MozillaFirefox-translations-other-140.5.0-150200.152.210.1<>,@i]p9|o؛#qRvB^Y \xz&_}%X׬\I8[W5g/1"h 딼!& ޸Z! n¦~hƓT<r'I 38-Y/* Ieտ+t֧(aWv'I>X?Hd$, = \ 0HNXNN ,N N N NN NNZNNH "( F8 P9$:=NBF0GLNHۄNIܼNX YZL[P\lN]ޤN^bcdef"l$u8NvpzDCMozillaFirefox-translations-other140.5.0150200.152.210.1Extra translations for FirefoxThis package contains rarely used languages for the user interface of Firefox.i]ibs-power9-11rSUSE Linux Enterprise 15SUSE LLC MPL-2.0https://www.suse.com/System/Localizationhttp://www.mozilla.org/linuxppc64le`Q3 _ r]48aD"<?fnؘtH:ll4Up 12LK ȝtQq1^@f'/fITWz8 drb}_,+B{!AA큤iOi9i9i9i9i9i9i9i9i9i9i9i9i9i9i9i9i9i9i9i9i9i9i9i9i9i9i9i9i9i9i9i9i9i9i9i9i9i9i9i9i9i9i9i9i9i9i9i9i9i9i9i9i9i9i9i9i9i9i9i9i9i9i9i9i9i9i9i9i9i9i9i9i9i9i9i9i93992151c861e5245e8b5a9e8ae09ee5832e7cfd65e0c370cba0e2b13b8f74592e1f5c8daa622920b6545444306cdba85984daba90193e41fd54abb7a30c1f9882e6503958430304aa7b1c84c33405a0eb85f6278561bbdfe4db0c64e9c02a36e42b22958c896237fc77a66c38dfa7d54094071e277680ad2388c8fcc9f3cc1abe7d533a6af7bdf7f5885323818afd48afae404006143c6952750c9efcd316ba9433bc1920f849f341bfd46a7eb363c45d80454ac05b432a813cee20b3c67ee6311447ef6ad4c80b746fbb14712fdbe32e491bf602a78a43c3a37222f3cf8d64d9e358fb5d6d72cc70b93a33403d7c6761264ade064641272eb036cad76eaae626fadd5dd92efab59c058dcf697b97f0b793ae4ab7100b9c56bbbc9fe618f39debdad45963468d944c1f4ab9fc51f01cf674cfdd5b66e7e34ff4343030e5239ed72f5d221d781ef2ec5a419127cbfeada4b89d0c4bead4fa3baa9146ddf52f5ea5776607c7798bae3c4943caccb6ce5a23daa0fe5963f33b8489b05e072ce531af0fe017c9f40ac1b42e9097d56c3d63d9051be91928909341dac2f583ecd4a04afb7d19c1e13c1f770367852ec525f675eb4e9ed958b248ea0f2d21eb35fdb3208221816fe4b0f80c4cd087be8536657ef9f2b992ae4775247cc9fc335b7d442ab38aa79ad4b725beae001ae65798823b87d75c247323bbbbdc15814329cab6c6db7a40f549b7d84fb14b887280617f273ece98d139aaafcd8452d5e94a5cbd8f88ef78de7f4c34bb2cd6f154bdbce00c0f5b37de9f7b526aae10baebdf60acf0751a8ffe0fc65c54eaf7f1d114fab16bbacf63eef5cdbd27865ff39964ed30aa4360c4d9d849c4916d0492f54c115d8cf1cbcad42a6d9a549d74eb88a8a28a9b7063381ce7ca859addb8d77fb826bf6ce809ad1cc5a7d507c76421a4fa90e8b8f72d645ca46492254b967cdbc971374a098babc541208be46aac1d5772f887488fc87207e8bbba1f474f10a0bc0f11207c870fadce4583486a43f5032064f845c7abf5f848fb7be844ff74cc1f4d6e05dbbf31dcf93664cf0e0eb861d9a1a618740d2804a869be5df570b6b91c7afaac5fc610e22ec2e7d5c4f73a88aa793bd4a0410d39ed276864079e7ada12fd3c87233977cc30c9aef27fd91580a05d90c4adbfeb74092d943f7a651bb7c4a022c91ae5499310e383c37200e350193c92baf29c9c3e25e2b5ce5c88415ff608b5209e493de5bde1358c2cb938326121af737c9e44fe3bcd50e557b5c1342a2e9764fb34f458e1862cdcd855bf0920ec6b0a61f99c82bc8bf0657a2126056d77e5efb6626f166e0ae27c3dcc20d3e473be6ff5e5309ed2da7b5e810271395ffee57b52d50ab392a885a7b849a1472ebbc647b6485937a6bea9f1df1ff15782e63195c431178052215d1955c52c0eedb0a67119173659cddc24e611c559b4421876c9fdabc829355424402a934eb76ba27b4431d96b18ac2d907e305a8e1dc5cd1792b2bda45f9a7973ea1ae2c3a56957d0204e207740d4228c7b20bbd06782809721edd55a9ae8a7345a2572cfaa1b000454b5c123748c6dd44ef1ac7fcaa53aec34c886eed76858c6ab2b32818c09269cb5e3ceab65892c168785e8717ad25a4bd1c44733172e888997b3ecef1ef2989e93153045d4927fad4b7cc55432a40ee9394e5397bc0c0db023b71b752eb9807c6c925c520fe81f25cc51d9dcde1dea3cdf31e9e6047442d7efb93b43d106b2077204f5b8984d1d3ad889f37d80afafb02546ab9fea6ec14ddac83bb8991116342ebee894860d8d0db62c4350af6fe02ccaf1628b322c45c2088b84dbf45b4998d66ba1a41a70bb78329d322fcf41d4b64fff8dce22f1a0c9b56a9f133a90e6934b023e008151728685674f1f57dfb4632de6f04ea3970d561f670e31a1ffe21033f60a124998d9ece4bc11592960992674f301dee7992af5439b96bce378067284a4118bebb6d3f0bc8f7b1c3065a65580fb5d816aefb7ba085d90815930864ec1e95a38179d57f5b1509ae4f899a3070f59e137402182a3ac15b2878527c197bac25a1e4f01685d3b4a2c3a054f6e4dd7235ee5a73d48b81348f4906511ec477123827d06fb858dcf30d763057febc432aee143e59f510ca60faac45cf7e3d983662437745a9cb5322d9248c8cc937b7a0b9619318eaae8bd0517f5edc49f2861c4c3607ea286f818025218f25f32ddfadb6d178f0b2bf0897e3728deade20911086a13fcc2aad6c988974125cce56fc78840ac1904b59e49cbaa43c58856b7ca2752a079e65fbdfe847f18d5109cc34d989df48fc4ddb305664acaac3772d88ae6a8d652e7d00d356d289b1cb11bcfe3df063f7a0fbd73e9b803f10221114272a56e946328b6305b814ccbb022572ba36a6b969c532b7677de56c96c72e72492d58b88290d9acddeb34799a29a48266a6de5cb097168c92adb40b8e9e3c571a2b2dc53294cf7711d0050bce3f90dde4461d738428b51bcb8a67b7b14dc75701ed52a5befcb04978f1efafd35a155f53abf6c924dda480aecc948b570b4b128ac02e107ab3bfce6dd8db91a52cde677932b0396bf98c5a4c0dde4d2730a7d01d02e8e8985182e20e8765d9fc02bde08372e7b7ae6a01e254b4afd9c235c962da7a55f38055d832f317cb383da9a925df2051732ee936f1e54bc3539acc23a3eaf668f9f56955072e6a45284680fe9b2c991cd3eca649468c324142bf29383fa613850135fda6c8e87f5a6fd5058849aa5dbfe730e5832cd6b3e16a271418e950ee7d8752a083a67d165dd562de6d3378824366d5ab91e6b8000b52c886f355d87d2016a35fcb1331e7d5e1b8e827d09c08136dea51a9339a83d70992e5b02cb8917918c507bb071a84e1a30897c2086963aa7a2fcdeba39fe08a477cea35a02f0ef71e4c12ebebac4359b775480690f25024ac3503317d72eed81f35933e3ebec15399a3a2d72c57f5be0efe05d21ff88c9939312d7e292b82c7f01e6072ebd226daabaf5410f1ac45dd89acbc9640615f23d4261a47c5d3229eafbaf93855ba88e9304b3286aa877ac71b6499570f0a6aff6f62bd2d10c1492a7bb213a52640ce8f38ab00f0f00e785c2868ef68017c7073bd5a8c76607e0110a473ab30dd0f17bfacc4c6a5212d7989078a1e25922b2fee0a13d07062b985263ac27fe5548f99368b95123b159276e04a27d3e6914ba28bea4a5b996990c63615e405aecf8c991c3488e096b54db19e3baac8ea0e1bffd5d7016a740959a2a8f5f6b558f946ddc606dc77df615e032e5f13c29ccd67268e87405edc353975222de2d5dd25302cf51635d0c6511b06fe9a14fa176ec8d14b131e284d5996d935800aa0f47bf33afffa105bc14bf80b912853fe31df9946de5b53b296ab65f0d04ed657dee399rootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootMozillaFirefox-140.5.0-150200.152.210.1.src.rpmMozillaFirefox-translations-otherMozillaFirefox-translations-other(ppc-64)locale(MozillaFirefox:ach;af;an;ast;az;be;bg;bn;br;bs;cak;cy;dsb;en_CA;eo;es_MX;et;eu;fa;ff;fy_NL;ga_IE;gd;gl;gn;gu_IN;he;hi_IN;hr;hsb;hy_AM;ia;id;is;ka;kab;kk;km;kn;lij;lt;lv;mk;mr;ms;my;ne_NP;nn_NO;oc;pa_IN;rm;ro;si;sk;sl;son;sq;sr;ta;te;th;tr;uk;ur;uz;vi;xh)    MozillaFirefoxrpmlib(CompressedFileNames)rpmlib(FileDigests)rpmlib(PayloadFilesHavePrefix)rpmlib(PayloadIsXz)140.5.03.0.4-14.6.0-14.0-15.2-14.14.1ihR@hҋhҋhh@hh,hZhxhkh]6@hQXhQXh,nh+@h@ggggvgM@gDfggp@f@f@f'@fwf=@f@faf;i@f-ere@eBeeexK@eV@e.w@e@e 0@eRd dd\@d dD@d@dx@dX@d.@d c1cGcclcN@c$e@cc@b?b@bbbi0@bL/@bDF@b3"b0b(b%b[@a@aq@a*@aLa@a(@apa\>@aV@a9@a8a@aaj@`#@`@`!@``}p`[)`4@`!'`@__إ@_@_/@_@_u_i@_a@_a@_D@_C_6|_*@_'@_ @_^@^z^)@^?@^V@^U@^k@^v^t@^g@^B@^&^^r]N@]]@]d@]]@]]n]@]z@]@]v>] ] #] #\\@\ޢ@\ڭ\@\!\f\e\@\\u*@\d\Q\@n@\@\@\@[ @[;@[@[@[h@[3|@[@ZZZ2@ZZ@Z}@Zg#Z_:Z]@ZF.@Z3@Z+@Z YYχ@Y5Y@Y@YY\YA%@Y$$@Y]XX9@X9@X@XXCX@X6@XXN@XJX@X)@X W%W@W$Wu@WF@WWWW9WE@W\@W@Ws@WaC@W_W^@W^@WV@WEWBW4p@W)@W(W W WW @W VVV@V>@VwVVV@VuVm]VHsV4@V@VV @UN@UUĝUĝU@UUt2@U`kUUUUUOH@U0UUUQU ]@U T@T!TT@T*@Ty@T\@TXTWn@TWn@TR(@TO@TKTCT>amartin.sirringhaus@suse.commartin.sirringhaus@suse.commartin.sirringhaus@suse.commartin.sirringhaus@suse.commartin.sirringhaus@suse.commartin.sirringhaus@suse.commartin.sirringhaus@suse.commartin.sirringhaus@suse.commartin.sirringhaus@suse.commartin.sirringhaus@suse.comcgrobertson@suse.commartin.sirringhaus@suse.commartin.sirringhaus@suse.commartin.sirringhaus@suse.commartin.sirringhaus@suse.commartin.sirringhaus@suse.commartin.sirringhaus@suse.commartin.sirringhaus@suse.commartin.sirringhaus@suse.commartin.sirringhaus@suse.commartin.sirringhaus@suse.commartin.sirringhaus@suse.commartin.sirringhaus@suse.commartin.sirringhaus@suse.commartin.sirringhaus@suse.comcgrobertson@suse.commartin.sirringhaus@suse.commartin.sirringhaus@suse.commartin.sirringhaus@suse.commartin.sirringhaus@suse.commartin.sirringhaus@suse.commartin.sirringhaus@suse.commartin.sirringhaus@suse.commartin.sirringhaus@suse.commartin.sirringhaus@suse.commartin.sirringhaus@suse.commartin.sirringhaus@suse.commartin.sirringhaus@suse.commartin.sirringhaus@suse.commartin.sirringhaus@suse.commartin.sirringhaus@suse.commeissner@suse.commartin.sirringhaus@suse.comcgrobertson@suse.commartin.sirringhaus@suse.commartin.sirringhaus@suse.commartin.sirringhaus@suse.commartin.sirringhaus@suse.comcgrobertson@suse.commartin.sirringhaus@suse.commartin.sirringhaus@suse.commartin.sirringhaus@suse.commartin.sirringhaus@suse.commartin.sirringhaus@suse.commartin.sirringhaus@suse.commartin.sirringhaus@suse.commartin.sirringhaus@suse.commartin.sirringhaus@suse.commartin.sirringhaus@suse.commartin.sirringhaus@suse.commartin.sirringhaus@suse.comcgrobertson@suse.commartin.sirringhaus@suse.commartin.sirringhaus@suse.commartin.sirringhaus@suse.commartin.sirringhaus@suse.commartin.sirringhaus@suse.commartin.sirringhaus@suse.commartin.sirringhaus@suse.commartin.sirringhaus@suse.commartin.sirringhaus@suse.commartin.sirringhaus@suse.comcgrobertson@suse.commartin.sirringhaus@suse.commartin.sirringhaus@suse.commartin.sirringhaus@suse.commartin.sirringhaus@suse.commartin.sirringhaus@suse.comandreas.stieger@gmx.demartin.sirringhaus@suse.commartin.sirringhaus@suse.commartin.sirringhaus@suse.commartin.sirringhaus@suse.comcgrobertson@suse.comcgrobertson@suse.commartin.sirringhaus@suse.comcgrobertson@suse.commartin.sirringhaus@suse.comwilliam.brown@suse.commartin.sirringhaus@suse.commartin.sirringhaus@suse.commartin.sirringhaus@suse.commartin.sirringhaus@suse.commartin.sirringhaus@suse.commartin.sirringhaus@suse.commartin.sirringhaus@suse.commartin.sirringhaus@suse.commartin.sirringhaus@suse.commartin.sirringhaus@suse.commartin.sirringhaus@suse.comcgrobertson@suse.comcgrobertson@suse.comcgrobertson@suse.commartin.sirringhaus@suse.commartin.sirringhaus@suse.commartin.sirringhaus@suse.comcgrobertson@suse.comcgrobertson@suse.comcgrobertson@suse.commartin.sirringhaus@suse.commartin.sirringhaus@suse.commartin.sirringhaus@suse.comcgrobertson@suse.commartin.sirringhaus@suse.comcgrobertson@suse.comcgrobertson@suse.commartin.sirringhaus@suse.comcgrobertson@suse.commartin.sirringhaus@suse.commartin.sirringhaus@suse.comandreas.stieger@gmx.decgrobertson@suse.commartin.sirringhaus@suse.comcgrobertson@suse.commartin.sirringhaus@suse.commartin.sirringhaus@suse.commartin.sirringhaus@suse.commartin.sirringhaus@suse.comcgrobertson@suse.commartin.sirringhaus@suse.commartin.sirringhaus@suse.commartin.sirringhaus@suse.comcgrobertson@suse.commartin.sirringhaus@suse.commartin.sirringhaus@suse.commartin.sirringhaus@suse.commartin.sirringhaus@suse.commartin.sirringhaus@suse.comcgrobertson@suse.commartin.sirringhaus@suse.commartin.sirringhaus@suse.commartin.sirringhaus@suse.commartin.sirringhaus@suse.commartin.sirringhaus@suse.commartin.sirringhaus@suse.comcgrobertson@suse.comcgrobertson@suse.compsimons@suse.comjkowalczyk@suse.comcgrobertson@suse.comcgrobertson@suse.comcgrobertson@suse.comcgrobertson@suse.comalarrosa@suse.comcgrobertson@suse.comcgrobertson@suse.comkbabioch@suse.decgrobertson@suse.comcgrobertson@suse.comalarrosa@suse.comalarrosa@suse.comalarrosa@suse.comcgrobertson@suse.compcerny@suse.compcerny@suse.compcerny@suse.comwr@rosenauer.orgastieger@suse.comwr@rosenauer.orgwr@rosenauer.orgastieger@suse.comwr@rosenauer.orgwr@rosenauer.orgwbauer@tmo.atcgrobertson@suse.comastieger@suse.comfcrozat@suse.comsecurity@suse.comwr@rosenauer.orgstefan.bruens@rwth-aachen.dezaitor@opensuse.orgwr@rosenauer.orgdimstar@opensuse.orgschwab@suse.dewr@rosenauer.orgastieger@suse.comwr@rosenauer.orgwr@rosenauer.orgwr@rosenauer.orgwr@rosenauer.orgwr@rosenauer.orgwr@rosenauer.orgwr@rosenauer.orgwr@rosenauer.orgwr@rosenauer.orgwr@rosenauer.orgastieger@suse.comwr@rosenauer.orgwr@rosenauer.orgcgrobertson@novell.comwr@rosenauer.orgwr@rosenauer.orgastieger@suse.combadshah400@gmail.comastieger@suse.comwr@rosenauer.orgastieger@suse.comastieger@suse.comwr@rosenauer.orgpcerny@suse.combadshah400@gmail.comwr@rosenauer.orgbadshah400@gmail.comantoine.belvire@laposte.netmailaender@opensuse.orgastieger@suse.comwr@rosenauer.orgbadshah400@gmail.comagraf@suse.comwr@rosenauer.orgwr@rosenauer.orgbadshah400@gmail.combadshah400@gmail.comdsterba@suse.czwr@rosenauer.orgnormand@linux.vnet.ibm.combadshah400@gmail.comwr@rosenauer.orgbadshah400@gmail.combadshah400@gmail.comastieger@suse.comastieger@suse.comwr@rosenauer.orgolaf@aepfle.deastieger@suse.comwr@rosenauer.orgdmueller@suse.comwr@rosenauer.orgastieger@suse.comwr@rosenauer.orgwr@rosenauer.orgwr@rosenauer.orgwr@rosenauer.orgwr@rosenauer.orgwr@rosenauer.orgwr@rosenauer.orgwr@rosenauer.orgwr@rosenauer.orgwr@rosenauer.orgwr@rosenauer.orgwr@rosenauer.orgschwab@suse.dewr@rosenauer.orgwr@rosenauer.orgnormand@linux.vnet.ibm.comwr@rosenauer.orgwr@rosenauer.orgwr@rosenauer.orgwr@rosenauer.orgwr@rosenauer.orgdvaleev@suse.comwr@rosenauer.orgdimstar@opensuse.orgwr@rosenauer.orgwr@rosenauer.orgwr@rosenauer.orgwr@rosenauer.orgledest@gmail.comwr@rosenauer.orgwr@rosenauer.orgguillaume@opensuse.orgdmueller@suse.comjosua.mayer97@gmail.comwr@rosenauer.orgjosua.mayer97@gmail.comwr@rosenauer.orgvindex17@outlook.itwr@rosenauer.org- Firefox Extended Support Release 140.5.0 ESR * Fixed: Various security fixes. MFSA 2025-88 (bsc#1253188) * CVE-2025-13012 (bmo#1991458) Race condition in the Graphics component * CVE-2025-13016 (bmo#1992130) Incorrect boundary conditions in the JavaScript: WebAssembly component * CVE-2025-13017 (bmo#1980904) Same-origin policy bypass in the DOM: Notifications component * CVE-2025-13018 (bmo#1984940) Mitigation bypass in the DOM: Security component * CVE-2025-13019 (bmo#1988412) Same-origin policy bypass in the DOM: Workers component * CVE-2025-13013 (bmo#1991945) Mitigation bypass in the DOM: Core & HTML component * CVE-2025-13020 (bmo#1995686) Use-after-free in the WebRTC: Audio/Video component * CVE-2025-13014 (bmo#1994241) Use-after-free in the Audio/Video component * CVE-2025-13015 (bmo#1994164) Spoofing issue in Firefox- Firefox Extended Support Release 140.4.0 ESR * Fixed: Various security fixes. MFSA 2025-83 (bsc#1251263) * CVE-2025-11708 (bmo#1988931) Use-after-free in MediaTrackGraphImpl::GetInstance() * CVE-2025-11709 (bmo#1989127) Out of bounds read/write in a privileged process triggered by WebGL textures * CVE-2025-11710 (bmo#1989899) Cross-process information leaked due to malicious IPC messages * CVE-2025-11711 (bmo#1989978) Some non-writable Object properties could be modified * CVE-2025-11712 (bmo#1979536) An OBJECT tag type attribute overrode browser behavior on web resources without a content-type * CVE-2025-11713 (bmo#1986142) Potential user-assisted code execution in “Copy as cURL” command * CVE-2025-11714 (bmo#1973699, bmo#1989945, bmo#1990970, bmo#1991040, bmo#1992113) Memory safety bugs fixed in Firefox ESR 115.29, Firefox ESR 140.4, Thunderbird ESR 140.4, Firefox 144 and Thunderbird 144 * CVE-2025-11715 (bmo#1983838, bmo#1987624, bmo#1988244, bmo#1988912, bmo#1989734, bmo#1990085, bmo#1991899) Memory safety bugs fixed in Firefox ESR 140.4, Thunderbird ESR 140.4, Firefox 144 and Thunderbird 144- Firefox Extended Support Release 140.3.1 ESR (bsc#1250452) * Fixed: Improved reliability when HTTP/3 connections fail: Firefox no longer forces HTTP/2 during fallback, allowing the server to choose the protocol and preventing stalls on some sites. (bmo#1980812)- Replace mozilla-bmo998749.patch with upstreams version- Firefox Extended Support Release 140.3.0 ESR * Fixed: Various security fixes. MFSA 2025-75 (bsc#1249391) * CVE-2025-10527 (bmo#1984825) Sandbox escape due to use-after-free in the Graphics: Canvas2D component * CVE-2025-10528 (bmo#1986185) Sandbox escape due to undefined behavior, invalid pointer in the Graphics: Canvas2D component * CVE-2025-10529 (bmo#1970490) Same-origin policy bypass in the Layout component * CVE-2025-10532 (bmo#1979502) Incorrect boundary conditions in the JavaScript: GC component * CVE-2025-10533 (bmo#1980788) Integer overflow in the SVG component * CVE-2025-10536 (bmo#1981502) Information disclosure in the Networking: Cache component * CVE-2025-10537 (bmo#1938220, bmo#1980730, bmo#1981280, bmo#1981283, bmo#1984505, bmo#1985067) Memory safety bugs fixed in Firefox ESR 140.3, Thunderbird ESR 140.3, Firefox 143 and Thunderbird 143- Firefox Extended Support Release 140.2.0 ESR * Fixed: Various security fixes. MFSA 2025-67 (bsc#1248162) * CVE-2025-9179 (bmo#1979527) Sandbox escape due to invalid pointer in the Audio/Video: GMP component * CVE-2025-9180 (bmo#1979782) Same-origin policy bypass in the Graphics: Canvas2D component * CVE-2025-9181 (bmo#1977130) Uninitialized memory in the JavaScript Engine component * CVE-2025-9182 (bmo#1975837) Denial-of-service due to out-of-memory in the Graphics: WebRender component * CVE-2025-9183 (bmo#1976102) Spoofing issue in the Address Bar component * CVE-2025-9184 (bmo#1929482, bmo#1976376, bmo#1979163, bmo#1979955) Memory safety bugs fixed in Firefox ESR 140.2, Thunderbird ESR 140.2, Firefox 142 and Thunderbird 142 * CVE-2025-9185 (bmo#1970154, bmo#1976782, bmo#1977166) Memory safety bugs fixed in Firefox ESR 115.27, Firefox ESR 128.14, Thunderbird ESR 128.14, Firefox ESR 140.2, Thunderbird ESR 140.2, Firefox 142 and Thunderbird 142- Add build_limit for s390x on SLE16 (bsc#1247774)- Add patch mozilla-kde-force-xdg-portal.patch to switch to using xdg-desktop-portal file-picker on KDE on SLE-15 (bsc#1226112)- Firefox Extended Support Release 140.1.0 ESR * Fixed: Various security fixes. MFSA 2025-59 (bsc#1246664) * CVE-2025-8027 (bmo#1968423) JavaScript engine only wrote partial return value to stack * CVE-2025-8028 (bmo#1971581) Large branch table could lead to truncated instruction * CVE-2025-8029 (bmo#1928021) javascript: URLs executed on object and embed tags * CVE-2025-8036 (bmo#1960834) DNS rebinding circumvents CORS * CVE-2025-8037 (bmo#1964767) Nameless cookies shadow secure cookies * CVE-2025-8030 (bmo#1968414) Potential user-assisted code execution in “Copy as cURL” command * CVE-2025-8031 (bmo#1971719) Incorrect URL stripping in CSP reports * CVE-2025-8032 (bmo#1974407) XSLT documents could bypass CSP * CVE-2025-8038 (bmo#1808979) CSP frame-src was not correctly enforced for paths * CVE-2025-8039 (bmo#1970997) Search terms persisted in URL bar * CVE-2025-8033 (bmo#1973990) Incorrect JavaScript state machine for generators * CVE-2025-8034 (bmo#1970422, bmo#1970422, bmo#1970422, bmo#1970422) Memory safety bugs fixed in Firefox ESR 115.26, Firefox ESR 128.13, Thunderbird ESR 128.13, Firefox ESR 140.1, Thunderbird ESR 140.1, Firefox 141 and Thunderbird 141 * CVE-2025-8040 (bmo#1975058, bmo#1975058, bmo#1975998, bmo#1975998) Memory safety bugs fixed in Firefox ESR 140.1, Thunderbird ESR 140.1, Firefox 141 and Thunderbird 141 * CVE-2025-8035 (bmo#1975961, bmo#1975961, bmo#1975961) Memory safety bugs fixed in Firefox ESR 128.13, Thunderbird ESR 128.13, Firefox ESR 140.1, Thunderbird ESR 140.1, Firefox 141 and Thunderbird 141- Replace usage of %jobs for reproducible builds (boo#1237231)- Firefox Extended Support Release 140.0esr ESR * General - Reader View now has an enhanced Text and Layout menu with new options for character spacing, word spacing, and text alignment. These changes offer a more accessible reading experience. - Reader View now has a Theme menu with additional Contrast and Gray options. You can also select custom colors for text, background, and links from the Custom tab. - Firefox will now offer to temporarily remember when users grant permissions to sites (e.g. geolocation). Temporary permissions will be removed either after one hour or when the tab is closed. - Firefox now includes safeguards to prevent sites from abusing the history API by generating excessive history entries, which can make navigating with the back and forward buttons difficult by cluttering the history. This intervention ensures that such entries, unless interacted with by the user, are skipped when using the back and forward buttons. - Firefox now identifies all links in PDFs and turns them into hyperlinks. - You can now copy links from background tabs using the tabstrip context menu on macOS and Linux. - Users on macOS and Linux are now given the option to close only the current tab if the Quit keyboard shortcut is used while multiple tabs are open in the window. (bmo#None) * Sidebar and Tabs - You can now enable the updated Firefox sidebar in Settings > General > Browser Layout to quickly access multiple tools in one click, without leaving your main view. Sidebar tools include an AI chatbot of your choice, bookmarks, history, and tabs from devices you sync with your Mozilla account. - Keep a lot of tabs open? Try our new vertical tabs layout to quickly scan your list of tabs. With vertical tabs, your open and pinned tabs appear in the sidebar instead of along the top of the browser. To turn on vertical tabs, right-click on the toolbar near the top of the browser and select Turn on Vertical Tabs. If you’ve enabled the updated sidebar, you can also go to Customize sidebar and check Vertical tabs. Early testers report feeling more organized after using vertical tabs for a few days. - Stay productive and organized with less effort by grouping related tabs together. One simple way to create a group is to drag a tab onto another, pause until you see a highlight, then drop to create the group. Tab groups can be named, color-coded, and are always saved. You can close a group and reopen it later. - A tab preview is now displayed when hovering the mouse over background tabs, making it easier to locate the desired tab without needing to switch tabs. - The sidebar to view tabs from other devices can now be opened via the Tab overview menu. * Security & Privacy - HTTPS is replacing HTTP as the default protocol in the address bar on non-local sites. If a site is not available via HTTPS, Firefox will fall back to HTTP. - Firefox now blocks third-party cookie access when Enhanced Tracking Protection's Strict mode is enabled. - Firefox now has a new anti-tracking feature, Bounce Tracking Protection, which is now available in Enhanced Tracking Protection's "Strict" mode. This feature detects bounce trackers based on their redirect behavior and periodically purges their cookies and site data to block tracking. - Firefox now enforces certificate transparency, requiring web servers to provide sufficient proof that their certificates were publicly disclosed before they will be trusted. This only affects servers using certificates issued by a certificate authority in Mozilla's Root CA Program. - Smartblock Embeds allows users to selectively unblock certain social media embeds that are blocked in ETP Strict and Private Browsing modes. Currently, support is limited to a few embed types, with more to be added in future updates. - Firefox now upgrades page loads to HTTPS by default and gracefully falls back to HTTP if the secure connection fails. This behavior is known as HTTPS-First. - The "Copy Without Site Tracking" menu item was renamed to "Copy Clean Link" to help clarify expectations around what the feature does. "Copy Clean Link" is a list based approach to remove - known tracking parameters from links. This option can also now be used on plain text links. - The Clear browsing data and cookies dialog now allows clearing saved form info separately from browsing history. * Translations - Firefox now allows translating selected text portions to different languages after a full-page translation. - Full-Page Translations are now available within Firefox extension pages that start with the moz-extension:// URL scheme. - When suggesting a default translation language, Firefox will now take into consideration languages you have previously used for translations. - Added support for many new languages in Firefox translation. * Windows - Canvas2D switched from Direct2D to a platform independent acceleration backend on Windows. - Hardware-accelerated playback of HEVC video content is now supported on Windows. - Firefox on Windows 11 now uses acrylic-style menus for popup windows, which better match the operating system’s aesthetic. * macOS - Added support for multiple languages in the same document spoken in macOS VoiceOver. - The macOS session resume feature has been enhanced. Firefox will now automatically relaunch if it was open before a system restart, like after an OS update. - The macOS DMG installer packages now use LZMA for compression, reducing download size and installation time. - Due to recent changes in macOS Sequoia, the shortcut for completing search strings to .com addresses has been changed from Ctrl+Enter to Cmd+Enter. * Linux - Firefox now supports touchpad hold gestures on Linux. This means that kinetic (momentum) scrolling can now be interrupted by placing two fingers on the touchpad. * Developer: - Firefox now supports text fragments, which allows users to link directly to a specific portion of text in a web document via a special URL fragment. - Debugger log-point values are now automatically converted into profiler markers, making it easy to add information to the marker timeline directly from the Debugger. - The Debugger's directory root is now scoped to the specific domain where it was set, which aligns with typical usage and avoids applying it across unrelated domains. This builds on previous improvements such as a redesigned UI and easier removal of the root setting. Setting a directory root updates the Source List to show only the selected directory and its children. (Learn more) - The Network Blocking feature in the Network panel now blocks HTTP requests in addition to blocking responses. - The Network panel displays information about Early Hints, including a dedicated indicator for the 103 HTTP status code in the user interface. - The Network panel now allows overriding network request responses with local files. - The filter setting in the Network panel is now preserved across DevTools Toolbox sessions. - A new column has been added to the Network panel to display the full path of the request URL. This enhancement makes helps developers quickly view and analyze complete request paths. - Introduced a new console command `$$$` that allows searching the page, including within shadow roots. - Improved support for debugging web extensions, such as automatically reloading the web extension's source code in the Debugger when the extension is reloaded. Workers are now available in the Console panel’s context selector and breakpoints function correctly in content scripts. - In the Inspector Fonts panel, we now display fonts metadata, like the font version, designer, vendor, license, etc. - Added support for the import map integrity field, allowing you to ensure the integrity of dynamically or statically imported modules. - Implemented support for `Error.isError`, enabling brand checks to determine whether an object is an instance of Error. (Learn more) - Added support for the `error.captureStackTrace` extension to improve compatibility with other browsers. (Learn more: http://github.com/tc39/proposal-error-capturestacktrace) * Enterprise: - The UserMessaging policy has been updated with a new option to allow disabling Firefox Labs in preferences. - The Preferences policy has been updated to allow setting the preference security.pki.certificate_transparency.mode. - HTTPS-First is now on by default. You can manage this behavior using the HttpsOnlyMode and HttpAllowlist policies. - An internal change has been made to Firefox that removes `XPCOMUtils.defineLazyGetter`. For most people, this shouldn't matter, but if you encounter problems with AutoConfig or third party software like PolicyPak, this might be the cause. You'll need to reach out to your provider. - Firefox now supports the Content Analysis SDK for integrating DLP software. For more information, see this post. - The SearchEngines policy is now available on all versions of Firefox (not just the ESR). * Fixed: Various security fixes. MFSA 2025-51 (bsc#1244670) * CVE-2025-6424 (bmo#1966423) Use-after-free in FontFaceSet * CVE-2025-6425 (bmo#1717672) The WebCompat WebExtension shipped with Firefox exposed a persistent UUID * CVE-2025-6426 (bmo#1964385) No warning when opening executable terminal files on macOS * CVE-2025-6427 (bmo#1966927) connect-src Content Security Policy restriction could be bypassed * CVE-2025-6428 (bmo#1970151) Firefox for Android opened URLs specified in a link querystring parameter * CVE-2025-6429 (bmo#1970658) Incorrect parsing of URLs could have allowed embedding of youtube.com * CVE-2025-6430 (bmo#1971140) Content-Disposition header ignored when a file is included in an embed or object tag * CVE-2025-6431 (bmo#1942716) The prompt in Firefox for Android that asks before opening a link in an external application could be bypassed * CVE-2025-6432 (bmo#1943804) DNS Requests leaked outside of a configured SOCKS proxy * CVE-2025-6433 (bmo#1954033) WebAuthn would allow a user to sign a challenge on a webpage with an invalid TLS certificate * CVE-2025-6434 (bmo#1955182) HTTPS-Only exception screen lacked anti-clickjacking delay * CVE-2025-6435 (bmo#1950056, bmo#1961777) Save as in Devtools could download files without sanitizing the extension * CVE-2025-6436 (bmo#1941377, bmo#1960948, bmo#1966187, bmo#1966505, bmo#1970764) Memory safety bugs fixed in Firefox 140 and Thunderbird 140- removed patches firefox-kde.patch, mozilla-kde.patch, fix-sle12-build-errors.patch, mozilla-rust-disable-future-incompat.patch - added patches mozilla-bmo1746799.patch- Firefox Extended Support Release 128.12.0 ESR * Fixed: Various security fixes. MFSA 2025-53 (bsc#1244670) * CVE-2025-6424 (bmo#1966423) Use-after-free in FontFaceSet * CVE-2025-6425 (bmo#1717672) The WebCompat WebExtension shipped with Firefox exposed a persistent UUID * CVE-2025-6426 (bmo#1964385) No warning when opening executable terminal files on macOS * CVE-2025-6429 (bmo#1970658) Incorrect parsing of URLs could have allowed embedding of youtube.com * CVE-2025-6430 (bmo#1971140) Content-Disposition header ignored when a file is included in an embed or object tag- Firefox Extended Support Release 128.11.0 ESR MFSA 2025-44 (bsc#1243353) * CVE-2025-5283 (bmo#1962421) Double-free in libvpx encoder * CVE-2025-5263 (bmo#1960745) Error handling for script execution was incorrectly isolated from web content * CVE-2025-5264 (bmo#1950001) Potential local code execution in “Copy as cURL” command * CVE-2025-5265 (bmo#1962301) Potential local code execution in “Copy as cURL” command * CVE-2025-5266 (bmo#1965628) Script element events leaked cross-origin resource status * CVE-2025-5267 (bmo#1954137) Clickjacking vulnerability could have led to leaking saved payment card details * CVE-2025-5268 (bmo#1950136, bmo#1958121, bmo#1960499, bmo#1962634) Memory safety bugs fixed in Firefox 139, Thunderbird 139, Firefox ESR 128.11, and Thunderbird 128.11 * CVE-2025-5269 (bmo#1924108) Memory safety bug fixed in Firefox ESR 128.11 and Thunderbird 128.11- Firefox Extended Support Release 128.10.1 ESR * Fixed: Security Fixes. MFSA 2025-37 (bsc#1243303) * CVE-2025-4918 (bmo#1966612) Out-of-bounds access when resolving Promise objects * CVE-2025-4919 (bmo#1966614) Out-of-bounds access when optimizing linear sums- Firefox Extended Support Release 128.10.0 ESR MFSA 2025-29 (bsc#1241621) * CVE-2025-2817 (bmo#1917536) Potential privilege escalation in Firefox Updater * MFSA-RESERVE-2025-1937097 (bmo#1937097) WebGL shader attribute memory corruption in Firefox for macOS * MFSA-RESERVE-2025-1958350 (bmo#1958350) Process isolation bypass using `javascript:` URI links in cross-origin frames * MFSA-RESERVE-2025-1949994 (bmo#1949994, bmo#1956698, bmo#1960198) Potential local code execution in "copy as cURL" command * MFSA-RESERVE-2025-1952465 (bmo#1952465) Unsafe attribute access during XPath parsing * MFSA-RESERVE-2025-3 (bmo#1951161, bmo#1952105) Memory safety bugs fixed in Firefox 138, Thunderbird 138, Firefox ESR 128.10, and Thunderbird 128.10 * MFSA-RESERVE-2025-7 (bmo#1894100) Memory safety bug fixed in Firefox ESR 128.10 and Thunderbird 128.10- Firefox Extended Support Release 128.9.0 ESR * Fixed: Various security fixes. MFSA 2025-22 (bsc#1240083) * CVE-2025-3028 (bmo#1941002) Use-after-free triggered by XSLTProcessor * CVE-2025-3029 (bmo#1952213) URL Bar Spoofing via non-BMP Unicode characters * CVE-2025-3030 (bmo#1850615, bmo#1932468, bmo#1942551, bmo#1951017, bmo#1951494) Memory safety bugs fixed in Firefox 137, Thunderbird 137, Firefox ESR 128.9, and Thunderbird 128.9 - Firefox Extended Support Release 128.8.1 ESR * Fixed: Security fix. MFSA 2025-19 (bsc#1240140) * CVE-2025-2857 (bmo#1956398, https://www.cve.org/CVERecord?id=CVE-2025-2783) Incorrect handle could lead to sandbox escapes NOTE: This only affects Firefox on Windows. Other operating systems are unaffected.- Firefox Extended Support Release 128.8.0 ESR * Fixed: Various security fixes. MFSA 2025-16 (bsc#1237683) * CVE-2024-43097 (bmo#1945624) Overflow when growing an SkRegion's RunArray * CVE-2025-1930 (bmo#1902309) AudioIPC StreamData could trigger a use-after-free in the Browser process * CVE-2025-1931 (bmo#1944126) Use-after-free in WebTransportChild * CVE-2025-1932 (bmo#1944313) Inconsistent comparator in XSLT sorting led to out-of-bounds access * CVE-2025-1933 (bmo#1946004) JIT corruption of WASM i32 return values on 64-bit CPUs * CVE-2025-1934 (bmo#1942881) Unexpected GC during RegExp bailout processing * CVE-2025-1935 (bmo#1866661) Clickjacking the registerProtocolHandler info-bar * CVE-2025-1936 (bmo#1940027) Adding %00 and a fake extension to a jar: URL changed the interpretation of the contents * CVE-2025-1937 (bmo#1938471, bmo#1940716) Memory safety bugs fixed in Firefox 136, Thunderbird 136, Firefox ESR 115.21, Firefox ESR 128.8, and Thunderbird 128.8 * CVE-2025-1938 (bmo#1922889, bmo#1935004, bmo#1943586, bmo#1943912, bmo#1948111) Memory safety bugs fixed in Firefox 136, Thunderbird 136, Firefox ESR 128.8, and Thunderbird 128.8- Firefox Extended Support Release 128.7.0 ESR * Fixed: Various security fixes. MFSA 2025-09 (bsc#1236539) * CVE-2025-1009 (bmo#1936613) Use-after-free in XSLT * CVE-2025-1010 (bmo#1936982) Use-after-free in Custom Highlight * CVE-2025-1011 (bmo#1936454) A bug in WebAssembly code generation could result in a crash * CVE-2025-1012 (bmo#1939710) Use-after-free during concurrent delazification * CVE-2024-11704 (bmo#1899402) Potential double-free vulnerability in PKCS#7 decryption handling * CVE-2025-1013 (bmo#1932555) Potential opening of private browsing tabs in normal browsing windows * CVE-2025-1014 (bmo#1940804) Certificate length was not properly checked * CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694, bmo#1938469, bmo#1939583, bmo#1940994) Memory safety bugs fixed in Firefox 135, Thunderbird 135, Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20, and Thunderbird 128.7 * CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984) Memory safety bugs fixed in Firefox 135, Thunderbird 135, Firefox ESR 128.7, and Thunderbird 128.7- Firefox Extended Support Release 128.6.0 ESR * Fixed: Various security fixes. MFSA 2025-02 (bsc#1234991) * CVE-2025-0237 (bmo#1915257) WebChannel APIs susceptible to confused deputy attack * CVE-2025-0238 (bmo#1915535) Use-after-free when breaking lines in text * CVE-2025-0239 (bmo#1929156) Alt-Svc ALPN validation failure when redirected * CVE-2025-0240 (bmo#1929623) Compartment mismatch when parsing JavaScript JSON module * CVE-2025-0241 (bmo#1933023) Memory corruption when using JavaScript Text Segmentation * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873, bmo#1932169) Memory safety bugs fixed in Firefox 134, Thunderbird 134, Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19, and Thunderbird 128.6 * CVE-2025-0243 (bmo#1827142, bmo#1932783) Memory safety bugs fixed in Firefox 134, Thunderbird 134, Firefox ESR 128.6, and Thunderbird 128.6 - Firefox Extended Support Release 128.5.2 ESR * Fixed: Fixed a crash experienced by Windows users with Qihoo 360 Total Security Antivirus software installed (bmo#1934258)- Firefox Extended Support Release 128.5.1 ESR (bsc#1234326) * Fixed: Fixed an issue that prevented some websites from loading when using SSL Inspection. (bmo#1933747)- Firefox Extended Support Release 128.5.0 ESR * Fixed: Various security fixes and other quality improvements. MFSA 2024-64 (bsc#1233695) * CVE-2024-11691 (bmo#1914707, bmo#1924184) Out-of-bounds write in Apple GPU drivers via WebGL * CVE-2024-11692 (bmo#1909535) Select list elements could be shown over another site * CVE-2024-11693 (bmo#1921458) Download Protections were bypassed by .library-ms files on Windows * CVE-2024-11694 (bmo#1924167) CSP Bypass and XSS Exposure via Web Compatibility Shims * CVE-2024-11695 (bmo#1925496) URL Bar Spoofing via Manipulated Punycode and Whitespace Characters * CVE-2024-11696 (bmo#1929600) Unhandled Exception in Add-on Signature Verification * CVE-2024-11697 (bmo#1842187) Improper Keypress Handling in Executable File Confirmation Dialog * CVE-2024-11698 (bmo#1916152) Fullscreen Lock-Up When Modal Dialog Interrupts Transition on macOS * CVE-2024-11699 (bmo#1880582, bmo#1929911) Memory safety bugs fixed in Firefox 133, Firefox ESR 128.5, and Thunderbird 128.5- Firefox Extended Support Release 128.4.0 ESR * Fixed: Various security fixes and other quality improvements. MFSA 2024-56 (bsc#1231879) * CVE-2024-10458 (bmo#1921733) Permission leak via embed or object elements * CVE-2024-10459 (bmo#1919087) Use-after-free in layout with accessibility * CVE-2024-10460 (bmo#1912537) Confusing display of origin for external protocol handler prompt * CVE-2024-10461 (bmo#1914521) XSS due to Content-Disposition being ignored in multipart/x-mixed-replace response * CVE-2024-10462 (bmo#1920423) Origin of permission prompt could be spoofed by long URL * CVE-2024-10463 (bmo#1920800) Cross origin video frame leak * CVE-2024-10464 (bmo#1913000) History interface could have been used to cause a Denial of Service condition in the browser * CVE-2024-10465 (bmo#1918853) Clipboard "paste" button persisted across tabs * CVE-2024-10466 (bmo#1924154) DOM push subscription message could hang Firefox * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394, bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706) Memory safety bugs fixed in Firefox 132, Thunderbird 132, Firefox ESR 128.4, and Thunderbird 128.4 - Rebase mozilla-rust-disable-future-incompat.patch- Firefox Extended Support Release 128.3.1 ESR MFSA 2024-51 (bsc#1231413) * CVE-2024-9680 (bmo#1923344) Use-after-free in Animation timeline- Firefox Extended Support Release 128.3.0 ESR * Fixed: Various security fixes and other quality improvements. MFSA 2024-47 (bsc#1230979) * CVE-2024-9392 (bmo#1899154, bmo#1905843) Compromised content process can bypass site isolation * CVE-2024-9393 (bmo#1918301) Cross-origin access to PDF contents through multipart responses * CVE-2024-9394 (bmo#1918874) Cross-origin access to JSON contents through multipart responses * CVE-2024-8900 (bmo#1872841) Clipboard write permission bypass * CVE-2024-9396 (bmo#1912471) Potential memory corruption may occur when cloning certain objects * CVE-2024-9397 (bmo#1916659) Potential directory upload bypass via clickjacking * CVE-2024-9398 (bmo#1881037) External protocol handlers could be enumerated via popups * CVE-2024-9399 (bmo#1907726) Specially crafted WebTransport requests could lead to denial of service * CVE-2024-9400 (bmo#1915249) Potential memory corruption during JIT compilation * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317, bmo#1916476) Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16, Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3 * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317, bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963, bmo#1915008, bmo#1916476) Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3- Firefox Extended Support Release 128.2.0 ESR * Fixed: Various security fixes and other quality improvements. MFSA 2024-40 (bsc#1229821) * CVE-2024-8385 (bmo#1911909) WASM type confusion involving ArrayTypes * CVE-2024-8381 (bmo#1912715) Type confusion when looking up a property name in a "with" block * CVE-2024-8382 (bmo#1906744) Internal event interfaces were exposed to web content when browser EventHandler listener callbacks ran * CVE-2024-8383 (bmo#1908496) Firefox did not ask before openings news: links in an external application * CVE-2024-8384 (bmo#1911288) Garbage collection could mis-color cross-compartment objects in OOM conditions * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529) SelectElements could be shown over another site if popups are allowed * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009) Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2, and Thunderbird 128.2 - Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch- Firefox Extended Support Release 128.1.0 ESR * Fixed: Various security fixes and other quality improvements. MFSA 2024-35 (bsc#1228648) * CVE-2024-7518 (bmo#1875354) Fullscreen notification dialog can be obscured by document content * CVE-2024-7519 (bmo#1902307) Out of bounds memory access in graphics shared memory handling * CVE-2024-7520 (bmo#1903041) Type confusion in WebAssembly * CVE-2024-7521 (bmo#1904644) Incomplete WebAssembly exception handing * CVE-2024-7522 (bmo#1906727) Out of bounds read in editor component * CVE-2024-7524 (bmo#1909241) CSP strict-dynamic bypass using web-compatibility shims * CVE-2024-7525 (bmo#1909298) Missing permission check when creating a StreamFilter * CVE-2024-7526 (bmo#1910306) Uninitialized memory used by WebGL * CVE-2024-7527 (bmo#1871303) Use-after-free in JavaScript garbage collection * CVE-2024-7528 (bmo#1895951) Use-after-free in IndexedDB * CVE-2024-7529 (bmo#1903187) Document content could partially obscure security prompts * CVE-2024-7531 (bmo#1905691) PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel Sandy Bridge machines- Firefox Extended Support Release 128.0esr ESR * ### General * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported operating systems. * Firefox now supports automated translation of web content. Also, unlike cloud-based alternatives, translation is done locally so that the text being translated never leaves the machine. * The line breaking rules of web content now match the Unicode standard, improving cross-browser compatibility. Additionally, for East Asian and South East Asian end users, Firefox now supports proper language-aware word selection when double-clicking on text for languages including Chinese, Japanese, Burmese, Lao, Khmer, and Thai. * Video effects and background blur are now available to Firefox users on Google Meet. Firefox now displays images and descriptions for search suggestions when provided by the search engine. * It is now possible to copy and paste any file from the operating system into Firefox. * Having any issues with a website on Firefox, yet the site seems to be working as expected on another browser? You can now let us know via the Web Compatibility Reporting Tool! By filing a web compatibility issue, you’re directly helping us detect, target, and fix the most impacted sites to make your browsing experience on Firefox smoother. * Firefox now prompts users in the US and Canada to save their addresses upon submitting an address form, allowing Firefox to autofill stored address information in the future. * Support for credit card autofill has been extended to users running Firefox in the IT, ES, AT, BE, and PL locales. * Recently closed tabs now persist between sessions that don't have automatic session restore enabled. Manually restoring a previous session will continue to reopen any previously open tabs or windows. * When migrating data from Chrome, Firefox now offers the ability to import certain extensions as well. * The Screenshots feature in Firefox has been updated. It now supports taking screenshots of file types like SVG, XML, and more as well as various about: pages within Firefox. The screenshot tool was also made more accessible to everyone by implementing new keyboard shortcuts and adding theme compatibility and High Contrast Mode (HCM) support. And finally, performance for capturing large screenshots has been improved. * ### PDF Viewer * The Firefox PDF viewer has expanded PDF editing capabilities: * Text highlighting is now supported. * Editing already-existing text annotations is now supported. * Images and alt text can be added in addition to text and drawings. * A floating button is now included to simplify deleting drawings, text, and images added in PDFs. * Caret browsing mode now also works in the PDF viewer. (Learn more) * ### Firefox View * Firefox View includes more content. You can now see all open tabs from all windows. If you sync open tabs, you’ll see all tabs from other devices. Browsing history is now listed and you can sort by date or by site. As before, recently closed tabs are also listed on Firefox View. To access Firefox View, select the file folder icon at the top left of your tab strip. * We’ve integrated search into Firefox View. You can now search through all of the tabs on each of the section subpages - Recent Browsing, Open Tabs, Recently Closed Tabs, Tabs from other devices, or History. * In Firefox View, open tabs can now be sorted by either recent activity or tab order. Recent activity is the default setting. * Firefox View now displays pinned tabs in the Open tabs section. Tab indicators have also been added to Open tabs, so users can do things like see which tabs are playing media and quickly mute or unmute across windows. Indicators were also added for bookmarks, tabs with notifications, and more! * It is now possible to close all duplicate tabs in a window with the `Close duplicate tabs` command available from the `List all tabs` widget in the tab bar or a tab context menu. * ### Security & Privacy * For added protection on macOS and Windows, a device sign in (e.g. operating system password, fingerprint, face or voice login if enabled) can be required when accessing and filling stored passwords in the Firefox Password Manager about:logins page. * Firefox now supports creating and using passkeys stored in the iCloud Keychain on macOS. * Firefox now imports user-added TLS trust anchors (e.g., certificates) from the operating system root store. This will be enabled by default on Windows, macOS, and Android, and if needed, can be turned off in settings (Settings → Privacy & Security → Certificates). * The Storage Access API web standard was updated to improve security while mitigating website breakages and further enabling the phase out of third-party cookies in Firefox. * Encrypted Client Hello (ECH) is now available to Firefox users, delivering a more private browsing experience. ECH extends the encryption used in TLS connections to cover more of the handshake and better protect sensitive fields. Read more about the launch of ECH on Mozilla Distilled. * Firefox supports a new “Copy Link Without Site Tracking” feature in the context menu which ensures that copied links no longer contain tracking information. * Firefox now supports a setting (in Preferences → Privacy & Security) to enable Global Privacy Control. With this opt-in feature, Firefox informs the websites that the user doesn’t want their data to be shared or sold. This feature is enabled in private browsing mode by default. * Firefox now more proactively blocks downloads from URLs that are considered to be potentially untrustworthy. * ### Anti-Fingerprinting * Web Audio in Firefox now uses the FDLIBM math library on all systems to improve anonymity with Fingerprint Protection. * As part of Total Cookie Protection, Firefox now supports the partitioning of Blob URLs, this mitigates a potential tracking vector that third-party agents could use to track an individual. * To mitigate font fingerprinting, the visibility of fonts to websites has been restricted to system fonts and language pack fonts when in Private Browsing Mode or with Enhanced Tracking Protection set to strict mode. * Firefox’s private windows and ETP-Strict privacy configuration now enhance the Canvas APIs with Fingerprinting Protection. * To reduce user fingerprinting information and the risk of some website compatibility issues, the CPU architecture for 32-bit x86 Linux will now be reported as x86_64 in Firefox's User-Agent string and `navigator.platform` and `navigator.oscpu` Web APIs. * ### Windows * Firefox can now be set to automatically launch whenever the computer starts up. (Learn more) * The background updater now updates properly when there are multiple user accounts on a system. * Firefox now populates the Windows taskbar jump list more efficiently, which should allow for a smoother overall browsing experience. * ### macOS * Firefox now supports Voice Control commands on macOS systems. * Links and other focusable elements are now tab-navigable by default on macOS, instead of following macOS' "Keyboard navigation" setting. This is a more accessible default and matches the default in all other platforms. A checkbox in the settings page still allows users to restore the old behavior. * Firefox on Mac now uses the macOS fullscreen API for all types of fullscreen windows. This should better match the expected macOS user experience for fullscreen spaces, menubar and the Dock. * ### Linux * Firefox now defaults to the Wayland compositor when available instead of XWayland. This brings support for touchpad & touchscreen gestures, swipe-to-nav, per-monitor DPI settings, better graphics performance, and more. * Firefox now ships with a new .deb package for Linux users on Ubuntu, Debian, and Linux Mint. * ### Video Playback * Enabled AV1 hardware decode acceleration on macOS for M3 Macs. * Firefox now supports the AV1 codec for Encrypted Media Extensions (EME), enabling higher-quality playback from video streaming providers. * NVIDIA RTX Video Super Resolution (“VSR”) is now available in Firefox. RTX VSR enhances and sharpens lower resolution video when upscaled to higher resolutions and also removes blocky artifacts commonly visible on low bitrate streamed video. VSR requires at least a 20-series or higher NVIDIA RTX GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver version R530 or higher. The feature can be enabled in the NVIDIA control panel. * NVIDIA RTX Video HDR is now available in Firefox. RTX Video HDR automatically converts SDR video to vibrant HDR10 in real time, letting you enjoy video with improved clarity on your HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550 or higher. The feature can be enabled in the NVIDIA control panel. * Developer: * Firefox now supports DNS prefetching for HTTPS documents via the `rel="dns-prefetch"` link hint. This standard allows web developers to specify domain names for important assets that should be resolved preemptively. * Firefox will now automatically try to upgrade ,