Release notes
These release notes are summaries of the most important changes for public releases.
Published 2021-03-17
This is a small bugfix update.
- Changed the version of NSS to a custom build to address certificate import and (hopefully also) keygen issues.
- Updated the embedded emoji font for Yet More Professions With All Skin Colors&tm;.
- Updated the YouTube Studio useragent for compatibility.
Published 2021-03-11
This is a development, bugfix and security update.
- Added support for missing ES2019 JavaScript functions and specifications.
- Fixed an issue with useragent updates.
- Folder uploads through input elements now require user interaction on Windows 10.
- Mitigated a potential problem with history location/state change updates if used in rapid succession.
- Fixed a problem with WebCrypto failing to work properly with AES-GCM.
- Updated various libraries for compatibility and security.
- Fixed several memory safety hazards and potential browser crashes
- Security issues fixed: CVE-2021-23973, CVE-2021-23974.
- Unified XUL Platform Mozilla Security Patch Summary: 4 fixed, 2 defense-in-depth, 19 not applicable.
Published 2021-02-06
This is a development, bugfix and security update.
- Added a preference (
browser.tabs.allowTabDetach) to control whether "tearing off" of tabs is allowed.
- Updated some needed user-agent overrides for web compatibility with a few large sites.
- Added support for the
scrollbar-width CSS keyword.
- Fixed a javascript performance issue.
- Enabled several platform features by default for web compatibility.
- Removed the use of
<menuitem> in page content.
- Fixed several memory safety hazards and potential browser crashes
- Security issues fixed: CVE-2021-23962, CVE-2021-23953 and ZDI-CAN-12197.
- Unified XUL Platform Mozilla Security Patch Summary: 4 fixed, 6 defense-in-depth, 22 not applicable.
Published 2021-01-05
This is a development and security update.
- Fixed the display of dates and times to honor what the user has set in their regional settings.
- Disabled the use of the legacy database format for stored passwords and certificates.
- Worked around crashes and run-time issues with module scripts.
- Moved the global user-agent override to the networking component. Please note that this may interfere with some "user agent spoofing" extensions.
- Fixed a website layout issue with table-styled elements potentially overlapping when placed inside a flexbox.
- Updated the list of prohibited ports the browser can use.
- Updated NSS to 3.59.1
- Security issues fixed: CVE-2020-26978 and CVE-2020-35112.
- Unified XUL Platform Mozilla Security Patch Summary: 3 fixed, 16 not applicable.
Published 2020-11-25
This is a development and security update.
- Aligned CSS
tab-size with the specification and un-prefixed it.
- Updated Brotli library to 1.0.9.
- Updated JAR lib code.
- Cleaned up HPKP leftovers.
- Disabled the DOM filesystem API by default.
- Removed Phone Vibrator API.
- Fixed an issue where the software uninstaller would not remove the program files it should.
- Fixed a devtools crash related to timeline snapshots.
- Fixed several data race conditions.
- Security issues fixed: CVE-2020-26960, CVE-2020-26951, CVE-2020-26956, CVE-2020-15999 and several memory safety hazards.
- Unified XUL Platform Mozilla Security Patch Summary: 5 fixed, 4 defense-in-depth, 3 rejected, 19 not applicable.
Published 2020-10-30
This is a standard development and bugfix update.
- Implemented support for CSS
caret-color.
- Implemented support for un-prefixed
::selection CSS pseudo-element styling.
- Fixed another potential crashing scenario in
ResizeObservers.
- Fixed several crashes in the DOM
Fetch API.
- Fixed a crash in table pagination.
- Security issues fixed: CVE-2020-15680 (VG-VD-20-115) and several memory safety hazards.
- Unified XUL Platform Mozilla Security Patch Summary: 1 fixed, 2 defense-in-depth, 12 not applicable.
Published 2020-10-05
This is a standard development update.
- Implemented the ResizeObserver API.
- Implemented percentage value parsing for CSS opacity.
- Updated DOM MediaQueryList to the current draft spec.
- Updated CSS overflow-wrap to the current draft spec and implemented `anywhere`.
- Updated the Windows widget code to be more efficient on current O.S. targets.
- Performed source code cleanup (ongoing).
- Fixed a crash in CSS clip paths.
- Security issues addressed in this release: CVE-2020-15676, CVE-2020-15677.
- Unified XUL Platform Mozilla Security Patch Summary: 2 fixed, 2 defense-in-depth, 6 not applicable.
Published 2020-09-11
This is a compatibility, bugfix and security update.
- Updated JavaScript module loading in accordance with the spec for web compatibility.
- Disabled a function related to WebComponents to prevent mis-detection.
- Improved compatibility with websites that try to style standard form elements.
- Updated the SQLite library to 3.33.0.
- Changed media errors to be a more generic response, improving user privacy.
- Improved code stability (fixed a number of crashes).
- Updated the NSS library for various connection security fixes.
- Security issues addressed in this release: CVE-2020-15664, CVE-2020-15666, CVE-2020-15667, CVE-2020-15668 and CVE-2020-15669.
- Unified XUL Platform Mozilla Security Patch Summary: 4 fixed, 1 defense-in-depth, 1 rejected, 9 not applicable.
Published 2020-08-06
This is a development, bugfix and security update.
- Implemented the Abort API (aborting fetch requests) for web compatibility.
- Improved our handling of JavaScript module loading.
- Improved handling of aspect ratios of elements.
- Added support for basic polygon clip paths for web compatibility.
- Added global menubar support for GTK builds
- Implemented more parts of Google WebComponents (ongoing). These are disabled by default because they are incomplete as of yet.
- Fixed an issue in the uninstaller that would sometimes not properly delete program files.
- Fixed an issue with backspace in editable HTML elements.
- Fixed various browser crashes and hangs.
- Updated the NSS library for various connection security fixes.
- Updated the included en-US spellchecking dictionary with about 2,500 more words.
- Removed the DOM battery API.
- Made various code correctness and performance improvements to the editor library.
- Security issues addressed in this release: CVE-2020-12422, CVE-2020-12402, CVE-2020-12418, CVE-2020-15658, CVE-2020-15656, CVE-2020-15652, CVE-2020-6514, CVE-2020-15657 and a number of security hazards that do not have a CVE number attached.
- Unified XUL Platform Mozilla Security Patch Summary: 8 fixed, 6 defense-in-depth, 23 not applicable.
Published 2020-06-10
This is a development and security update.
- Implemented
URLSearchParams' sort() function
- Implemented ES2020
globalThis for web compatibility
- Implemented
node.getRootNode() for web compatibility
- Improved our WebM media parser to be more tolerant to different encoding styles.
- Improved our MP3 media parser to be more tolerant to different encoding styles and particularly tiny files/stream chunks.
- Improved performance of table drawing for more corner cases
- Changed the way images without a
src are handled in page layouts to align with the Chrome-pushed spec.
- Added modern MIPS support
- Split out the ICU data file from xul.dll on Windows
- Fixed a regression in WebAudio channel handling due to a landed security fix.
- Fixed a regression preventing scripting from properly disabling input controls
- Fixed an issue with border radius sometimes not being honored in tables
- Fixed some build issues in non-standard configurations.
- Removed more telemetry code
- Removed the in-browser speech recognition engine and API
- Removed support for the obsolete and unmaintained NVidia 3DVision stereoscopic interface.
- Changed handling of braille blanks in the ui (CVE-2020-12409)
- Mitigated a potential timing attack against DSA keys in NSS (CVE-2020-12399)
- Mitigated a potential use-after-free hazard in EME code.
- Unified XUL Platform Mozilla Security Patch Summary: 1 fixed, 2 defense-in-depth, 7 not applicable.
Published 2020-05-08
This is a development and security update.
- On-going work for implementing ShadowDOM v1, aligning the way DOM works as-needed.
- On-going work for solving dependency issues in C++ throughout the entire tree.
- Removed unused Contextual Identity Service.
- Implemented URLSearchParams
sort().
- Enabled DOM High resolution timestamps.
- Removed support for obsolete NV 3DVision stereoscopic hardware.
- Fixed a potential vulnerability in the zip file reader. DiD
- Fixed a potential vulnerability in the JavaScript JIT compiler related to aliases. DiD
- Ported several upstream devtools fixes (addresses CVE-2020-12392 and CVE-2020-12393).
- Ported upstream sctp fix (addresses CVE-2020-6831).
- Improved memory safety of some WebAudio calls.
- Improved memory safety in the XUL window destructor. DiD
- Unified XUL Platform Mozilla Security Patch Summary: 4 fixed, 3 DiD (Defense-in-depth), 15 not applicable.
Published 2020-04-17
This is a small compatibility update.
- Enabled building of AV1 codec support (for real this time).
Published 2020-04-15
This is a major development update.
Important: It is possible that since 2020.03.04 your browser is no longer checking automatically for updates,
due to an oversight in keeping a pre-release preference. You may have to check for updates manually from the About
box. Please verify after updating that your updating preferences are set correctly for your use!
- Changed site-specific overrides to use an operating system macro instead of hard-coding a version.
- Changed the way hardware acceleration is set on various operating systems.
- Fixed an incorrect preference preventing automatic updates by default.
- Changed the geolocation service requests to https thanks to a generous service donation by IP-API.com.
- Changed the security storage database type to SQLite.
- Enabled AV1 support in all builds; this was erroneously not built in recent releases.
- Fixed several potential crashes.
- Re-imported the ExtensionStorage js module for use by browser extensions.
- Removed the use of high-resolution Windows system timers from the layout refresh driver; this should help with some performance and battery life issues.
- Fixed an issue with element outlines sometimes being drawn too large.
- Fixed an issue with grid cell sizing.
- Fixed an issue with layout frames (e.g. selection popups) being wrongly positioned.
- Removed a potentially dangerous and otherwise ineffective optimization from the JavaScript engine.
- Fixed unwanted behavior where created/focused pop-up windows could potentially cover the DOM fullscreen notification, hiding it from users. (CVE-2020-6810)
- Fixed an issue where copying data as a curl request from developer tools would not properly escape parameters. (CVE-2020-6811)
- Updated our sctp library code with several upstream fixes.
- Fixed an issue with the release of document content viewers (CVE-2020-6819). Defense-in-depth.
- Fixed an issue with handling functions with rest parameters. Defense-in-depth.
- Removed HTTP Public Key Pinning (HPKP)
- Removed HSTS preloading list support since these lists are no longer efficient.
Published 2020-03-11
This is a small bugfix and compatibility update.
- Cleaned up front-end code.
- Fixed behavior for YouTube to prevent the deprecated interface being selected again.
Published 2020-03-04
This is a major development update.
- New modular setup for building: Basilisk has been split off from the UXP platform repository and will be maintained as its own application with UXP as a platform module.
- Implemented asynchronous iterators (
await iterator.next() and for await loops) (ES2018)
- Aligned
document.open() with the overhauled specification.
- Implemented promise-based media playback.
- Enabled seeking to next frame in media files.
- Improved table drawing performance again after the rewrite for sticky positioning making it slow.
- Aligned the way DOM styles are computed with mainstream browser behavior.
- Increased the maximum XML nesting depth to 2048 levels for extreme corner cases and to conservatively align with other browsers.
- Implemented an NSS performance optimization for Master Password use with limited effect.
- Implemented non-standard legacy CSSStyleSheet rules functions.
- Implemented the html5
<dialog> element. To switch this on, flip dom.dialog_element.enabled to true.
- Implemented CustomElements v1. (preffed, not functional yet due to reliance on shadowDOM).
- Implemented rule processing stub for font-variation-settings.
- Implemented optional catch binding (ES2019).
- Changed the way hardware acceleration is controlled from applications.
- Updated CSP processing to allow custom scheme wildcards to be specified without a port.
- Removed the (unused) DOM promise implementation.
- Disabled some logging in production builds.
- Disabled allowing remote
jar: URIs by default for security reasons. If you need this functionality for your non-standard environment, you can enable it with the preference network.jar.block-remote-files, but please consider moving away from this method of providing web-based applications.
- Completely removed
showModalDialog.
- Performed various tree-wide code cleanups.
- Removed various gadgeteering/redundant/dead DOM APIs (casting/presentation, FlyWeb)
- Removed "Copy raw data" button from the troubleshooting information page, since it's never used by us in that format, and users mistakenly keep using it instead of copying text.
- Removed a bunch of Android support code.
- Backed out a large code cleanup patch for causing subtle issues in website operation (e.g. WordPress). This will have to be revisited later; the reintroduced code is not in use in practice.
- Fixed several crashes.
- Fixed a parsing issue with
<template> tags.
- Fixed an issue with form elements sometimes being incorrectly disabled.
- Fixed some potential crashing scenarios with WebGL on Linux.
- Fixed a potential pointer issue issue in cubeb. (DiD)
- Fixed a crash due to ES6 modules (CVE-2020-9545).
Published 2020-02-18
This is a security and bugfix update.
- Fixed an issue in CSP blocking requests without a port for custom schemes.
- Fixed a potentially hazardous crash in layers.
- Fixed random crashes on some sites using IndexedDB.
- Changed the way the application can be invoked from the command-line to prevent a whole class of potential exploits involving modified omnijars.
- Fixed an issue in the HTML parser after using HTML5 template tags, allowing JavaScript parsing and execution when it should not be allowed, risking XSS vulnerabilities on sites relying on correct operation of the browser. (CVE-2020-6798)
- Unified XUL Platform Mozilla Security Patch Summary: 2 fixed, 2 DiD, 10 not applicable.
Published 2020-02-07
This is a small bugfix and compatibility update.
- Backed out regular expression lookbehind code for causing crashes.
- Fixed an issue where some poorly-implemented FTP servers could hang the browser.
- Changed behavior for YouTube to prevent the deprecated interface being selected by default.
Published 2020-01-12
This is a security, bugfix and development update.
Please note: from this release forward, windows archives are compressed with 7-zip, and Linux tarballs with xz.
- Added sticky positioning feature to HTML table parts.
- Removed the non-standard watch()/unwatch() debugging features. Some Firefox extensions will have to be updated to compensate for this.
- Fixed retrieving of certificates in the certificate exception dialog.
- Updated multiple third-party libraries, fixing numerous bugs.
- Removed Adobe PrimeTime EME CDM support.
- Enabled basic implementation of module type scripting.
- Implemented additional JavaScript features (regex lookbehind, regex dot-all flag, regex
.matchAll(), promise .finally()).
- Disabled HPKP preload list and the HPKP feature by default.
- Added support for Emoji 12 (Unicode 12.0).
- Updated NSS to 3.41.4 to address CVE-2019-11756 and CVE-2019-11745.
- Security issues fixed: CVE-2019-17019, CVE-2019-17026, and several potentially exploitable crashes and memory safety hazards that don't have a CVE number.
- Unified XUL Platform Mozilla Security Patch Summary: 4 fixed, 15 DiD, 28 not applicable.
Published 2019-10-31
This is a security and bugfix update.
- Updated timezone data for internationalization functions.
- Fixed the option to use hardware acceleration over RDP for Windows 8.1 and 10.
- Fixed an issue with inner window navigation potentially leaking.
- Fixed a startup crash caused by Qihoo 360 Safeguard/360 Total Security.
- Ported some expat parser fixes from upstream.
- Ported several NSS upstream fixes to our build.
- Aligned handling of U+0000 in the html5 parser with expectations.
- Added size checks to WebGL data buffering.
- Fixed build issues with newer glibc versions.
- Fixed build issues for ARM targets.
- Worked around a gcc9 compiler issue that would prevent building with it.
- Security issues fixed: CVE-2019-15903, CVE-2019-11757, CVE-2019-11763 and several potentially exploitable crashes and memory safety hazards that don't have a CVE number.
- Unified XUL Platform Mozilla Security Patch Summary: 6 fixed, 6 DiD, 1 rejected, 24 not applicable.
Published 2019-09-12
This is a security and bugfix update.
- Fixed an issue where saving a webpage to disk would sometimes drop tags from the document.
- Fixed an issue with click-to-play plugin content throwing up a blank notification.
- Fixed an issue in the renderer where region intersections would sometimes return the wrong result.
This fixes a regression caused by the fix for CVE-2016-5252.
- Fixed security issues: CVE-2019-11744, CVE-2019-11752, CVE-2019-11737, CVE-2019-11746, CVE-2019-11750, CVE-2019-11747 and CVE-2019-11738.
- Unified XUL Platform Mozilla Security Patch Summary: 7 fixed, 1 DiD, 1 already covered, 22 not applicable.
Published 2019-09-04
This is a Linux-only update to fix a versioning issue preventing updates.
Published 2019-09-03
This is a development, bugfix and security release.
Please note that Google Widevine DRM might currently not work in new installations due to Google's licensing model.
- Implemented JavaScript parser improvements and several TC39 spec revisions for web compatibility.
- Improved performance of the JavaScript engine.
- Added support for gzip-compressed SVG-in-Opentype fonts.
- Updated internationalization code to support updated time zones and the Japanese Reiwa era.
- Updated NSS to a custom version to have better encryption strength for master passwords.
- Added several performance improvements to DOM, the rendering engine and the parser.
- Improved general security of access to FTP-sourced resources
- Changed the way file access is handled from scripts to prevent cross-file access.
- Fixed SVG alignment issues causing blurry display of SVGs.
- Added support for Matroska media containers and AAC audio.
- Fixed security issues: CVE-2019-11719, CVE-2019-11711, CVE-2019-11715, CVE-2019-11717, CVE-2019-11714 (DiD), CVE-2019-11729 (DiD), CVE-2019-11727 (DiD), CVE-2019-11730 (DiD), CVE-2019-11713 (DiD) and several networking and memory-safety hazards that do not have CVE numbers.
- Fixed several memory safety hazards and crashes.
Published 2019-06-08
This is a development, bugfix and security release.
- Removed unused code: contextual identity, crash reporter leftovers, SecurityUI telemetry, "enhanced" new tab tiles.
- Updated the installer and internal updater.
- Removed all Firefox Accounts code and replaced the Sync client for compatibility.
- Implemented JavaScript parser improvements and the TC39
toString() revision proposal for web compatibility.
- Improved handling of
url() tokens in CSS to better handle incorrect syntax.
- Updated the embedded emoji font for broader emoji coverage.
- Fixed print failure for some web pages.
- Fixed Linux XRender performance issues over remote connections (e.g. X2Go).
- Improved JavaScript engine performance: dead compartment collection,
- Fixed an address bar focus issue in Private Browsing mode.
- Improved rendering performance for certain websites (with complex event regions).
- Implemented several ECMAScript 2019 features (String
trimStart/trimEnd, Array flat/flatMap, Symbol description)
- Fixed security issues: CVE-2019-7317, CVE-2019-11701, CVE-2019-11698, CVE-2019-9817 (DiD), CVE-2019-11700, CVE-2019-11696 and CVE-2019-11693.
- Fixed several memory safety hazards and crashes.
Published 2019-03-27
This is a development and security release.
- Added several site-specific overrides for web compatibility.
- Aligned http "Accept:" headers with the fetch spec, with the exception of image requests to continue allowing content negotiation.
- Fixed potential denial-of-service issues involving FTP (loading of subresources and spamming errors).
- Aligned
URLSearchParams with the spec.
- Fixed a corner case for flexbox layouts, improving rendering of some websites.
- Fixed Widevine compatibility issues.
- Fixed security issues: CVE-2019-9791, CVE-2019-9792, CVE-2019-9796, CVE-2019-9801, CVE-2019-9793, CVE-2019-9794, CVE-2019-9808, CVE-2019-9790, CVE-2019-9797, CVE-2019-9804 and ZDI-CAN-8368.
- Fixed several memory safety hazards and crashes.
- Windows binaries are now code-signed again (including the setup program for the installer).
Published 2019-03-08
This is a development and security release.
- Changed
location to allow an empty string set on search to clear URL parameters.
- Removed WebExtension support from the platform.
- Implemented the "origin-clean" algorithm for
ImageBitmap.
- Switched to using C++11 thread-safe statics in the entire application.
- Fixed several Skia security vulnerabilities (CVE-2018-18356, CVE-2018-18335 and CVE-2019-5785).
- Fixed a crash due to frames in some uncommon situations.
- Aligned textarea placeholder strings with the spec (preserve line breaks).
- Removed the Windows maintenance service code.
- Improved http basic auth DOS protection heuristics.
- Fixed arrows on some toolkit controls.
- Added a Netflix site-specific override to fix Silverlight playback.
Published 2019-02-11
This is a development and security release.
- Removed experimental WebExtension support from the browser.
Please check your add-ons; you may need to find alternatives for extensions that are no longer supported.
For background to this change, please see the following forum announcement.
- Removed more telemetry code from the platform.
- Finalized spec compliance of the IntersectionObserver API, and enabled it by default.
Related this, also fixed a number of browser crashes.
- Switched to the new ffmpeg decode API to avoid dropping of frames.
- Removed Mozilla-proprietary AudioContext constructor, improving spec compliance of WebAudio.
- Aligned Element.ScrollIntoView() with the spec.
- Fixed a buffering issue in the WebP decoder that caused intermittent browser crashes.
- Changed the Add-on Manager to the same one used by Pale Moon, unifying add-on handling.
Note: Some extensions that modify/style the Add-on Manager will have to be updated to work with Basilisk 2019 versions as a result.
- Improved resource-efficiency for internal stopwatch timers.
- Improved handling of incorrectly-encoded CTTS in media files, resolving some playback issues of videos.
- Updated SQLite lib to 3.26.
- Improved the Cycle Collector and Garbage Collector.
- Set the Incremental Garbage Collection time slice to 20 ms for more efficient JavaScript memory handling (regression fix).
- Improved fullscreen navigation bar handling in the situation it has focus when switching to full screen.
- Aligned
instanceof with the final ES6 spec.
- Fixed a potential use-after-free in IndexedDB code. (DiD)
- Improved proxy handling to avoid
localhost getting proxied. (CVE-2018-18506)
- Fixed several potentially-exploitable memory safety hazards and crashes. (DiD)
- Improved Windows DIB clipboard data handling.
Published 2018-12-18
This is a development and security release.
- Added a preference (network.http.upgrade-insecure-requests) to allow disabling requests for opportunistic encryption.
- Removed more telemetry code from the platform.
- Added experimental support for the AV1 video codec for MP4 containers (disabled by default).
- Cleaned up some media handling code, removing obsolete components for older target platforms.
- Ported all applicable security fixes from Gecko/64. Most of these fixes were merely defense-in-depth.
- Fixed a crash when using http pipelining over some broken proxies.
- Enhanced the WebP decoder to properly handle animated lossy and lossless WebP.
- Removed VR hardware support (both display and input types) from the platform.
- Updated the GMP update service URL to improve compatibility with DRM-encumbered media.
- Removed support for Firefox Accounts and changed the Sync client to work with Sync 1.1 (Weave).
The default server for using Sync is now the Pale Moon Sync server.
Please see this announcement on the forum for more details.
- Updated NSPR to 4.20.
- Updated NSS to 3.41, finalizing our platform support for TLS 1.3.
- Fixed a spec compliance issue with the location.protocol setter.
Published 2018-11-07
This is a bugfix release.
- Fixed an issue that prevented the browser from starting properly on some systems after the most recent update.
Published 2018-11-04
This is a development and security release.
- Removed more telemetry code from the platform.
- Updated libnestegg from upstream.
- Updated ffvpx library from upstream.
- Web dev: Make all arguments to init*Event() optional except the first.
- Ported all applicable security fixes from Gecko/63 and intermediate point releases.
- Fixed an issue in session storage scripting that might prematurely throw an error and interrupt session restore.
- Resolved an issue with long menus not scrolling if a submenu was open.
- Cleaned up and updated some installer code.
- Made caret width normal/thick behind CJK char configurable.
- Fixed an issue with table border scaling at various zoom levels.
- Updated handling of multimedia (on-going).
- Fixed a corner case behavioral issue when an Outlook-sourced mail message is dropped to the browser.
- Removed the unfinished and disabled in-browser translation code.
- Updated the Reader View components.
- Added experimental AV1 support for WebM videos (disabled by default).
Note: This is limited to WebM videos only at the moment, so it will not yet work on MP4 videos or MSE streaming (e.g. YouTube).
- Fixed an issue with CSS grid element sizing.
- Updated sidebar context menu behavior to be more in line with other browsers.
- Fixed an issue where a separate content process could be launched despite e10s being disabled.
- Disabled the reporting of CSS errors to the console by default to improve general performance.
Published 2018-09-28
This is a development and security release.
- Added support for local-ref URLs in SVG USE elements.
- Reinstated part of the searchplugin API that was removed by Mozilla, improving compatibility with search-engine modifying extensions.
- Improved compiler compatibility with GCC 8.
- Ported all applicable security patches from Gecko/62.
- Fixed wrong SVG sizes with non-integer values for viewBox width/height.
- Fixed a performance regression when many workers are in use simultaneously.
- Improved browser session restore speed by skipping unnecessary notifications.
- Fixed a crash with http authentication.
- Fixed a performance issue caused by rapid-fire timers due to value overflow.
- Fixed an issue with launching executable files not working.
- Fixed an issue where sites allowed to store offline data could not be removed from the permission list.
- Fixed an issue with common dialog boxes having incorrect sizes for their content.
- Fixed a regression: ICC v4 color profiles would not be honored.
- Remove the blocking of binary components in extensions.
- Added a preference to enable (experimental!) asynchronous panning and zooming on desktop.
- Fixed a potential crash when using SOCKS.
- Fixed a potential privacy issue in non-standard environments. (CVE-2017-7797)
- Fixed a memory leak when using SHA256 crypto.
Published 2018-09-05
This is a development release.
- Added new DataTransfer constructor (spec compliance).
- Aligned CSS layout flex grid with latest spec.
- Made the MP4 reader less sensitive to corrupt data.
- Improved media handling (ongoing).
- Updated NSPR/NSS and enabled the use of latest draft TLS 1.3.
- Changed the way network/cert errors are handled and displayed.
- Fixed an ANGLE rendering issue (WebGL2 crash fix).
- Added support for sbgp and sgpd boxes in EME.
- Fixed "sticky" menus in High Contrast themes.
- Updated zlib to 1.2.11.
- Enabled Direct3D9 accelerated layers as a fallback if Direct3D11 can't be used.
- Tuned the network stack for efficiency.
- Fixed a number of performance issues with the browser.
- Improved Mac OS X theming (unreleased).
- Improved compatibility with GCC 8.
- Reinstated RC4 and 3DES as weak cyphers as an option to enable use in non-standard environments (not enabled for the web by default).
- Removed most telemetry calling code from C++ and the JS TelemetryStopwatch. This prevents most data gathering and improves performance.
- Added an option (browser.newtabpage.add_to_session_history) to decide whether to store "about:newtab" in the session history for workflows of people wanting to use the back button to return to the QuickDial page.
- Added an option (ui.menu.allow_content_scroll) to override the OS convention to prevent scrolling of content when contextual menus are open.
- Added a horizontal scroll action option for mouse wheel.
Published 2018-07-18
This is a development and security release. We're only highlighting the most pertinent changes
this time, since there have been over 450 of them.
- Fixed an issue where windows would not be restored to their proper place if using custom device pixel ratios.
- Removed the whole UITour system.
- Removed the use of Disconnect if SafeBrowsing isn't built.
- Updated the Readability/Reader View components.
- Updated Cookie gating to be more strict.
- Updated NSPR/NSS and enabled the use of TLS 1.3 by default.
- Reinstated string.prototype.contains for compatibility (alias for .includes).
- Updated kiss-fft to v1.4.0 (fork).
- Fixed a serious memory leak in the WebP image decoder.
- Fixed compatibility issues with Youtube Live, .
- Improved legibility of fonts at certain scale levels on Windows.
- Fixed Firefox-inherited SSL status ambiguity. SSLStatus.CipherName now actually displays the name. The full suite is still available in the (new) property CipherSuite.
- Fixed some incorrect CSP handling.
- Prohibited web access to the moz-icon:// scheme to solve privacy issues with it.
- Fixed crash hazards in the editor.
- Removed SSL error reporting telemetry.
- Updated libwebp image decoder library to 1.0.0 + sec fixes.
- Made it possible for UXP applications to run within a chrooted environment (provided it's compiled against glibc)
- Ported several controlling preferences from Pale Moon (prompts.tab_modal.focusSwitch, browser.cache.backend, etc.)
- Fixed security issues: CVE-2018-12363, CVE-2018-12366, CVE-2018-12364, CVE-2018-12359, CVE-2018-12367, and CVE-2018-12360.
- Fixed a number of security, stability and memory safety hazards that did not have CVE numbers at the time of implementation.
Published 2018-06-01
This is a development and security release.
- Updated our strings for soft-blocked items so people will cry less when we do our job and warn about known-problematic add-ons.
- Fixed a regression in site-specific user-agent overrides that would prevent proper application on subdomains.
- Improved the reader view API.
- Removed more dead code from our tree (crashreporter components, gonk).
- Removed DMD code.
- Removed jprof profiler code.
- Removed the SPS profiler.
- Slimmed down IPC (ongoing).
- Removed the Social API code.
- Fixed some media back-end crashes and instabilities.
- Updated the fetch API to be more web-compatible.
- Limited maximum accepted image sizes for PNG images to prevent abuse/browser DoS.
- Blocking of top-level data: navigations is now enabled by default.
- Fixed security issues: CVE-2017-0381, CVE-2018-5174, CVE-2018-5155, CVE-2018-5173, CVE-2018-5177, CVE-2018-5159, CVE-2018-5167, CVE-2018-5154 and CVE-2018-5178.
- Fixed a number of stability and memory safety hazards that do not have CVE numbers.
Published 2018-05-15
This is a development release.
- Updated FFvpx lib to latest upstream.
- Improved the memory allocator for multi-core and modern O.S. use.
- Improved thread locking (mutexes).
- Added support for FFmpeg 4.0/libavcodec 58.
- Added some fixes for the performance timer API.
- Improved consistency of color emoji display.
- Fixed vertical lines in tabs on higher DPI screens.
- Improved full-screen control animation.
- Ported security and stability fixes from Mozilla.
- Reinstated the use of
xrender for proper Linux X11 performance.
- Fixed unsafe "instanceof" negations.
- Removed the e10s sandbox.
- Removed dead widget code.
- Removed legacy non-ICU Intl code.
Published 2018-04-27
This is a bugfix release.
- Fixed an issue with the master password that could make the password store become inaccessible.
- Clarified button labels in the password manager and cookie permissions manager.
Published 2018-04-26
This is a bugfix release.
- Added blocking of top-level data: URLs.
- Fixed several issues with docshell loads.
- Resolved issues with application.ini not allowing non-mcp applications to be official and have their own vendor.
- Regression fix: WebExtensions - commands API does not support shortcuts with space or numbers.
- Regression fix: Set a sandboxName on the WebExtensions Content Script sandboxes.
- Regression fix: (Windows) Security - Certificate Stores - NSSCertDBTrustDomain allows end-entities to be their own trust anchors.
- Regression fix: Re-implemented several improvements for pointer events.
- Regression fix: DOM - Fix incorrect TypeError: Response body is given with a null body status.
- Re-introduced some site-specific overrides that were erroneously removed (fixes e.g. dailymotion).
- Regression fix: Optimize operations on roots of deeply-nested frame trees (layout performance).
- Tweaked fullscreen API settings (add unprefixed API calls, remove too-long duration black fade).
- Removed Google Safebrowsing selections from preferences by default (it's disabled).
- Reverted the incomplete addition of the pluralforms Intl API as it caused problems.
- Fixed content permissions (e.g. cookies) access and storage.
- Reverted NSS 3.35 to 3.32.1 for instability problems similar to Pale Moon.
TLS 1.3 has been disabled by default along with this change to not attempt to use a draft standard.
Published 2018-04-24
This is the first release on the re-forked and re-based UXP. Regressions are possible as a result.
Please do let us know if you find something that regressed.
- New release based on UXP (take 2) which is an earlier Mozilla fork-point.
- Updated Javascript to fully cover ES6 and a good portion of the later specs.
- Implemented (in ongoing fashion) additional spec compliance patches for HTML, DOM and various other standards.
- Includes all previous security fixes.
Published 2018-03-21
This is a maintenance release.
- Fixed CVE-2018-5127: Buffer overflow manipulating SVG animatedPathSegList.
- Fixed CVE-2018-5129: Out-of-bounds write with malformed IPC messages.
- Fixed CVE-2018-5130: Mismatched RTP payload type can trigger memory corruption.
- Fixed CVE-2018-5131: Fetch API improperly returns cached copies of no-store/no-cache resources.
- Fixed CVE-2018-5144: Integer overflow during Unicode conversion.
- Fixed CVE-2018-5125: Memory safety bugs.
- Fixed CVE-2018-5145: Memory safety bugs.
- Fixed CVE-2018-5137: Path traversal on chrome:// URLs.
Published 2018-02-15
After this release, the current Basilisk will be in maintenance mode as we work on a re-forked UXP.
- Restored source-editor commands for scratchpad and style editor menus.
- Removed a bunch of Rust cruft.
- Moved a number of flow decisions from run-time to build-time to slim the browser down.
- Removed redundant Vista checks.
- Removed unused crash reporter conditional code.
- Enabled blocking of top-level data: URI navigations by default. If you need this functionality as a developer, flip security.data_uri.block_toplevel_data_uri_navigations. Note that this does not block manually entered data: URIs, only navigation to it from the browser.
- Added the status line (response) to raw header display.
- Removed b2g code.
- WebExtensions: Content Script sandboxes will now have their sandboxName set.
- Added an option to remove all session cookies for a specific domain.
- Added a number of devtools improvements.
- Fixed a number of crashes and instabilities in the browser.
Published 2018-02-02
- Fixed border and caret widths for natural rounding.
- Mitigated Meltdown/Spectre hazards.
- Removed b2g code.
- Fixed issues with ID-less web extensions and incorrect warnings in the add-on manager.
- Removed unused internal extensions and components.
- Fixed source editor controller commands.
- Fixed X-Frame-Options sameorigin check to check all ancestors.
- Fixed "sticky" menu colors in special accessibility ("high contrast") system themes.
- Made XDR decoding more robust, fixing a good handful of JavaScript engine crashes.
- Fixed security issues: CVE-2018-5099, CVE-2018-5093, CVE-2018-5113, CVE-2018-5095, CVE-2018-5098, CVE-2018-5111, CVE-2018-5109, CVE-2018-5122, CVE-2018-5091, CVE-2018-5097, CVE-2018-5102, CVE-2018-5104, and multiple potentially exploitable crashes and vulnerabilities that do not have a CVE assigned to them.
Published 2018-01-05
- Fixed potential registry name collisions on Windows for file types and protocols.
- Renamed Options to Preferences (Windows) and moved Preferences to the Tools menu (Linux).
- Switched off automatic form filling of login credentials and added a preference to control this.
- Completely removed the "Mozilla Settings Service" and "Blocklist service" client.
- Fixed a margin issue for the navigation bar.
- Adjusted the performance-timing resolution to prevent timing-based hardware-specific attacks ("Meltdown"/"Spectre").
- Limited the number of shared Array Buffers for normal JS code to prevent allocation issues.
- Disabled shared JS memory for the time being to make doubly-sure it can't be abused while "Spectre" is investigated further.
Published 2017-12-28
- Fixed several compatibility issues with WebExtensions.
- Disabled Mozilla's "system add-ons" service, which would allow Mozilla to remotely install add-ons.
- Disabled Mozilla's "system settings" service, which would allow Mozilla to remotely change settings or block add-ons.
- Updated SQLite lib to 3.21.0.
- Added an option to block top-level data: URIs.
- Removed referrers when opening links in new private windows.
- Updated license and rights pages.
- Changed the Feedback link to point to the forum instead of Mozilla.
- Fixed an issue with exportFunction().
- Fixed/enabled the use of Firefox Sync (Firefox Accounts).
- Restored the toolkit Error Console for application troubleshooting.
- Added '-jsconsole' and '-browserconsole' command-line arguments for launching of either console on startup.
- Removed what was left of the underused Social API.
- Changed the way element border rounding is done in Goanna to have natural rounding up/down of fractional sizes (IEEE 754).
- Fixed a potential leak involving IndexedDB and private browsing mode.
- Fixed a crash in ANGLE.
Published 2017-12-03
- Linux-only update to fix a release channel/update problem.
Published 2017-12-01
- Fixed add-on/GMP update calls to Mozilla services.
- Enabled accessibility features.
- Enabled parental Controls features (Windows only).
- Changed blocklist hosting to self-hosted.
- Removed leveraging the blocklist for CRL purposes.
- Included the Universal Runtime Libraries with the browser.
- No longer enforcing the "preferred" cipher suite profile on Http/2.
- Added support for the
worker-src CSP directive.
- Fixed freetype glyph metrics in Skia (fixes Freetype 2.8.1+ issues).
- Fixed an issue with ContentSecurityManager not passing the correct context.
- Fixed a number of issues with Contenteditable elements.
- Fixed a number of issues with pointer events.
- Implemented "cookie-averse document objects" to mitigate cookie injection.
- Fixed an issue with SVG text-based image masks.
- Fixed the installer checking for Firefox instead of Basilisk.
- Enabled the use of 64-bit plug-ins other than Flash and Silverlight.
- Made the SVG texture cache more lenient to large-resolution SVG images.
- Fixed several crashes and memory safety hazards.
- Fixed several security bugs: CVE-2017-7837, CVE-2017-7832, CVE-2017-7830, CVE-2017-7835, CVE-2017-7831, CVE-2017-7838, CVE-2017-7839, CVE-2017-7828, CVE-2017-7840, and several others from Firefox 57 that do not have a CVE designation.
Published 2017-11-17
- Initial release of Basilisk to the public.
