# \[SMT\]\[Z3\] Predicting Math.random() in Firefox using Z3 SMT-solver

DevFeed: [\[SMT\]\[Z3\] Predicting Math.random() in Firefox using Z3 SMT-solver](<https://devfeed.tech/articles/smt-z3-predicting-math-random-in-firefox-using-z3-smt-solver-20590.md>)

Original publisher: [Read original article](<https://yurichev.com/blog/xorshift/>)

Published: 2026-02-01T23:00:00Z

Content type: tutorial

Language: en

Sources: [Dennis Yurichev](<https://devfeed.tech/sources/dennis-yurichev.md>)

Topics: [Firefox](<https://devfeed.tech/topics/firefox.md>), [Code](<https://devfeed.tech/topics/code.md>), [math](<https://devfeed.tech/topics/math.md>), [C](<https://devfeed.tech/topics/c.md>)

Tags: [c](<https://devfeed.tech/tags/c.md>), [code](<https://devfeed.tech/tags/code.md>), [firefox](<https://devfeed.tech/tags/firefox.md>), [math](<https://devfeed.tech/tags/math.md>)

## AI overview

This tutorial shows how to use the Z3 SMT solver with Z3Py to recover the initial state of Firefox's Xorshift128+ pseudorandom number generator and predict Math.random() outputs. It explains why three generated real numbers are sufficient to determine the 128-bit state and demonstrates verification with C code.

## Source excerpt

[SMT][Z3] Predicting Math.random() in Firefox using Z3 SMT-solver