I addressed that in the response - and admitted that, yes, it is an assumption against the largest attack vectors. >OTOH, they might throw everything and the k

I addressed that in the response - and admitted that, yes, it is an assumption against the largest attack vectors. >OTOH, they might throw everything and the kitchen sink in under the assumption that they'll be caught quickly so they want to capture as much as possible before they're kicked out. If I felt the risk was large enough to be concerned over - I'd fork and backport the patches and compile a personal version of FF 36 with critical bugs patched. I'll be honest in "possibly execute arbitrary code via unknown vectors" is not one of my highest security concerns and a concerning amount of these are only possible when running Javascript. In fact, the most concerning issues I saw are video codec related. Reading a few of them, they require me to decode/play the video in the browser to trigger so I can probably avoid that by downloading videos to watch locally in a media player instead of through Firefox. The severity of a bug doesn't matter to me as much as how trivial it is to exploit and how it needs to be exploited.