Release notes
These release notes are summaries of the most important changes for public releases.
Published 2026-11-01
UXP Changes:
- Removed compromised eMudhra certificates from the certificate store.
- Updated SQLite to 3.54.1.
- Updated the executable extensions list to warn about additional types of files.
- Fixed several potential application crashes.
- Restricted JAR loading to align better with in-browser usage.
- Fixed an issue with potential out-of-bounds access in JavaScript.
- Disabled the new
:has() CSS implementation by default for performance reasons. See implementation notes.
- Added a preference for handling improper form element placement in HTML. See implementation notes.
- Backported an upstream libvpx VP8 decoder fix.
- Fixed an issue in the BigInt implementation that caused specific JavaScript calls to fail.
- Fixed a potentially exploitable memory leak.
- Security issues addressed: CVE-2026-109730 (DiD), CVE-2026-109735, CVE-2026-109736, CVE-2026-109782, CVE-2026-109763, CVE-2026-109776 (DiD), CVE-2026-100822, CVE-2026-100783, CVE-2026-100773 (DiD), CVE-2026-96869 (DiD), CVE-2026-100791, and several others that did not have a CVE designation at the time of evaluation.
Basilisk Changes:
- Introduced Intel 32-bit macOS builds for OS X 10.6 and later. These builds do not support automatic updates.
- Enabled automatic updates for MIPS64EL Linux builds.
- Built on UXP commit: 6b18be917d
Included Polyfills:
-
This release includes the following polyfills:
- image.decode
- Intl.DisplayNames
- Intl.RelativeTimeFormat
- Intl.Segmenter
- en-US only Intl.ListFormat
- Microsoft-specific (Outlook, Azure, etc) webauthn shim
- TextDecoderStream
- TextEncoderStream
- TransformStream
- ReadableStream pipeTo
- ReadableStream pipeThrough
- getAnimations
- elementFromPoint finite values
UXP Implementation Notes:
- The CSS
:has() pseudo-class selector was disabled by default because it caused severe performance issues on websites. This reduces web compatibility for some sites, but should improve browser performance while the root cause is investigated. The feature is expected to be enabled again after the performance issues have been addressed.
- If you do not mind the performance impact or have fast hardware, you can enable the feature by setting
layout.css.has-pseudo.enabled to true for broader website compatibility at the cost of additional processing.
- Form elements in HTML documents has been tightened for security reasons to adhere more strictly to the HTML standard regarding forms in tables. You can now control this with the preference
html5.forms.standards_compliant. By default, this is set to true to adhere to the specification, but you can temporarily set it to false and reload the page to allow more lax parsing of forms similar to earlier versions of Basilisk.
Old Releases
Old release notes from Basilisk Development Team releases can be found
here.
Release notes from releases by Moonchild Productions can be found
here.
