Mozilla Firefox

[Grogan]

I guess they have to come up with some new gimmicks. Google Chrome has greatly reduced its adoption, as it's forced on people.

I don't think I'd like horizontal tabs, I never liked a taskbar on the side. That's a good feature to add though.

[Grogan]

I was reading at phoronix that Nightly should have better process startup performance and at least initial smaller memory footprint due to this "forkserver" code that's been enabled for a while now. It hasn't made into stable or -rc codebases yet. These are the kinds of improvements I want to see, not just sewing more arms onto the octopus.

https://www.phoronix.com/news/Firefox-F ... inux-Nears

[Grogan]

I noticed a Firefox 135.0.1 before I went to bed today. There are release notes now:

https://www.mozilla.org/en-US/firefox/1 ... easenotes/

Fixed drop-down menus being unusable on some sites relying on certain mousemove event behavior. (Bug 1944191)

Fixed scrolling to the wrong location with anchor tags in some situations. (Bug 1946899)

Fixed being unable to restore closed windows and tabs via the History menu when upgrading from an older Firefox version. (Bug 1947503)

Fixed broken search functionality when updating to Firefox 135 with a custom search engine with an overly-large icon installed. (Bug 1946156)

Security fix.

[Grogan]

Firefox 136.0 is out, no release notes yet.

As usual, the appropriate download can be had from here:
https://ftp.mozilla.org/pub/firefox/releases/136.0/

[Zema Bus]

That's the version where they introduced those new tab settings if that carried through to the release.

[Grogan]

I'm not too interested in that, but hardware video encoding is now enabled by default for amdgpu. I've been forcing that (vaapi) for a long time now.

I don't think that "forkserver" code is merged yet though, still just in Nightly.

I'm pissed off about that "data selling" FUD though. People are blowing that way out of proportion, with people vowing to boycott Firefox and Thunderbird, even though the policy text has been revised and clarified. I absolutely refuse to use a Chrome based browser, I hate that engine, in any hands. Librewolf uses an older code base and sucks, too.

[Zema Bus]

Louis Rossmann did a video touching on that, he is one of the few I've seen talking about it who called it a "nothing burger", most of the others talked about leaving Firefox over it.

[Grogan]

I saw that last night, but I didn't watch it, because I was disgusted by the comments I saw before starting the video. I wasn't in the mood to get irritated, so I just closed the browser tab. I guess I should watch that tonight

Anyway, I'm using Firefox 136 now and I checked in about:config and about:support and everything looks correct for video acceleration (for the codecs that are expected to be accelerated).

[Grogan]

Firefox 136 Release Notes
https://www.mozilla.org/en-US/firefox/1 ... easenotes/

You can now enable the updated Firefox sidebar in Settings > General > Browser Layout to quickly access multiple tools in one click, without leaving your main view. Sidebar tools include an AI chatbot of your choice, bookmarks, history, and tabs from devices you sync with your Mozilla account.

Keep a lot of tabs open? Try our new vertical tabs layout to quickly scan your list of tabs. With vertical tabs, your open and pinned tabs appear in the sidebar instead of along the top of the browser. To turn on vertical tabs, right-click on the toolbar near the top of the browser and select Turn on Vertical Tabs. If you’ve enabled the updated sidebar, you can also go to Customize sidebar and check Vertical tabs. Early testers report feeling more organized after using vertical tabs for a few days.

The Clear browsing data and cookies dialog now allows clearing saved form info separately from browsing history.

Smartblock Embeds allows users to selectively unblock certain social media embeds that are blocked in ETP Strict and Private Browsing modes. Currently, support is limited to a few embed types, with more to be added in future updates.

Firefox now upgrades page loads to HTTPS by default and gracefully falls back to HTTP if the secure connection fails. This behavior is known as HTTPS-First.

On macOS, some background tabs will be moved to lower power cores, reducing energy usage.

Hardware-accelerated playback of HEVC video content is now supported on macOS.

Hardware video decoding is now enabled for AMD GPUs on Linux.

On Linux, Firefox is now available on ARM64 (AArch64), with installation options via APT and tarballs. Flatpak support is coming soon.

The Weather forecast on the New Tab page is expanding to additional regions, including Mexico, Brazil, Argentina, and Chile, as part of an ongoing regional rollout.

Address autofill enabled for users in the United Kingdom.

Firefox will now prefer the PNG format when copying images out of Firefox, allowing the preservation of transparency.

Various security fixes.

For New Tab stories, the Save to Pocket action was moved from a button to the context menu along with other actions, such as Bookmark.

[Grogan]

Hah... I forgot to check for a new Firefox build today, and there is one!

Firefox 136.0.1
https://ftp.mozilla.org/pub/firefox/releases/136.0.1/

No release notes yet.

I might as well start a build while I head upstairs (I have it all scripted).

[Grogan]

Firefox 136.0.1 Release Notes
https://www.mozilla.org/en-US/firefox/1 ... easenotes/

Fixed:

Fixed an issue where a cookie size limit caused problems with website cookie management when using the CookieStore API. This could cause login and other state-related issues. (Bug 1950565)

Fixed an issue where Control/Command+L did not focus the address bar in new windows. (Bug 1947723)

Unresolved:

Users clearing "History" and/or "Site settings" on shutdown on previous versions will also have clearing "Cookies and site data" and "Temporary cached files and pages" enabled after updating to Fx136 even if they previously haven't checked these settings.
Affected users can go to "Privacy & Security" settings directly after the upgrade and uncheck both boxes to avoid getting logged out. (Bug 1952564)

[Grogan]

Firefox 136.0.2 today, with release notes, even

https://www.mozilla.org/en-US/firefox/1 ... easenotes/

Fixed:

Fixed a bug where "Cookies and site data" and "Temporary cached files and pages" were unexpectedly enabled after updating to Firefox 136 for users with "History" and/or "Site settings" set to clear on shutdown in previous versions. (Bug 1952564)

Affected users already on Firefox 136 can disable these settings in "Privacy & Security".

Fixed an issue where the Primary Password prompt appeared in unexpected situations. (Bug 1946121)

Fixed visibility issues with radio buttons on dark backgrounds. (Bug 1951930)

Fixed high CPU usage on Windows when the screen was locked or the laptop lid was closed. (Bug 1924932)

Web Platform:

Disabled support for the CookieStore API due to compatibility concerns. The API will be enabled later once the compatibility issues have been addressed.

I guess it's time to type ./firefox_build again.

[Grogan]

There's a Firefox 136.0.3 today, with release notes:

https://www.mozilla.org/en-US/firefox/1 ... easenotes/

Fixed:
Significantly improved responsiveness on TikTok by improving the speed of date formatting. (Bug 1954323)

Oh boy, now I can has TikTok at turbo speed (I wouldn't want that on my network)

That's a problem with date formatting though, TikTok is just the abuser that makes the problem critical.

[Grogan]

Now this is getting silly. There's a Firefox 136.0.4 today. It's unusual to have that many point releases between their fast release schedules.

https://www.mozilla.org/en-US/firefox/1 ... easenotes/

It's a Security Fix

CVE-2025-2857: Incorrect handle could lead to sandbox escapes

Reporter
Andrew McCreight
Impact
critical

Description

Following the recent Chrome sandbox escape (CVE-2025-2783), various Firefox developers identified a similar pattern in our IPC code. A compromised child process could cause the parent process to return an unintentionally powerful handle, leading to a sandbox escape.
The original vulnerability was being exploited in the wild.
This only affects Firefox on Windows. Other operating systems are unaffected.

I just so happen to not feel like doing another Firefox build right now (got other things to tinker with) so I'm glad I get to pass on this one

[Grogan]

Firefox 137.0 now, no release notes yet.

https://ftp.mozilla.org/pub/firefox/releases/137.0/

I was planning on doing a LLVM upgrade to 20.1.1, I haven't decided if I'm going to do that first. (not sure if it's appropriate yet)

[Grogan]

I got it all done before game time (had a few snags to work out), built new LLVM 20.1.1, the WASI toolchain (still needs to have BULK_MEMORY ops hacked out for Firefox), Rust (had trouble with that) and then finally, Firefox 137.0.

If only I knew what has changed in Firefox lol

One thing I heard, is that there is now hardware acceleration for X.265 (HEVC) video.

[Grogan]

Firefox 137.0 Release notes:

Tab groups begin rolling out today! Stay productive and organized with less effort by grouping related tabs together. One simple way to create a group is to drag a tab onto another, pause until you see a highlight, then drop to create the group. Groups can be named, color-coded, and are always saved. You can close a group and reopen it later.

Firefox Address Bar Refresh 2025 - new ways to search for things new, previously viewed, and more - all from the address bar:

Unified Search Button: A new, easy-to-access button in the address bar helps you switch between search engines and search modes with ease. This feature brings the simplicity of mobile Firefox to your desktop experience.

Search Term Persistence: Now when you refine a search in the address bar, the original term sticks around, making it easier to adjust your queries and find exactly what you're looking for.

Secondary Action Buttons: Suggestions for common Firefox features.

Contextual Search Mode: Firefox detects if you are on a page that has search capability and offers that option for you to directly search with the page engine from the address bar. Use this option at least 2 times and Firefox will suggest adding the search engine to your Firefox.

Contextual Search Engine Options: Use a Contextual Search mode option at least 2 times and Firefox will suggest adding the search engine to your Firefox so that it’s always available to you.

Intuitive Search Keywords: You can access various address bar search modes with convenient and descriptive keywords (e.g. @bookmarks,@tabs,@history, @actions).



Firefox now identifies all links in PDFs and turns them into hyperlinks.

Support HEVC playback on Linux.

Now you can sign PDFs without leaving Firefox. Save your signatures to re-use later.

You can now use the Firefox address bar as a calculator. Simply type an arithmetic expression and view the result in the address bar drop-down. Clicking on this result will copy it to your clipboard.

I had one or more youtube videos crash Firefox last night (probably HEVC acceleration?) on Gentoo. I'll have to see if it happens on Arch, but it probably will (same Firefox build, same Mesa version etc.). All I have to do is hover for preview and blammo, Firefox disappears. Firefox doesn't even know it crashed, it doesn't come up with the restore tabs shit or anything. After a couple of times of that, there were no more of those in my feed and it was late, so I didn't try to troubleshoot or find any console info. Other videos played fine. It could just be one video, it was hard to tell which one crashed it.

[Grogan]

The crash (segfault) happens on both OSes. Weird that sometimes it stops though and I can hover and play the videos. Other times it crashes just having certain videos in my feed while scrolling and now that they are on Arch, it crashes on the my main youtube page.

This video is one that seems to trigger the crash in Firefox 137.0

Sopranos Headshots
https://www.youtube.com/watch?v=Za_uBAHr8kI

(don't want this to display inline so I checked the box to not parse URLs)

As far as I can tell, it's a normal h.264 encoded video. However, that's after downloading it with yt-dlp, I don't know a way on youtube to see what codecs its streaming to me.

[Grogan]

Actually it could be my build. I just did a plain non-profiled, non-LTO build with gcc (well, and rust of course), --without-wasm-sandboxed-libraries (that's a LLVM thing) and nothing fancy. I'm not having the crash now.

As long as I don't do any benchmark comparisons, it'll be fine for now but it gives me some troubleshooting direction (might be LLVM 20 in which case I'm fucked until the next release cycle at least).

[Grogan]

A plain (non PGO/LTO) clang build of Firefox 137.0 isn't crashing either (tested on both OSes). Even with my usual:

CFLAGS="-g0 -march=alderlake -mno-sse4.2"
CXXFLAGS="-g0 -march=alderlake -mno-sse4.2"
RUSTFLAGS="-C target-cpu=alderlake -C debuginfo=0"

(SSE 4.2 in this build breaks the build and clang++, or at least it used to)

So something in the video playback code was getting messed up, probably during the LTO, with LLVM 20.1.1

By the way, it takes me 11 minutes to build Firefox with a simple clang build. 18 minutes with gcc. Both are using --enable-optimize (which will mostly use -O3)

[Grogan]

I said I wasn't going to do it, but I had to run benchmark tests. My conclusion is that this code base now runs like shit if not built their way, it's meant to be compiled with PGO+LTO. Some of the benchmark tests were like 50 to 70% lower (in individual tests, not necessarily overall scores). Similar results with gcc vs. clang. That's a wide variety of tests using the browser's functions. You won't likely "feel" that just reading web pages but that bites the weenie. I can visually see that some of the graphics tests match the scores, too. I probably wouldn't have noticed if not for running tests, but now that I do, it doesn't sit right with me.

I got somewhat better results using clang and forcing --enable-optimize=-O3 globally, some of the individual tests (e.g. web assembly) did better.

I think when Firefox 137.0.1 comes out I'm going to blast back my LLVM 19.1.7 packages temporarily so I can do a proper Firefox build. (I can easily do that because I don't have my graphics libraries etc. depending on it)

[Grogan]

So it wasn't just the lack of expected PGO+LTO optimization, it was performing poorly being built with other compilers (LLVM 20 and gcc 14.2.1) themselves.

I tried a new PGO+LTO build with my LLVM 20.1.1 but with Rust 1.86 which does correctly build and link in LLVM 20. My results crashed on youtube (I wasn't really expecting any change there) but also my benchmark tests showed pretty much the same problem as the working LLVM 20 and gcc plain builds of Firefox.

So I temporarily blasted back my LLVM 19.1.7 and Rust 1.85.1 packages built against it and did a proper Firefox 137.0 build and got my performance back. Also, it does not crash on youtube (preview/scrolling or playing known videos that were triggering it)

I'll stay with this build until Firefox 138 now, when I'll try it again with my LLVM 20 toolchains. (unless I see something that interests me in the point releases)

[Grogan]

LOL! NOW, there is a Firefox 137.0.1 (I definitely checked today right before I started, I've been trying to wait for a reason to recompile again)

No release notes yet.

[Grogan]

There's really nothing in it for me, Firefox 137.0.1. For once I waited to see if there was any point in it.

Firefox 137.0.1 release notes
https://www.mozilla.org/en-US/firefox/1 ... easenotes/

Fixed an issue where folder shortcuts on Windows were incorrectly treated as files during file uploads, preventing selecting files within the target folder. (Bug 1958222)

Fixed a crash experienced by Windows users when downloading files with Qihoo 360 Total Security Antivirus software installed. (Bug 1958112)

Fixed an occasional startup crash. (Bug 1958293)

Windows problems... and "Qihoo 360 Total Security Antivirus"

It sounds totally awesomely Chinese (it is). They fixed it by blocking its filtering dll from loading into the process.

What is kind of cool is that it seems those Windows crashes were known and fixed so fast because of their crash reporter (from the bug report discussions).

[Zema Bus]

New stuff that may be coming down the pike. This is in Firefox Nightly 139.0a1.

Firefox_Nightly_139.0a1.jpg (162.83 KiB) Viewed 56972 times

AI summaries (currently disabled by default):

Firefox_Nightly_139.0a1._enabling_AI.jpg (31.77 KiB) Viewed 56972 times

Press left Shift and Alt with the mouse pointer over a link:

Firefox_Nightly_139.0a1.__AI_summary..jpg (99.49 KiB) Viewed 56972 times

[Grogan]

I heard they were adding JPEG-XL support... oh boy, another image format to deal with. I think the real problem for that one is, Google won't add it to their browser. They are pushing that .webp shit.

I'm not sure what to think about some AI service precis'ing web pages. It kind of takes control away from webmasters. At best, nuances and context may be lost. At worst, it could be garbage that turns people away.

On that page, the real key point is "currently shut down". Mike will not specialize in anything but that, at this time

[Grogan]

Firefox 137.0.2 today. No release notes
https://ftp.mozilla.org/pub/firefox/releases/137.0.2/

I'm going to wait and see what's changed before I go temporarily downgrading LLVM and Rust builds for it. I'm still on 137.0

[Grogan]

Firefox release notes
https://www.mozilla.org/en-US/firefox/1 ... easenotes/

Fixed file picker not being displayed when exporting passwords on macOS in about:logins for some users. (Bug 1956266)

Fixed accessibility issues with the new PDF signature feature. (Bug 1956110 and Bug 1952571)

Fixed an issue where using the context menu to paste in the Style Editor would insert the code twice. (Bug 1955854)

Fixed functional regressions in our XSLT support introduced in 137. (Bug 1954841)

Fixed a tooltip flickering issue on Windows that affected some users when hovering. (Bug 1958631)

Fixed an issue where Firefox would not respond to clicks in some HTML5 video players. (Bug 1959251)

Fixed an issue where radio inputs behaved incorrectly when preventDefault() was called on the click event. (Bug 1957956)

Fixed an issue that caused some Firefox users to restart their browser multiple times to complete an update. (Bug 1959492)

Security fix.

CVE-2025-3608: Race condition in nsHttpTransaction could lead to memory corruption
https://www.mozilla.org/en-US/security/ ... sa2025-25/

Changed

Fixed an issue with DRM video playback on some sites caused by the general availability rollout of Microsoft's PlayReady hardware decryption DRM support in Firefox 137. PlayReady support is now limited to specific sites while broader compatibility continues to be tested. (Bug 1959827)

I guess I'm going to do this one.

[Grogan]

Firefox 138.0 is out now, but no release notes yet.

https://ftp.mozilla.org/pub/firefox/releases/138.0/

Now to see if this builds correctly with LLVM 20.1

P.S. Nope... still crashes on certain youtube videos with a proper PGO+LTO build. Just having them in the feed and scrolling will do it. (I searched for "Sopranos Headshots" and as soon as the video appeared in the search results, blammo)

It seems all they care about are ways to make money nowadays. New services, new features, new schemes... not Firefox maintenance and improvement. Despite all their spinning wheels, hoops and smoke and mirrors, Firefox is one of the worst performing browsers out there and its regressing (Firefox 137.x had regressions in benchmarks even built with LLVM 19.1.7 and I very much doubt that's changed). I'm getting very tired of this.

Chrome based browsers are significantly better in terms of performance. I hate Chrome browsers, but I'm soon going to have to consider other things.

Instead, what do I get for a new feature here? They added pushpins to all my icons of sites that are pinned to my new tab page. Now when I click my address bar drop list, all the icons have ugly white push pins. What a wonderful improvement to the browser.

[Zema Bus]

It's too bad we don't have more than two browser options in terms of what's under the hood right now. It's either something based on Firefox or something based on Chromium. It sounds like that new browser in development, the Ladybird browser, could give us a third option but that's still a few years away.