These release notes are summaries of the most important changes for public releases.
This is a development release.
Added new DataTransfer constructor (spec compliance).
Aligned CSS layout flex grid with latest spec.
Made the MP4 reader less sensitive to corrupt data.
Improved media handling (ongoing).
Updated NSPR/NSS and enabled the use of latest draft TLS 1.3.
Changed the way network/cert errors are handled and displayed.
Fixed an ANGLE rendering issue (WebGL2 crash fix).
Added support for sbgp and sgpd boxes in EME.
Fixed "sticky" menus in High Contrast themes.
Updated zlib to 1.2.11.
Enabled Direct3D9 accelerated layers as a fallback if Direct3D11 can't be used.
Tuned the network stack for efficiency.
Fixed a number of performance issues with the browser.
Improved Mac OS X theming (unreleased).
Improved compatibility with GCC 8.
Reinstated RC4 and 3DES as weak cyphers as an option to enable use in non-standard environments (not enabled for the web by default).
Removed most telemetry calling code from C++ and the JS TelemetryStopwatch. This prevents most data gathering and improves performance.
Added an option (browser.newtabpage.add_to_session_history) to decide whether to store "about:newtab" in the session history for workflows of people wanting to use the back button to return to the QuickDial page.
Added an option (ui.menu.allow_content_scroll) to override the OS convention to prevent scrolling of content when contextual menus are open.
Added a horizontal scroll action option for mouse wheel.
This is a development and security release. We're only highlighting the most pertinent changes
this time, since there have been over 450 of them.
Fixed an issue where windows would not be restored to their proper place if using custom device pixel ratios.
Removed the whole UITour system.
Removed the use of Disconnect if SafeBrowsing isn't built.
Updated the Readability/Reader View components.
Updated Cookie gating to be more strict.
Updated NSPR/NSS and enabled the use of TLS 1.3 by default.
Reinstated string.prototype.contains for compatibility (alias for .includes).
Updated kiss-fft to v1.4.0 (fork).
Fixed a serious memory leak in the WebP image decoder.
Fixed compatibility issues with Youtube Live, .
Improved legibility of fonts at certain scale levels on Windows.
Fixed Firefox-inherited SSL status ambiguity. SSLStatus.CipherName now actually displays the name. The full suite is still available in the (new) property CipherSuite.
Fixed some incorrect CSP handling.
Prohibited web access to the moz-icon:// scheme to solve privacy issues with it.
Fixed crash hazards in the editor.
Removed SSL error reporting telemetry.
Updated libwebp image decoder library to 1.0.0 + sec fixes.
Made it possible for UXP applications to run within a chrooted environment (provided it's compiled against glibc)
Ported several controlling preferences from Pale Moon (prompts.tab_modal.focusSwitch, browser.cache.backend, etc.)
Fixed security issues: CVE-2018-12363, CVE-2018-12366, CVE-2018-12364, CVE-2018-12359, CVE-2018-12367, and CVE-2018-12360.
Fixed a number of security, stability and memory safety hazards that did not have CVE numbers at the time of implementation.
This is a development and security release.
Updated our strings for soft-blocked items so people will cry less when we do our job and warn about known-problematic add-ons.
Fixed a regression in site-specific user-agent overrides that would prevent proper application on subdomains.
Improved the reader view API.
Removed more dead code from our tree (crashreporter components, gonk).
Removed DMD code.
Removed jprof profiler code.
Removed the SPS profiler.
Slimmed down IPC (ongoing).
Removed the Social API code.
Fixed some media back-end crashes and instabilities.
Updated the fetch API to be more web-compatible.
Limited maximum accepted image sizes for PNG images to prevent abuse/browser DoS.
Blocking of top-level data: navigations is now enabled by default.
Fixed CVE-2018-5129: Out-of-bounds write with malformed IPC messages.
Fixed CVE-2018-5130: Mismatched RTP payload type can trigger memory corruption.
Fixed CVE-2018-5131: Fetch API improperly returns cached copies of no-store/no-cache resources.
Fixed CVE-2018-5144: Integer overflow during Unicode conversion.
Fixed CVE-2018-5125: Memory safety bugs.
Fixed CVE-2018-5145: Memory safety bugs.
Fixed CVE-2018-5137: Path traversal on chrome:// URLs.
After this release, the current Basilisk will be in maintenance mode as we work on a re-forked UXP.
Restored source-editor commands for scratchpad and style editor menus.
Removed a bunch of Rust cruft.
Moved a number of flow decisions from run-time to build-time to slim the browser down.
Removed redundant Vista checks.
Removed unused crash reporter conditional code.
Enabled blocking of top-level data: URI navigations by default. If you need this functionality as a developer, flip security.data_uri.block_toplevel_data_uri_navigations. Note that this does not block manually entered data: URIs, only navigation to it from the browser.
Added the status line (response) to raw header display.
Removed b2g code.
WebExtensions: Content Script sandboxes will now have their sandboxName set.
Added an option to remove all session cookies for a specific domain.
Added a number of devtools improvements.
Fixed a number of crashes and instabilities in the browser.
Fixed border and caret widths for natural rounding.
Mitigated Meltdown/Spectre hazards.
Removed b2g code.
Fixed issues with ID-less web extensions and incorrect warnings in the add-on manager.
Removed unused internal extensions and components.
Fixed source editor controller commands.
Fixed X-Frame-Options sameorigin check to check all ancestors.
Fixed "sticky" menu colors in special accessibility ("high contrast") system themes.
Fixed security issues: CVE-2018-5099, CVE-2018-5093, CVE-2018-5113, CVE-2018-5095, CVE-2018-5098, CVE-2018-5111, CVE-2018-5109, CVE-2018-5122, CVE-2018-5091, CVE-2018-5097, CVE-2018-5102, CVE-2018-5104, and multiple potentially exploitable crashes and vulnerabilities that do not have a CVE assigned to them.
Fixed potential registry name collisions on Windows for file types and protocols.
Renamed Options to Preferences (Windows) and moved Preferences to the Tools menu (Linux).
Switched off automatic form filling of login credentials and added a preference to control this.
Completely removed the "Mozilla Settings Service" and "Blocklist service" client.
Fixed a margin issue for the navigation bar.
Adjusted the performance-timing resolution to prevent timing-based hardware-specific attacks ("Meltdown"/"Spectre").
Limited the number of shared Array Buffers for normal JS code to prevent allocation issues.
Disabled shared JS memory for the time being to make doubly-sure it can't be abused while "Spectre" is investigated further.
Fixed several compatibility issues with WebExtensions.
Disabled Mozilla's "system add-ons" service, which would allow Mozilla to remotely install add-ons.
Disabled Mozilla's "system settings" service, which would allow Mozilla to remotely change settings or block add-ons.
Updated SQLite lib to 3.21.0.
Added an option to block top-level data: URIs.
Removed referrers when opening links in new private windows.
Updated license and rights pages.
Changed the Feedback link to point to the forum instead of Mozilla.
Fixed an issue with exportFunction().
Fixed/enabled the use of Firefox Sync (Firefox Accounts).
Restored the toolkit Error Console for application troubleshooting.
Added '-jsconsole' and '-browserconsole' command-line arguments for launching of either console on startup.
Removed what was left of the underused Social API.
Changed the way element border rounding is done in Goanna to have natural rounding up/down of fractional sizes (IEEE 754).
Fixed a potential leak involving IndexedDB and private browsing mode.
Fixed a crash in ANGLE.
Linux-only update to fix a release channel/update problem.
Fixed add-on/GMP update calls to Mozilla services.
Enabled accessibility features.
Enabled parental Controls features (Windows only).
Changed blocklist hosting to self-hosted.
Removed leveraging the blocklist for CRL purposes.
Included the Universal Runtime Libraries with the browser.
No longer enforcing the "preferred" cipher suite profile on Http/2.
Added support for the worker-src CSP directive.
Fixed freetype glyph metrics in Skia (fixes Freetype 2.8.1+ issues).
Fixed an issue with ContentSecurityManager not passing the correct context.
Fixed a number of issues with Contenteditable elements.
Fixed a number of issues with pointer events.
Implemented "cookie-averse document objects" to mitigate cookie injection.
Fixed an issue with SVG text-based image masks.
Fixed the installer checking for Firefox instead of Basilisk.
Enabled the use of 64-bit plug-ins other than Flash and Silverlight.
Made the SVG texture cache more lenient to large-resolution SVG images.
Fixed several crashes and memory safety hazards.
Fixed several security bugs: CVE-2017-7837, CVE-2017-7832, CVE-2017-7830, CVE-2017-7835, CVE-2017-7831, CVE-2017-7838, CVE-2017-7839, CVE-2017-7828, CVE-2017-7840, and several others from Firefox 57 that do not have a CVE designation.