A security expert who claimed to have discovered a critical vulnerability in the open source Firefox browser has retracted his original claims. 

Mischa Spiegelmock demonstrated what he claimed was a JavaScript vulnerability in Firefox at the ToorCon hacker conference in San Diego over the weekend.

He said that the flaw could allow for remote code execution, and boasted that he knew of at least another 30 undisclosed vulnerabilities.

Spiegelmock has now admitted to Mozilla that the security vulnerability would only crash the browser and that he had been unable to execute arbitrary code.

"The main purpose of our talk was to be humorous. I do not have 30 undisclosed Firefox vulnerabilities, nor did I ever make this claim," he said in a statement that was posted on the Mozilla website. 

"I have no undisclosed Firefox vulnerabilities. The person who was speaking with me made this claim, and I honestly have no idea if he has them or not. I apologise to everyone involved, and I hope I have made everything as clear as possible."

Prior to Spiegelmock's confession, Mozilla security chief Window Snyder had reported that the vulnerability was incapable of allowing remote code execution.

Snyder said that, despite the limited risk to end users, the software developer still takes the issue seriously and will continue its investigation.