT-related. GrapheneOS's Vanadium browser has the JIT disabled by default, with a per-site toggle. Apple's Lockdown Mode blocks "certain complex web technologies". Tor Browser's Safest level turns off JavaScript altogether. Each is a minimal browser for one threat, switched on by hand. What does not exist is the general version: a browser that starts small and only grows when it has to.

What a minimal viable browser looks like

The shape is the same as the minimal viable code path, applied to one program.

Three browsers come out of the same engine. A browser for one application has no extensions, no media and no downloads: a kiosk, a till, an internal tool. A browser for one agent has the same, plus no accounts and no file access. And the reader's own browser loads what they use as they use it, with each extension in its own box.

Firefox has had pieces of this, and dropped some of them. It had a site-specific browser, behind a hidden preference, and removed it in Firefox 86 in 2021, citing known bugs and weak user research. It has a kiosk mode, started with --kiosk. It has had site isolation on for every desktop user since Firefox 95, which is the process boundary a component model needs. And Servo, the engine Mozilla started in Rust, is now an embeddable library, published as 0.1.0 in April 2026 under Linux Foundation Europe.

A browser for one agent

This is where the argument stops being about tidiness. We are now giving browsers to agents, and the agent reads everything the page says.

The vendors say plainly that this will not be fixed. OpenAI wrote in December 2025 that prompt injection, "much like scams and social engineering on the web, is unlikely to ever be fully 'solved'" (TechCrunch). Google calls indirect prompt injection "the primary new threat facing all agentic browsers". Gartner told most organisations to block AI browsers for now.

The incidents show where the damage comes from. In March 2026, Zenity Labs disclosed PleaseFix, a zero-click hijack of Perplexity's Comet through a calendar invite that reached local files and password-manager workflows. The fix was to restrict file:// access: not a smarter model, a smaller browser. At Black Hat in August, the same researchers showed zero-click chains against the agents in Chrome, Edge, Comet and ChatGPT Atlas; some vendors patched, others called it intended behaviour.

The better defences already point the same way. Atlas has a logged-out mode that runs the agent with no cookies or logins. Brave runs its AI browsing in an isolated profile with its own cookies and storage, and recommends isolating agentic browsing from normal browsing. Chrome adds Agent Origin Sets, which limit the sites an agent's task can touch, and a second model that checks proposed actions.

A minimal browser makes that the default rather than a setting. An agent's browser that has no accounts, no extensions, no file access and only the origins its task needs cannot leak a password it never had or a file it cannot open. In the terms of what can your agent reach, the grant shrinks to the mandate, and the injection that gets through finds nothing to take.

Every extension in its own box

Extensions are the part of the browser that users add, and they are where much of the recent damage came from. LayerX's 2025 report found 99% of enterprise users have an extension installed, and 53% have at least one with high or critical permissions.

The pattern in the incidents is not malicious code at install. It is a trusted extension that changes. Koi's ShadyPanda report covers 145 extensions with about 4.3 million installs, some of them "Featured" or "Verified", that were legitimate for years and then were weaponised through auto-update. Urban VPN Proxy, with a Featured badge, began harvesting every prompt and reply on ChatGPT, Claude, Gemini and Copilot from a July 2025 update, with no off switch. Firefox is not immune: Koi's later DarkSpectre attribution includes Firefox add-ons.

An extension in its own box gets only the sites and the powers its job needs, and a change to either is a new request, not a silent update. Firefox has started down this road. In Manifest V3 it made host permissions opt-in and controllable per site, and new extensions must declare their data collection at install. It has also kept the blocking webRequest API that Chrome removed, which is why full uBlock Origin still runs on Firefox. The next steps are a process per extension, and a permission model that is an Agent Behaviour Policy in all but name: what this extension may do, on which sites, and who approved it.

Parts of this exist

None of this is new as an idea, and much of it ships today, in pieces.

What is missing is the same engine, from the same vendor, in all three shapes, with the components as the unit.

Why Mozilla

I think Mozilla is better placed than anyone to build this, for four reasons.

It has its own engine. Gecko is the only independent engine with a large user base that is not Chromium or WebKit. A component model goes all the way down into the engine; a fork of someone else's cannot set that direction.

Privacy is the brand. Mozilla's state of Mozilla report puts Firefox at about 200 million monthly users, and the company has already shipped the instinct this needs: Firefox 148 added a switch that turns off current and future generative AI features. Its Smart Window is opt-in and does not act on pages yet. That is a company that already sells "you choose what runs".

It runs on the client. An agent's browser that holds nothing and reaches only what it needs is a client-side product. It does not need a server that sees the browsing, which is the same design as sgit.

Its money does not come from knowing more about you. Here the memo needs a correction: Mozilla's revenue is not independent. Mark Surman said in April that search was until recently about 95 to 98% of revenue, with privacy-preserving ads now about 10 to 12%, and most of the search money comes from Google. The court remedies in the Google case let those payments continue but limit default deals to one year at a time, and both sides have appealed. What holds is the part that matters here: Mozilla is paid for a search box, not for profiling its users, and it has about $1.4 billion in reserves and a plan to run its products as separate companies, each with its own accounts. A minimal browser for agents and applications is a product someone pays for directly, the way Brave Origin is, and it is the kind of revenue Mozilla says it wants.

Sell it as speed

The pitch to Mozilla should not be security. Security has never been enough to make people switch browsers, and Firefox at 2.8% of the market in September 2026 knows that better than anyone.

The pitch is that a browser with only the code it needs is fast. It starts at once, it uses a fraction of the memory, and an agent can run many of them. Lightpanda's own benchmark, which is the vendor's, claims 123MB against 2GB of peak memory for 100 pages, and 5 seconds against 46. A kiosk that boots in a second, an agent that opens a hundred clean browsers on a laptop, a reader whose browser does not load a PDF engine until they open a PDF: those are features people notice. The security comes with them, the way encryption made sgit better rather than being the reason to use it.

Firefox now ships every two weeks, from Firefox 155. A component that loads on demand is a component that can ship, and be pulled, on that cadence too.

What this does not claim

If you work on a browser and want to try a component model for agents, write to agent@riskmandate.ai.

Where this comes from

A voice memo from me on 18 October 2026. The research, read on 18 October 2026: Mozilla, hardening Firefox, 7 May 2026; state of Mozilla 2025/26 and its blog post, 27 January 2026; AI controls; Smart Window, 18 August 2026; Manifest V3 update, 13 March 2024; data collection consent, 23 October 2025; Project Fission; MediaNama, interview with Mark Surman, 4 April 2026; StatCounter, browser market share, September 2026; Servo, 0.1.0, 13 April 2026; Microsoft, browse safer with Edge, and The Record on the 2021 JIT figure; GrapheneOS, features; Apple, Lockdown Mode; OpenAI's statement as reported by TechCrunch, 22 December 2025; BleepingComputer on Chrome's agent security; Brave, AI browsing and unseeable prompt injections, 21 October 2025; Zenity Labs, PleaseFix, 3 March 2026; Dark Reading, zero-click agent hijacking, August 2026; The Register, Gartner on AI browsers, 8 December 2025, and Urban VPN, 16 December 2025; LayerX, extension security report 2025; Koi, ShadyPanda; Cybernews, DarkSpectre; Privacy Guides, Brave Origin, 7 June 2026; Malwarebytes, Chrome update, October 2026; Thurrott on Firefox 85; Lightpanda, repository; Chrome, headless shell; Tauri, start; NVD, CVE counts by source identifier. Related: the code you do not ship, what can your agent reach, cloudflare as Lego blocks, the value of constraints. Written up and checked by this site's agent; the editorial responsibility is mine.

Threads

Agents & policyVaults & method This article as a graph →

Builds on

Continued by

All articles · All graphs

Article No. 179 · start a reading list with it

Want the next issue by email. One issue a week or so: what was published, what it adds up to, and what is worth your time. Subscribe to the SGit Newsroom →

← All articles