The Month of Browser Bugs (MoBB)
Reliving the Past
The Month of Browser Bugs (MoBB), launched in July 2006 by security researcher H.D. Moore, uncovered numerous Remote Code Execution (RCE) vulnerabilities, generated multiple CVEs, and had a lasting impact on vulnerability disclosure practices.
This project sparked a significant shift in fuzzing and full disclosure practices, as demonstrated by the following developments:
MoBB demonstrated that fuzzing is highly effective at identifying vulnerabilities overlooked by traditional code analyzers. Today, fuzzing is an essential component of security testing and routinely uncovers critical bugs.
The initiative intensified debates on ethical vulnerability disclosure and challenged the norms of "responsible disclosure" by combining private reporting with coordinated patching.
Increased pressure prompted vendors to address security flaws more quickly, likely speeding up patch cycles and improving communication with researchers as vulnerabilities became public.
The discovery of many severe, previously unreported browser flaws highlighted the value of independent research. This approach increased reported vulnerabilities even without vendor coordination, a trend that continues today.
MoBB's assertive approach accelerated the adoption of modern browser hardening techniques beyond the operating system. It also demonstrated the effectiveness of fuzzing and highlighted the prevalence of vulnerabilities in Internet Explorer.
Additional context: