> The CVE was created last September, so it was known about at least that long
Mozilla could have reserved CVE numbers in blocks, and still be allocating from that batch.
Mozilla could have reserved CVE numbers in blocks, and still be allocating from that batch.
However, a CNA like Firefox does not allocate CVE as they need them. They first ask Mitre for a block of X CVE to use as they need. They probably got a new block in September.