According to the Mozilla ticket on the issue, Mozilla did not disclose because Comodo asked them not to. While the stated motivation of a coordinated disclosure

According to the Mozilla ticket on the issue, Mozilla did not disclose because Comodo asked them not to. While the stated motivation of a coordinated disclosure sounds decent enough, it's hard to believe it was really in either Mozilla's or their user's best interests. Microsoft was the last to patch, and I think if you're dealing with an attacker that would shut off microsoft.com (even selectively) or WU you're probably well beyond an RA compromise. https://bugzilla.mozilla.org/show_bug.cgi?id=643056#c20 https://bugzilla.mozilla.org/show_bug.cgi?id=643056#c20 It seems to me that there is a bit of a question (at least in a few people's minds) if there was going to be any kind of disclosure if Jacob didn't come along.