MozillaFirefox-translations-other-140.4.0-150200.152.207.1<>,4hp9|G+۲B?ko~PA5oBC}璩'e 8<9K;-ǹ)R`wocBZHA /U^ρcM ?9aG13 vB\vuFSNQ3p0գE8"v=G#PՓ]dP_ݐtg3m8qEM N?@V JOUPPv4}kpoVo5ETo v F75 49\|T/|GX>>?d$, = \ ,DJPNN $N N N FN NNRNN@ ( >8 H9$:=&BֳFGNHNITNX٤YٰZ[\N]<N^1bc)defluNvz}CMozillaFirefox-translations-other140.4.0150200.152.207.1Extra translations for FirefoxThis package contains rarely used languages for the user interface of Firefox.hs390zl39SUSE Linux Enterprise 15SUSE LLC MPL-2.0https://www.suse.com/System/Localizationhttp://www.mozilla.org/linuxs390x`Q3 ` r^49bD"<?gnؙuH:ml4Uq 13LL ȞtSq1^@f'0fIUYz9 erb}`,,B{!AA큤hhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhb2d2bff49d65913c90c316b52034ada6d06abef52dea9be388df3124a8dbbd6949e9d254376e2b36aa2a5aa2dd6fa2fa364812d39cda52c09ae9c34856ead510bd87997321f8a5d7361f9c6cf7cc64d591620ce18b5ca2b3e35d608046bd2d22cc7cae1278ef166b8a6fb790f2465242019ca33711c16f7439972de1562e7b3d523509f8d273285a4e3a096162b1fbd92a3537583fe810922b2377ba4d97d016fb70279284b16432532d7c0a1f214b0ee33dfa8fd6d095eda769de678b582207f3275d12ee7d6658c34c60e965b810113c18db69cc9b4e683f58044ed062a9ffbf938a97c536dc92958770d2d01c8533f195afd520e98f5639f1976b8a749f2bb5ddf8e695654fc766a6ac1b6a0a6055ba82e1f3c1290461f78bb9af1a0c693767ff7b24a54927410ba908ccdf1c705345e058390fbe332dacea6912e1d0a9552131198f00bdae23effbaac84edbf9ef6459fb8f698aaa5ec9b71668bbd5db640ffb4cf9e692a245ea3d2f10295a95b6fc758cf3c23aa7b9374428f44a99582936250d7b615c1c3491a4238f71f9d00ea0e00a726b4044df87ca8747c28c79d227bd853c3576a9b95ca6ec1cc54a9d7af6e00ef08b757126b727dbc96eaba4212e9619de94a81d9215e8be781fdaf424b5ae91cd5a40c6e28e47deb437444017f171e431bed6775dfc80cecd7e500137f17e245f932b292232fed05e4749dc607fabda1f76229bd46c242dc7903345494ff3898954e57751eb9ad66200b4141328154f171ccb089cf2af730ef6f165cad69d0c09f63dbab8cd3d25ded64fad8993904c5485b757b3947a4e5de302681c573855d4c1f7f888812359286600868ddde71297921708b8ffd1b605f97fbc7ca5829a12df82c4dc05beaf4c6bd8291bf34b7955df7b8f036e0f3f9641ac793b6c3304c4fc0775afaa51c3d7879cb1e058797605157d35b2e72f3fdf2e91ad9dccab2f83c49acc19c701efbfc30aad538b92174e085dbdb43b33cd4f31944e95e67dbc7b765923346dd23419f604eaa19588b32841547fdff9376fd162a307d66d3dc75229953db9bb4c3640bbf23f0a923b3362c84373b34ed03fb35c878bfa618c77dd984691a854a7519cb677a4b2ab1c9a4c0c983b71a1dece8c395cff73573a6bcffd25b5a773bb0f5428d3972dda92ee12da74d08353c5f1da3fc894c7cff3069a695609172d722f2aa7d028fdb8d28a7f52344e48c897c06134fb29e531556b54a3f3ccb0ad28aa51b90f65938c15cd792c84cb10aa56196fbc00fea741c1bba73359f0524d361ba9cfd144f9a6fd4ba3c0a0c5affc4123fc669949fc25090daa127b8e9e387eb908f3080648004bd760cbef9c2a34e8b4a99882cd14bb36fbf0e9f85b3514ea560397a811fc31087ecb04c34239641ef7e37c5502027451ad1f89208120ec860a1daa2c45573d76c82b7768ed872b57b381511c1b3eed0859de70767ccbe886ddba030bb8f8469cebca9c934119d5c0930315f599e6c9e93a041717bf8fe401b88d330c1a2355e21f913c87dabe299579042f9b30d788fad9bb3ad64444d6d4eeee0edb42a1a6a680baf9856daf7ee5b52a7a76e85689ccf7ba4b804e3fe4bbed3f7af77456705117f21d567554a8497b6ad45d9fca22153e3781fafd62eb5dcca627f6cdb8fcc7f8d5b72a9cf1b4f7c2c14f16090dff95c1e12027e9b7f3a74e15d926cbdadc7e287baab2f682568b300caca66808d315df687cdcee39507a075444a50660c3fb8738d1818285bb2bc002ca22d835b399d19d8e32350bee8846a66ec99dd3c50727d663cbd07621a7600e395451fe495e8a1e61aa128889e59ad009fb1b78dc650e5194c96f3efc390bf9ff84ae3c14fe364b359f57d4b0094239fa825a14b0874065cb234f42181c7518412d4cedd185a79c9bb6b6a274a98f3417d438a5c7aedbfc401d4fd0fa790beb328571173ffae3c91449c9da253983e5a077458f94c6d57d4df18c3d7e548603264c91dd38e13b8b3e1c65ed431040490dbbaedc3a7bc1b6130aeb36a941d811670c681ed701929e9a128e5d0eb350b3195600ba3a7e883ffc9f0922a69be4d329d1f34a041d0bc67b65df4d94f4b90595662972a7d3d465c96e5d46f9598ed3bd87e6e8b174ebb833a86c8b2a4c3fc7feba2b4c1c1b87a51490e1cf162a6fed8584ee37f5766f9c84c5e8df2b9b05f5b779ed81f6e7bb1ca2bccf61954de375f01189262b2448528f9cf5c97e7239f8c464b302202c0a8bb0c3dd0323f24e01c0d03f11e05046b78fbe53d0c0dac367f0df64b5443fca024985af5d39201db3a1df94569acf8bfd78802ca385375609f72427ee9ae3ba5d5261722908b23ea35e146f3f763ed1679987136790b3f12b5910887ea397344bc91dd6c1d34caa6e4d647076d0afac4c8c33805d60518214b4ed2c6f6ae33a06d737a92cb79f3aa9d06c5751b57d8b4b3a10b4356603fe473751daa507cf243e381fb2011b67d457c00f1753e1f0415df7c95868d6a4e8498020426150b03658714f476ea4fec925983ed3b1d7d4a0c52ad30c306a6653fe9e8d4e33fa135b0f5f53e53f4fb81ba56a853b721be0e2bf59e08e52bdae7fdef6f1ff8337ccd42495905ca505669dc962ac82837568406d92f3d282cffc553b6f3a40d4a949aa499a4002e7c770ae3a544fb59f6ca10da81dc1c713b078e7bbaddb552b04e5c2649c27e9ee35a8bce5217630175c75e2aeab348e8efcc0c74adfe10e437934cbca1ce058dd73c3bcb352d4b8bfdb24acfda32e7734789dc067fb0968dc44376ac2d81d82b9c38c45bc3d5c2b1d1da52d0b2aec4bfb2de8985a80130c4b0079b298f559169981b4aef53d3d5c813c04fe3f37a3de04159f3f91a62b492aee7dbe57429f8bc928a66d483e9deda226f9774eaab0e53a4bcb43e5d803f39d42470e4f96a78fda8581f252f4a5d836d3e8754948b091c575206988c6d1fc01806faec1d1f20c5c31c26cbf5c6faa4c425d94d8ebe2a862d8a9354b6272a9e67b8e0d206d6cbb83c9037b6cb8a1cd7e520a448897c8bbad94f55d52a557ce62657bd127b6c12fac7d7d6068ba01c84fa8c170453387da235673bde7a26d6e022a691a2dc782b370c1965e602f8e56493bc8eddbc0f6a791faea98535561d6bdc6ea582a44b817370289cf354476c50c46b889f704b62a661a67191134cef29912b9496badae19d1f0f3bde064b5092e48a26009ccb516420afd4f63fa30a5b7fe3537cce0055c25dffcd23bf595a8cd18d1185a22f160da159cd73adc8d565dcf90b1b0ba9a0bc9c4fb01a81c4d646dd9ce94ba2bcc4948ffb571230d27d0a64a55603245cf40d9a64c80556ff3e8e349ca5c28238bed216ea0ac44c8f9e2804ff5a39c6a7abffa2c12aa3ee5691a564f8044ce35ec65f467df6af90073e1c4rootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootMozillaFirefox-140.4.0-150200.152.207.1.src.rpmMozillaFirefox-translations-otherMozillaFirefox-translations-other(s390-64)locale(MozillaFirefox:ach;af;an;ast;az;be;bg;bn;br;bs;cak;cy;dsb;en_CA;eo;es_MX;et;eu;fa;ff;fy_NL;ga_IE;gd;gl;gn;gu_IN;he;hi_IN;hr;hsb;hy_AM;ia;id;is;ka;kab;kk;km;kn;lij;lt;lv;mk;mr;ms;my;ne_NP;nn_NO;oc;pa_IN;rm;ro;si;sk;sl;son;sq;sr;ta;te;th;tr;uk;ur;uz;vi;xh)    MozillaFirefoxrpmlib(CompressedFileNames)rpmlib(FileDigests)rpmlib(PayloadFilesHavePrefix)rpmlib(PayloadIsXz)140.4.03.0.4-14.6.0-14.0-15.2-14.14.1hR@hҋhҋhh@hh,hZhxhkh]6@hQXhQXh,nh+@h@ggggvgM@gDfggp@f@f@f'@fwf=@f@faf;i@f-ere@eBeeexK@eV@e.w@e@e 0@eRd dd\@d dD@d@dx@dX@d.@d c1cGcclcN@c$e@cc@b?b@bbbi0@bL/@bDF@b3"b0b(b%b[@a@aq@a*@aLa@a(@apa\>@aV@a9@a8a@aaj@`#@`@`!@``}p`[)`4@`!'`@__إ@_@_/@_@_u_i@_a@_a@_D@_C_6|_*@_'@_ @_^@^z^)@^?@^V@^U@^k@^v^t@^g@^B@^&^^r]N@]]@]d@]]@]]n]@]z@]@]v>] ] #] #\\@\ޢ@\ڭ\@\!\f\e\@\\u*@\d\Q\@n@\@\@\@[ @[;@[@[@[h@[3|@[@ZZZ2@ZZ@Z}@Zg#Z_:Z]@ZF.@Z3@Z+@Z YYχ@Y5Y@Y@YY\YA%@Y$$@Y]XX9@X9@X@XXCX@X6@XXN@XJX@X)@X W%W@W$Wu@WF@WWWW9WE@W\@W@Ws@WaC@W_W^@W^@WV@WEWBW4p@W)@W(W W WW @W VVV@V>@VwVVV@VuVm]VHsV4@V@VV @UN@UUĝUĝU@UUt2@U`kUUUUUOH@U0UUUQU ]@U T@T!TT@T*@Ty@T\@TXTWn@TWn@TR(@TO@TKTCT>amartin.sirringhaus@suse.commartin.sirringhaus@suse.commartin.sirringhaus@suse.commartin.sirringhaus@suse.commartin.sirringhaus@suse.commartin.sirringhaus@suse.commartin.sirringhaus@suse.commartin.sirringhaus@suse.commartin.sirringhaus@suse.comcgrobertson@suse.commartin.sirringhaus@suse.commartin.sirringhaus@suse.commartin.sirringhaus@suse.commartin.sirringhaus@suse.commartin.sirringhaus@suse.commartin.sirringhaus@suse.commartin.sirringhaus@suse.commartin.sirringhaus@suse.commartin.sirringhaus@suse.commartin.sirringhaus@suse.commartin.sirringhaus@suse.commartin.sirringhaus@suse.commartin.sirringhaus@suse.commartin.sirringhaus@suse.comcgrobertson@suse.commartin.sirringhaus@suse.commartin.sirringhaus@suse.commartin.sirringhaus@suse.commartin.sirringhaus@suse.commartin.sirringhaus@suse.commartin.sirringhaus@suse.commartin.sirringhaus@suse.commartin.sirringhaus@suse.commartin.sirringhaus@suse.commartin.sirringhaus@suse.commartin.sirringhaus@suse.commartin.sirringhaus@suse.commartin.sirringhaus@suse.commartin.sirringhaus@suse.commartin.sirringhaus@suse.commeissner@suse.commartin.sirringhaus@suse.comcgrobertson@suse.commartin.sirringhaus@suse.commartin.sirringhaus@suse.commartin.sirringhaus@suse.commartin.sirringhaus@suse.comcgrobertson@suse.commartin.sirringhaus@suse.commartin.sirringhaus@suse.commartin.sirringhaus@suse.commartin.sirringhaus@suse.commartin.sirringhaus@suse.commartin.sirringhaus@suse.commartin.sirringhaus@suse.commartin.sirringhaus@suse.commartin.sirringhaus@suse.commartin.sirringhaus@suse.commartin.sirringhaus@suse.commartin.sirringhaus@suse.comcgrobertson@suse.commartin.sirringhaus@suse.commartin.sirringhaus@suse.commartin.sirringhaus@suse.commartin.sirringhaus@suse.commartin.sirringhaus@suse.commartin.sirringhaus@suse.commartin.sirringhaus@suse.commartin.sirringhaus@suse.commartin.sirringhaus@suse.commartin.sirringhaus@suse.comcgrobertson@suse.commartin.sirringhaus@suse.commartin.sirringhaus@suse.commartin.sirringhaus@suse.commartin.sirringhaus@suse.commartin.sirringhaus@suse.comandreas.stieger@gmx.demartin.sirringhaus@suse.commartin.sirringhaus@suse.commartin.sirringhaus@suse.commartin.sirringhaus@suse.comcgrobertson@suse.comcgrobertson@suse.commartin.sirringhaus@suse.comcgrobertson@suse.commartin.sirringhaus@suse.comwilliam.brown@suse.commartin.sirringhaus@suse.commartin.sirringhaus@suse.commartin.sirringhaus@suse.commartin.sirringhaus@suse.commartin.sirringhaus@suse.commartin.sirringhaus@suse.commartin.sirringhaus@suse.commartin.sirringhaus@suse.commartin.sirringhaus@suse.commartin.sirringhaus@suse.commartin.sirringhaus@suse.comcgrobertson@suse.comcgrobertson@suse.comcgrobertson@suse.commartin.sirringhaus@suse.commartin.sirringhaus@suse.commartin.sirringhaus@suse.comcgrobertson@suse.comcgrobertson@suse.comcgrobertson@suse.commartin.sirringhaus@suse.commartin.sirringhaus@suse.commartin.sirringhaus@suse.comcgrobertson@suse.commartin.sirringhaus@suse.comcgrobertson@suse.comcgrobertson@suse.commartin.sirringhaus@suse.comcgrobertson@suse.commartin.sirringhaus@suse.commartin.sirringhaus@suse.comandreas.stieger@gmx.decgrobertson@suse.commartin.sirringhaus@suse.comcgrobertson@suse.commartin.sirringhaus@suse.commartin.sirringhaus@suse.commartin.sirringhaus@suse.commartin.sirringhaus@suse.comcgrobertson@suse.commartin.sirringhaus@suse.commartin.sirringhaus@suse.commartin.sirringhaus@suse.comcgrobertson@suse.commartin.sirringhaus@suse.commartin.sirringhaus@suse.commartin.sirringhaus@suse.commartin.sirringhaus@suse.commartin.sirringhaus@suse.comcgrobertson@suse.commartin.sirringhaus@suse.commartin.sirringhaus@suse.commartin.sirringhaus@suse.commartin.sirringhaus@suse.commartin.sirringhaus@suse.commartin.sirringhaus@suse.comcgrobertson@suse.comcgrobertson@suse.compsimons@suse.comjkowalczyk@suse.comcgrobertson@suse.comcgrobertson@suse.comcgrobertson@suse.comcgrobertson@suse.comalarrosa@suse.comcgrobertson@suse.comcgrobertson@suse.comkbabioch@suse.decgrobertson@suse.comcgrobertson@suse.comalarrosa@suse.comalarrosa@suse.comalarrosa@suse.comcgrobertson@suse.compcerny@suse.compcerny@suse.compcerny@suse.comwr@rosenauer.orgastieger@suse.comwr@rosenauer.orgwr@rosenauer.orgastieger@suse.comwr@rosenauer.orgwr@rosenauer.orgwbauer@tmo.atcgrobertson@suse.comastieger@suse.comfcrozat@suse.comsecurity@suse.comwr@rosenauer.orgstefan.bruens@rwth-aachen.dezaitor@opensuse.orgwr@rosenauer.orgdimstar@opensuse.orgschwab@suse.dewr@rosenauer.orgastieger@suse.comwr@rosenauer.orgwr@rosenauer.orgwr@rosenauer.orgwr@rosenauer.orgwr@rosenauer.orgwr@rosenauer.orgwr@rosenauer.orgwr@rosenauer.orgwr@rosenauer.orgwr@rosenauer.orgastieger@suse.comwr@rosenauer.orgwr@rosenauer.orgcgrobertson@novell.comwr@rosenauer.orgwr@rosenauer.orgastieger@suse.combadshah400@gmail.comastieger@suse.comwr@rosenauer.orgastieger@suse.comastieger@suse.comwr@rosenauer.orgpcerny@suse.combadshah400@gmail.comwr@rosenauer.orgbadshah400@gmail.comantoine.belvire@laposte.netmailaender@opensuse.orgastieger@suse.comwr@rosenauer.orgbadshah400@gmail.comagraf@suse.comwr@rosenauer.orgwr@rosenauer.orgbadshah400@gmail.combadshah400@gmail.comdsterba@suse.czwr@rosenauer.orgnormand@linux.vnet.ibm.combadshah400@gmail.comwr@rosenauer.orgbadshah400@gmail.combadshah400@gmail.comastieger@suse.comastieger@suse.comwr@rosenauer.orgolaf@aepfle.deastieger@suse.comwr@rosenauer.orgdmueller@suse.comwr@rosenauer.orgastieger@suse.comwr@rosenauer.orgwr@rosenauer.orgwr@rosenauer.orgwr@rosenauer.orgwr@rosenauer.orgwr@rosenauer.orgwr@rosenauer.orgwr@rosenauer.orgwr@rosenauer.orgwr@rosenauer.orgwr@rosenauer.orgwr@rosenauer.orgschwab@suse.dewr@rosenauer.orgwr@rosenauer.orgnormand@linux.vnet.ibm.comwr@rosenauer.orgwr@rosenauer.orgwr@rosenauer.orgwr@rosenauer.orgwr@rosenauer.orgdvaleev@suse.comwr@rosenauer.orgdimstar@opensuse.orgwr@rosenauer.orgwr@rosenauer.orgwr@rosenauer.orgwr@rosenauer.orgledest@gmail.comwr@rosenauer.orgwr@rosenauer.orgguillaume@opensuse.orgdmueller@suse.comjosua.mayer97@gmail.comwr@rosenauer.orgjosua.mayer97@gmail.comwr@rosenauer.orgvindex17@outlook.itwr@rosenauer.org- Firefox Extended Support Release 140.4.0 ESR * Fixed: Various security fixes. MFSA 2025-83 (bsc#1251263) * MFSA-RESERVE-2025-1988931 (bmo#1988931) Use-after-free in MediaTrackGraphImpl::GetInstance() * MFSA-RESERVE-2025-1989127 (bmo#1989127) Out of bounds read/write in a privileged process triggered by WebGL textures * MFSA-RESERVE-2025-1989899 (bmo#1989899) Cross-process information leaked due to malicious IPC messages * MFSA-RESERVE-2025-1989978 (bmo#1989978) Some non-writable Object properties could be modified * MFSA-RESERVE-2025-1979536 (bmo#1979536) An OBJECT tag type attribute overrode browser behavior on web resources without a content-type * MFSA-RESERVE-2025-1986142 (bmo#1986142) Potential user-assisted code execution in “Copy as cURL” command * MFSA-RESERVE-2025-0 (bmo#1973699, bmo#1989945, bmo#1990970, bmo#1991040, bmo#1992113) Memory safety bugs fixed in Firefox ESR 115.29, Firefox ESR 140.4, Thunderbird ESR 140.4, Firefox 144 and Thunderbird 144 * MFSA-RESERVE-2025-1 (bmo#1983838, bmo#1987624, bmo#1988244, bmo#1988912, bmo#1989734, bmo#1990085, bmo#1991899) Memory safety bugs fixed in Firefox ESR 140.4, Thunderbird ESR 140.4, Firefox 144 and Thunderbird 144- Firefox Extended Support Release 140.3.1 ESR (bsc#1250452) * Fixed: Improved reliability when HTTP/3 connections fail: Firefox no longer forces HTTP/2 during fallback, allowing the server to choose the protocol and preventing stalls on some sites. (bmo#1980812)- Replace mozilla-bmo998749.patch with upstreams version- Firefox Extended Support Release 140.3.0 ESR * Fixed: Various security fixes. MFSA 2025-75 (bsc#1249391) * CVE-2025-10527 (bmo#1984825) Sandbox escape due to use-after-free in the Graphics: Canvas2D component * CVE-2025-10528 (bmo#1986185) Sandbox escape due to undefined behavior, invalid pointer in the Graphics: Canvas2D component * CVE-2025-10529 (bmo#1970490) Same-origin policy bypass in the Layout component * CVE-2025-10532 (bmo#1979502) Incorrect boundary conditions in the JavaScript: GC component * CVE-2025-10533 (bmo#1980788) Integer overflow in the SVG component * CVE-2025-10536 (bmo#1981502) Information disclosure in the Networking: Cache component * CVE-2025-10537 (bmo#1938220, bmo#1980730, bmo#1981280, bmo#1981283, bmo#1984505, bmo#1985067) Memory safety bugs fixed in Firefox ESR 140.3, Thunderbird ESR 140.3, Firefox 143 and Thunderbird 143- Firefox Extended Support Release 140.2.0 ESR * Fixed: Various security fixes. MFSA 2025-67 (bsc#1248162) * CVE-2025-9179 (bmo#1979527) Sandbox escape due to invalid pointer in the Audio/Video: GMP component * CVE-2025-9180 (bmo#1979782) Same-origin policy bypass in the Graphics: Canvas2D component * CVE-2025-9181 (bmo#1977130) Uninitialized memory in the JavaScript Engine component * CVE-2025-9182 (bmo#1975837) Denial-of-service due to out-of-memory in the Graphics: WebRender component * CVE-2025-9183 (bmo#1976102) Spoofing issue in the Address Bar component * CVE-2025-9184 (bmo#1929482, bmo#1976376, bmo#1979163, bmo#1979955) Memory safety bugs fixed in Firefox ESR 140.2, Thunderbird ESR 140.2, Firefox 142 and Thunderbird 142 * CVE-2025-9185 (bmo#1970154, bmo#1976782, bmo#1977166) Memory safety bugs fixed in Firefox ESR 115.27, Firefox ESR 128.14, Thunderbird ESR 128.14, Firefox ESR 140.2, Thunderbird ESR 140.2, Firefox 142 and Thunderbird 142- Add build_limit for s390x on SLE16 (bsc#1247774)- Add patch mozilla-kde-force-xdg-portal.patch to switch to using xdg-desktop-portal file-picker on KDE on SLE-15 (bsc#1226112)- Firefox Extended Support Release 140.1.0 ESR * Fixed: Various security fixes. MFSA 2025-59 (bsc#1246664) * CVE-2025-8027 (bmo#1968423) JavaScript engine only wrote partial return value to stack * CVE-2025-8028 (bmo#1971581) Large branch table could lead to truncated instruction * CVE-2025-8029 (bmo#1928021) javascript: URLs executed on object and embed tags * CVE-2025-8036 (bmo#1960834) DNS rebinding circumvents CORS * CVE-2025-8037 (bmo#1964767) Nameless cookies shadow secure cookies * CVE-2025-8030 (bmo#1968414) Potential user-assisted code execution in “Copy as cURL” command * CVE-2025-8031 (bmo#1971719) Incorrect URL stripping in CSP reports * CVE-2025-8032 (bmo#1974407) XSLT documents could bypass CSP * CVE-2025-8038 (bmo#1808979) CSP frame-src was not correctly enforced for paths * CVE-2025-8039 (bmo#1970997) Search terms persisted in URL bar * CVE-2025-8033 (bmo#1973990) Incorrect JavaScript state machine for generators * CVE-2025-8034 (bmo#1970422, bmo#1970422, bmo#1970422, bmo#1970422) Memory safety bugs fixed in Firefox ESR 115.26, Firefox ESR 128.13, Thunderbird ESR 128.13, Firefox ESR 140.1, Thunderbird ESR 140.1, Firefox 141 and Thunderbird 141 * CVE-2025-8040 (bmo#1975058, bmo#1975058, bmo#1975998, bmo#1975998) Memory safety bugs fixed in Firefox ESR 140.1, Thunderbird ESR 140.1, Firefox 141 and Thunderbird 141 * CVE-2025-8035 (bmo#1975961, bmo#1975961, bmo#1975961) Memory safety bugs fixed in Firefox ESR 128.13, Thunderbird ESR 128.13, Firefox ESR 140.1, Thunderbird ESR 140.1, Firefox 141 and Thunderbird 141- Replace usage of %jobs for reproducible builds (boo#1237231)- Firefox Extended Support Release 140.0esr ESR * General - Reader View now has an enhanced Text and Layout menu with new options for character spacing, word spacing, and text alignment. These changes offer a more accessible reading experience. - Reader View now has a Theme menu with additional Contrast and Gray options. You can also select custom colors for text, background, and links from the Custom tab. - Firefox will now offer to temporarily remember when users grant permissions to sites (e.g. geolocation). Temporary permissions will be removed either after one hour or when the tab is closed. - Firefox now includes safeguards to prevent sites from abusing the history API by generating excessive history entries, which can make navigating with the back and forward buttons difficult by cluttering the history. This intervention ensures that such entries, unless interacted with by the user, are skipped when using the back and forward buttons. - Firefox now identifies all links in PDFs and turns them into hyperlinks. - You can now copy links from background tabs using the tabstrip context menu on macOS and Linux. - Users on macOS and Linux are now given the option to close only the current tab if the Quit keyboard shortcut is used while multiple tabs are open in the window. (bmo#None) * Sidebar and Tabs - You can now enable the updated Firefox sidebar in Settings > General > Browser Layout to quickly access multiple tools in one click, without leaving your main view. Sidebar tools include an AI chatbot of your choice, bookmarks, history, and tabs from devices you sync with your Mozilla account. - Keep a lot of tabs open? Try our new vertical tabs layout to quickly scan your list of tabs. With vertical tabs, your open and pinned tabs appear in the sidebar instead of along the top of the browser. To turn on vertical tabs, right-click on the toolbar near the top of the browser and select Turn on Vertical Tabs. If you’ve enabled the updated sidebar, you can also go to Customize sidebar and check Vertical tabs. Early testers report feeling more organized after using vertical tabs for a few days. - Stay productive and organized with less effort by grouping related tabs together. One simple way to create a group is to drag a tab onto another, pause until you see a highlight, then drop to create the group. Tab groups can be named, color-coded, and are always saved. You can close a group and reopen it later. - A tab preview is now displayed when hovering the mouse over background tabs, making it easier to locate the desired tab without needing to switch tabs. - The sidebar to view tabs from other devices can now be opened via the Tab overview menu. * Security & Privacy - HTTPS is replacing HTTP as the default protocol in the address bar on non-local sites. If a site is not available via HTTPS, Firefox will fall back to HTTP. - Firefox now blocks third-party cookie access when Enhanced Tracking Protection's Strict mode is enabled. - Firefox now has a new anti-tracking feature, Bounce Tracking Protection, which is now available in Enhanced Tracking Protection's "Strict" mode. This feature detects bounce trackers based on their redirect behavior and periodically purges their cookies and site data to block tracking. - Firefox now enforces certificate transparency, requiring web servers to provide sufficient proof that their certificates were publicly disclosed before they will be trusted. This only affects servers using certificates issued by a certificate authority in Mozilla's Root CA Program. - Smartblock Embeds allows users to selectively unblock certain social media embeds that are blocked in ETP Strict and Private Browsing modes. Currently, support is limited to a few embed types, with more to be added in future updates. - Firefox now upgrades page loads to HTTPS by default and gracefully falls back to HTTP if the secure connection fails. This behavior is known as HTTPS-First. - The "Copy Without Site Tracking" menu item was renamed to "Copy Clean Link" to help clarify expectations around what the feature does. "Copy Clean Link" is a list based approach to remove - known tracking parameters from links. This option can also now be used on plain text links. - The Clear browsing data and cookies dialog now allows clearing saved form info separately from browsing history. * Translations - Firefox now allows translating selected text portions to different languages after a full-page translation. - Full-Page Translations are now available within Firefox extension pages that start with the moz-extension:// URL scheme. - When suggesting a default translation language, Firefox will now take into consideration languages you have previously used for translations. - Added support for many new languages in Firefox translation. * Windows - Canvas2D switched from Direct2D to a platform independent acceleration backend on Windows. - Hardware-accelerated playback of HEVC video content is now supported on Windows. - Firefox on Windows 11 now uses acrylic-style menus for popup windows, which better match the operating system’s aesthetic. * macOS - Added support for multiple languages in the same document spoken in macOS VoiceOver. - The macOS session resume feature has been enhanced. Firefox will now automatically relaunch if it was open before a system restart, like after an OS update. - The macOS DMG installer packages now use LZMA for compression, reducing download size and installation time. - Due to recent changes in macOS Sequoia, the shortcut for completing search strings to .com addresses has been changed from Ctrl+Enter to Cmd+Enter. * Linux - Firefox now supports touchpad hold gestures on Linux. This means that kinetic (momentum) scrolling can now be interrupted by placing two fingers on the touchpad. * Developer: - Firefox now supports text fragments, which allows users to link directly to a specific portion of text in a web document via a special URL fragment. - Debugger log-point values are now automatically converted into profiler markers, making it easy to add information to the marker timeline directly from the Debugger. - The Debugger's directory root is now scoped to the specific domain where it was set, which aligns with typical usage and avoids applying it across unrelated domains. This builds on previous improvements such as a redesigned UI and easier removal of the root setting. Setting a directory root updates the Source List to show only the selected directory and its children. (Learn more) - The Network Blocking feature in the Network panel now blocks HTTP requests in addition to blocking responses. - The Network panel displays information about Early Hints, including a dedicated indicator for the 103 HTTP status code in the user interface. - The Network panel now allows overriding network request responses with local files. - The filter setting in the Network panel is now preserved across DevTools Toolbox sessions. - A new column has been added to the Network panel to display the full path of the request URL. This enhancement makes helps developers quickly view and analyze complete request paths. - Introduced a new console command `$$$` that allows searching the page, including within shadow roots. - Improved support for debugging web extensions, such as automatically reloading the web extension's source code in the Debugger when the extension is reloaded. Workers are now available in the Console panel’s context selector and breakpoints function correctly in content scripts. - In the Inspector Fonts panel, we now display fonts metadata, like the font version, designer, vendor, license, etc. - Added support for the import map integrity field, allowing you to ensure the integrity of dynamically or statically imported modules. - Implemented support for `Error.isError`, enabling brand checks to determine whether an object is an instance of Error. (Learn more) - Added support for the `error.captureStackTrace` extension to improve compatibility with other browsers. (Learn more: http://github.com/tc39/proposal-error-capturestacktrace) * Enterprise: - The UserMessaging policy has been updated with a new option to allow disabling Firefox Labs in preferences. - The Preferences policy has been updated to allow setting the preference security.pki.certificate_transparency.mode. - HTTPS-First is now on by default. You can manage this behavior using the HttpsOnlyMode and HttpAllowlist policies. - An internal change has been made to Firefox that removes `XPCOMUtils.defineLazyGetter`. For most people, this shouldn't matter, but if you encounter problems with AutoConfig or third party software like PolicyPak, this might be the cause. You'll need to reach out to your provider. - Firefox now supports the Content Analysis SDK for integrating DLP software. For more information, see this post. - The SearchEngines policy is now available on all versions of Firefox (not just the ESR). * Fixed: Various security fixes. MFSA 2025-51 (bsc#1244670) * CVE-2025-6424 (bmo#1966423) Use-after-free in FontFaceSet * CVE-2025-6425 (bmo#1717672) The WebCompat WebExtension shipped with Firefox exposed a persistent UUID * CVE-2025-6426 (bmo#1964385) No warning when opening executable terminal files on macOS * CVE-2025-6427 (bmo#1966927) connect-src Content Security Policy restriction could be bypassed * CVE-2025-6428 (bmo#1970151) Firefox for Android opened URLs specified in a link querystring parameter * CVE-2025-6429 (bmo#1970658) Incorrect parsing of URLs could have allowed embedding of youtube.com * CVE-2025-6430 (bmo#1971140) Content-Disposition header ignored when a file is included in an embed or object tag * CVE-2025-6431 (bmo#1942716) The prompt in Firefox for Android that asks before opening a link in an external application could be bypassed * CVE-2025-6432 (bmo#1943804) DNS Requests leaked outside of a configured SOCKS proxy * CVE-2025-6433 (bmo#1954033) WebAuthn would allow a user to sign a challenge on a webpage with an invalid TLS certificate * CVE-2025-6434 (bmo#1955182) HTTPS-Only exception screen lacked anti-clickjacking delay * CVE-2025-6435 (bmo#1950056, bmo#1961777) Save as in Devtools could download files without sanitizing the extension * CVE-2025-6436 (bmo#1941377, bmo#1960948, bmo#1966187, bmo#1966505, bmo#1970764) Memory safety bugs fixed in Firefox 140 and Thunderbird 140- removed patches firefox-kde.patch, mozilla-kde.patch, fix-sle12-build-errors.patch, mozilla-rust-disable-future-incompat.patch - added patches mozilla-bmo1746799.patch- Firefox Extended Support Release 128.12.0 ESR * Fixed: Various security fixes. MFSA 2025-53 (bsc#1244670) * CVE-2025-6424 (bmo#1966423) Use-after-free in FontFaceSet * CVE-2025-6425 (bmo#1717672) The WebCompat WebExtension shipped with Firefox exposed a persistent UUID * CVE-2025-6426 (bmo#1964385) No warning when opening executable terminal files on macOS * CVE-2025-6429 (bmo#1970658) Incorrect parsing of URLs could have allowed embedding of youtube.com * CVE-2025-6430 (bmo#1971140) Content-Disposition header ignored when a file is included in an embed or object tag- Firefox Extended Support Release 128.11.0 ESR MFSA 2025-44 (bsc#1243353) * CVE-2025-5283 (bmo#1962421) Double-free in libvpx encoder * CVE-2025-5263 (bmo#1960745) Error handling for script execution was incorrectly isolated from web content * CVE-2025-5264 (bmo#1950001) Potential local code execution in “Copy as cURL” command * CVE-2025-5265 (bmo#1962301) Potential local code execution in “Copy as cURL” command * CVE-2025-5266 (bmo#1965628) Script element events leaked cross-origin resource status * CVE-2025-5267 (bmo#1954137) Clickjacking vulnerability could have led to leaking saved payment card details * CVE-2025-5268 (bmo#1950136, bmo#1958121, bmo#1960499, bmo#1962634) Memory safety bugs fixed in Firefox 139, Thunderbird 139, Firefox ESR 128.11, and Thunderbird 128.11 * CVE-2025-5269 (bmo#1924108) Memory safety bug fixed in Firefox ESR 128.11 and Thunderbird 128.11- Firefox Extended Support Release 128.10.1 ESR * Fixed: Security Fixes. MFSA 2025-37 (bsc#1243303) * CVE-2025-4918 (bmo#1966612) Out-of-bounds access when resolving Promise objects * CVE-2025-4919 (bmo#1966614) Out-of-bounds access when optimizing linear sums- Firefox Extended Support Release 128.10.0 ESR MFSA 2025-29 (bsc#1241621) * CVE-2025-2817 (bmo#1917536) Potential privilege escalation in Firefox Updater * MFSA-RESERVE-2025-1937097 (bmo#1937097) WebGL shader attribute memory corruption in Firefox for macOS * MFSA-RESERVE-2025-1958350 (bmo#1958350) Process isolation bypass using `javascript:` URI links in cross-origin frames * MFSA-RESERVE-2025-1949994 (bmo#1949994, bmo#1956698, bmo#1960198) Potential local code execution in "copy as cURL" command * MFSA-RESERVE-2025-1952465 (bmo#1952465) Unsafe attribute access during XPath parsing * MFSA-RESERVE-2025-3 (bmo#1951161, bmo#1952105) Memory safety bugs fixed in Firefox 138, Thunderbird 138, Firefox ESR 128.10, and Thunderbird 128.10 * MFSA-RESERVE-2025-7 (bmo#1894100) Memory safety bug fixed in Firefox ESR 128.10 and Thunderbird 128.10- Firefox Extended Support Release 128.9.0 ESR * Fixed: Various security fixes. MFSA 2025-22 (bsc#1240083) * CVE-2025-3028 (bmo#1941002) Use-after-free triggered by XSLTProcessor * CVE-2025-3029 (bmo#1952213) URL Bar Spoofing via non-BMP Unicode characters * CVE-2025-3030 (bmo#1850615, bmo#1932468, bmo#1942551, bmo#1951017, bmo#1951494) Memory safety bugs fixed in Firefox 137, Thunderbird 137, Firefox ESR 128.9, and Thunderbird 128.9 - Firefox Extended Support Release 128.8.1 ESR * Fixed: Security fix. MFSA 2025-19 (bsc#1240140) * CVE-2025-2857 (bmo#1956398, https://www.cve.org/CVERecord?id=CVE-2025-2783) Incorrect handle could lead to sandbox escapes NOTE: This only affects Firefox on Windows. Other operating systems are unaffected.- Firefox Extended Support Release 128.8.0 ESR * Fixed: Various security fixes. MFSA 2025-16 (bsc#1237683) * CVE-2024-43097 (bmo#1945624) Overflow when growing an SkRegion's RunArray * CVE-2025-1930 (bmo#1902309) AudioIPC StreamData could trigger a use-after-free in the Browser process * CVE-2025-1931 (bmo#1944126) Use-after-free in WebTransportChild * CVE-2025-1932 (bmo#1944313) Inconsistent comparator in XSLT sorting led to out-of-bounds access * CVE-2025-1933 (bmo#1946004) JIT corruption of WASM i32 return values on 64-bit CPUs * CVE-2025-1934 (bmo#1942881) Unexpected GC during RegExp bailout processing * CVE-2025-1935 (bmo#1866661) Clickjacking the registerProtocolHandler info-bar * CVE-2025-1936 (bmo#1940027) Adding %00 and a fake extension to a jar: URL changed the interpretation of the contents * CVE-2025-1937 (bmo#1938471, bmo#1940716) Memory safety bugs fixed in Firefox 136, Thunderbird 136, Firefox ESR 115.21, Firefox ESR 128.8, and Thunderbird 128.8 * CVE-2025-1938 (bmo#1922889, bmo#1935004, bmo#1943586, bmo#1943912, bmo#1948111) Memory safety bugs fixed in Firefox 136, Thunderbird 136, Firefox ESR 128.8, and Thunderbird 128.8- Firefox Extended Support Release 128.7.0 ESR * Fixed: Various security fixes. MFSA 2025-09 (bsc#1236539) * CVE-2025-1009 (bmo#1936613) Use-after-free in XSLT * CVE-2025-1010 (bmo#1936982) Use-after-free in Custom Highlight * CVE-2025-1011 (bmo#1936454) A bug in WebAssembly code generation could result in a crash * CVE-2025-1012 (bmo#1939710) Use-after-free during concurrent delazification * CVE-2024-11704 (bmo#1899402) Potential double-free vulnerability in PKCS#7 decryption handling * CVE-2025-1013 (bmo#1932555) Potential opening of private browsing tabs in normal browsing windows * CVE-2025-1014 (bmo#1940804) Certificate length was not properly checked * CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694, bmo#1938469, bmo#1939583, bmo#1940994) Memory safety bugs fixed in Firefox 135, Thunderbird 135, Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20, and Thunderbird 128.7 * CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984) Memory safety bugs fixed in Firefox 135, Thunderbird 135, Firefox ESR 128.7, and Thunderbird 128.7- Firefox Extended Support Release 128.6.0 ESR * Fixed: Various security fixes. MFSA 2025-02 (bsc#1234991) * CVE-2025-0237 (bmo#1915257) WebChannel APIs susceptible to confused deputy attack * CVE-2025-0238 (bmo#1915535) Use-after-free when breaking lines in text * CVE-2025-0239 (bmo#1929156) Alt-Svc ALPN validation failure when redirected * CVE-2025-0240 (bmo#1929623) Compartment mismatch when parsing JavaScript JSON module * CVE-2025-0241 (bmo#1933023) Memory corruption when using JavaScript Text Segmentation * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873, bmo#1932169) Memory safety bugs fixed in Firefox 134, Thunderbird 134, Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19, and Thunderbird 128.6 * CVE-2025-0243 (bmo#1827142, bmo#1932783) Memory safety bugs fixed in Firefox 134, Thunderbird 134, Firefox ESR 128.6, and Thunderbird 128.6 - Firefox Extended Support Release 128.5.2 ESR * Fixed: Fixed a crash experienced by Windows users with Qihoo 360 Total Security Antivirus software installed (bmo#1934258)- Firefox Extended Support Release 128.5.1 ESR (bsc#1234326) * Fixed: Fixed an issue that prevented some websites from loading when using SSL Inspection. (bmo#1933747)- Firefox Extended Support Release 128.5.0 ESR * Fixed: Various security fixes and other quality improvements. MFSA 2024-64 (bsc#1233695) * CVE-2024-11691 (bmo#1914707, bmo#1924184) Out-of-bounds write in Apple GPU drivers via WebGL * CVE-2024-11692 (bmo#1909535) Select list elements could be shown over another site * CVE-2024-11693 (bmo#1921458) Download Protections were bypassed by .library-ms files on Windows * CVE-2024-11694 (bmo#1924167) CSP Bypass and XSS Exposure via Web Compatibility Shims * CVE-2024-11695 (bmo#1925496) URL Bar Spoofing via Manipulated Punycode and Whitespace Characters * CVE-2024-11696 (bmo#1929600) Unhandled Exception in Add-on Signature Verification * CVE-2024-11697 (bmo#1842187) Improper Keypress Handling in Executable File Confirmation Dialog * CVE-2024-11698 (bmo#1916152) Fullscreen Lock-Up When Modal Dialog Interrupts Transition on macOS * CVE-2024-11699 (bmo#1880582, bmo#1929911) Memory safety bugs fixed in Firefox 133, Firefox ESR 128.5, and Thunderbird 128.5- Firefox Extended Support Release 128.4.0 ESR * Fixed: Various security fixes and other quality improvements. MFSA 2024-56 (bsc#1231879) * CVE-2024-10458 (bmo#1921733) Permission leak via embed or object elements * CVE-2024-10459 (bmo#1919087) Use-after-free in layout with accessibility * CVE-2024-10460 (bmo#1912537) Confusing display of origin for external protocol handler prompt * CVE-2024-10461 (bmo#1914521) XSS due to Content-Disposition being ignored in multipart/x-mixed-replace response * CVE-2024-10462 (bmo#1920423) Origin of permission prompt could be spoofed by long URL * CVE-2024-10463 (bmo#1920800) Cross origin video frame leak * CVE-2024-10464 (bmo#1913000) History interface could have been used to cause a Denial of Service condition in the browser * CVE-2024-10465 (bmo#1918853) Clipboard "paste" button persisted across tabs * CVE-2024-10466 (bmo#1924154) DOM push subscription message could hang Firefox * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394, bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706) Memory safety bugs fixed in Firefox 132, Thunderbird 132, Firefox ESR 128.4, and Thunderbird 128.4 - Rebase mozilla-rust-disable-future-incompat.patch- Firefox Extended Support Release 128.3.1 ESR MFSA 2024-51 (bsc#1231413) * CVE-2024-9680 (bmo#1923344) Use-after-free in Animation timeline- Firefox Extended Support Release 128.3.0 ESR * Fixed: Various security fixes and other quality improvements. MFSA 2024-47 (bsc#1230979) * CVE-2024-9392 (bmo#1899154, bmo#1905843) Compromised content process can bypass site isolation * CVE-2024-9393 (bmo#1918301) Cross-origin access to PDF contents through multipart responses * CVE-2024-9394 (bmo#1918874) Cross-origin access to JSON contents through multipart responses * CVE-2024-8900 (bmo#1872841) Clipboard write permission bypass * CVE-2024-9396 (bmo#1912471) Potential memory corruption may occur when cloning certain objects * CVE-2024-9397 (bmo#1916659) Potential directory upload bypass via clickjacking * CVE-2024-9398 (bmo#1881037) External protocol handlers could be enumerated via popups * CVE-2024-9399 (bmo#1907726) Specially crafted WebTransport requests could lead to denial of service * CVE-2024-9400 (bmo#1915249) Potential memory corruption during JIT compilation * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317, bmo#1916476) Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16, Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3 * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317, bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963, bmo#1915008, bmo#1916476) Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3- Firefox Extended Support Release 128.2.0 ESR * Fixed: Various security fixes and other quality improvements. MFSA 2024-40 (bsc#1229821) * CVE-2024-8385 (bmo#1911909) WASM type confusion involving ArrayTypes * CVE-2024-8381 (bmo#1912715) Type confusion when looking up a property name in a "with" block * CVE-2024-8382 (bmo#1906744) Internal event interfaces were exposed to web content when browser EventHandler listener callbacks ran * CVE-2024-8383 (bmo#1908496) Firefox did not ask before openings news: links in an external application * CVE-2024-8384 (bmo#1911288) Garbage collection could mis-color cross-compartment objects in OOM conditions * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529) SelectElements could be shown over another site if popups are allowed * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009) Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2, and Thunderbird 128.2 - Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch- Firefox Extended Support Release 128.1.0 ESR * Fixed: Various security fixes and other quality improvements. MFSA 2024-35 (bsc#1228648) * CVE-2024-7518 (bmo#1875354) Fullscreen notification dialog can be obscured by document content * CVE-2024-7519 (bmo#1902307) Out of bounds memory access in graphics shared memory handling * CVE-2024-7520 (bmo#1903041) Type confusion in WebAssembly * CVE-2024-7521 (bmo#1904644) Incomplete WebAssembly exception handing * CVE-2024-7522 (bmo#1906727) Out of bounds read in editor component * CVE-2024-7524 (bmo#1909241) CSP strict-dynamic bypass using web-compatibility shims * CVE-2024-7525 (bmo#1909298) Missing permission check when creating a StreamFilter * CVE-2024-7526 (bmo#1910306) Uninitialized memory used by WebGL * CVE-2024-7527 (bmo#1871303) Use-after-free in JavaScript garbage collection * CVE-2024-7528 (bmo#1895951) Use-after-free in IndexedDB * CVE-2024-7529 (bmo#1903187) Document content could partially obscure security prompts * CVE-2024-7531 (bmo#1905691) PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel Sandy Bridge machines- Firefox Extended Support Release 128.0esr ESR * ### General * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported operating systems. * Firefox now supports automated translation of web content. Also, unlike cloud-based alternatives, translation is done locally so that the text being translated never leaves the machine. * The line breaking rules of web content now match the Unicode standard, improving cross-browser compatibility. Additionally, for East Asian and South East Asian end users, Firefox now supports proper language-aware word selection when double-clicking on text for languages including Chinese, Japanese, Burmese, Lao, Khmer, and Thai. * Video effects and background blur are now available to Firefox users on Google Meet. Firefox now displays images and descriptions for search suggestions when provided by the search engine. * It is now possible to copy and paste any file from the operating system into Firefox. * Having any issues with a website on Firefox, yet the site seems to be working as expected on another browser? You can now let us know via the Web Compatibility Reporting Tool! By filing a web compatibility issue, you’re directly helping us detect, target, and fix the most impacted sites to make your browsing experience on Firefox smoother. * Firefox now prompts users in the US and Canada to save their addresses upon submitting an address form, allowing Firefox to autofill stored address information in the future. * Support for credit card autofill has been extended to users running Firefox in the IT, ES, AT, BE, and PL locales. * Recently closed tabs now persist between sessions that don't have automatic session restore enabled. Manually restoring a previous session will continue to reopen any previously open tabs or windows. * When migrating data from Chrome, Firefox now offers the ability to import certain extensions as well. * The Screenshots feature in Firefox has been updated. It now supports taking screenshots of file types like SVG, XML, and more as well as various about: pages within Firefox. The screenshot tool was also made more accessible to everyone by implementing new keyboard shortcuts and adding theme compatibility and High Contrast Mode (HCM) support. And finally, performance for capturing large screenshots has been improved. * ### PDF Viewer * The Firefox PDF viewer has expanded PDF editing capabilities: * Text highlighting is now supported. * Editing already-existing text annotations is now supported. * Images and alt text can be added in addition to text and drawings. * A floating button is now included to simplify deleting drawings, text, and images added in PDFs. * Caret browsing mode now also works in the PDF viewer. (Learn more) * ### Firefox View * Firefox View includes more content. You can now see all open tabs from all windows. If you sync open tabs, you’ll see all tabs from other devices. Browsing history is now listed and you can sort by date or by site. As before, recently closed tabs are also listed on Firefox View. To access Firefox View, select the file folder icon at the top left of your tab strip. * We’ve integrated search into Firefox View. You can now search through all of the tabs on each of the section subpages - Recent Browsing, Open Tabs, Recently Closed Tabs, Tabs from other devices, or History. * In Firefox View, open tabs can now be sorted by either recent activity or tab order. Recent activity is the default setting. * Firefox View now displays pinned tabs in the Open tabs section. Tab indicators have also been added to Open tabs, so users can do things like see which tabs are playing media and quickly mute or unmute across windows. Indicators were also added for bookmarks, tabs with notifications, and more! * It is now possible to close all duplicate tabs in a window with the `Close duplicate tabs` command available from the `List all tabs` widget in the tab bar or a tab context menu. * ### Security & Privacy * For added protection on macOS and Windows, a device sign in (e.g. operating system password, fingerprint, face or voice login if enabled) can be required when accessing and filling stored passwords in the Firefox Password Manager about:logins page. * Firefox now supports creating and using passkeys stored in the iCloud Keychain on macOS. * Firefox now imports user-added TLS trust anchors (e.g., certificates) from the operating system root store. This will be enabled by default on Windows, macOS, and Android, and if needed, can be turned off in settings (Settings → Privacy & Security → Certificates). * The Storage Access API web standard was updated to improve security while mitigating website breakages and further enabling the phase out of third-party cookies in Firefox. * Encrypted Client Hello (ECH) is now available to Firefox users, delivering a more private browsing experience. ECH extends the encryption used in TLS connections to cover more of the handshake and better protect sensitive fields. Read more about the launch of ECH on Mozilla Distilled. * Firefox supports a new “Copy Link Without Site Tracking” feature in the context menu which ensures that copied links no longer contain tracking information. * Firefox now supports a setting (in Preferences → Privacy & Security) to enable Global Privacy Control. With this opt-in feature, Firefox informs the websites that the user doesn’t want their data to be shared or sold. This feature is enabled in private browsing mode by default. * Firefox now more proactively blocks downloads from URLs that are considered to be potentially untrustworthy. * ### Anti-Fingerprinting * Web Audio in Firefox now uses the FDLIBM math library on all systems to improve anonymity with Fingerprint Protection. * As part of Total Cookie Protection, Firefox now supports the partitioning of Blob URLs, this mitigates a potential tracking vector that third-party agents could use to track an individual. * To mitigate font fingerprinting, the visibility of fonts to websites has been restricted to system fonts and language pack fonts when in Private Browsing Mode or with Enhanced Tracking Protection set to strict mode. * Firefox’s private windows and ETP-Strict privacy configuration now enhance the Canvas APIs with Fingerprinting Protection. * To reduce user fingerprinting information and the risk of some website compatibility issues, the CPU architecture for 32-bit x86 Linux will now be reported as x86_64 in Firefox's User-Agent string and `navigator.platform` and `navigator.oscpu` Web APIs. * ### Windows * Firefox can now be set to automatically launch whenever the computer starts up. (Learn more) * The background updater now updates properly when there are multiple user accounts on a system. * Firefox now populates the Windows taskbar jump list more efficiently, which should allow for a smoother overall browsing experience. * ### macOS * Firefox now supports Voice Control commands on macOS systems. * Links and other focusable elements are now tab-navigable by default on macOS, instead of following macOS' "Keyboard navigation" setting. This is a more accessible default and matches the default in all other platforms. A checkbox in the settings page still allows users to restore the old behavior. * Firefox on Mac now uses the macOS fullscreen API for all types of fullscreen windows. This should better match the expected macOS user experience for fullscreen spaces, menubar and the Dock. * ### Linux * Firefox now defaults to the Wayland compositor when available instead of XWayland. This brings support for touchpad & touchscreen gestures, swipe-to-nav, per-monitor DPI settings, better graphics performance, and more. * Firefox now ships with a new .deb package for Linux users on Ubuntu, Debian, and Linux Mint. * ### Video Playback * Enabled AV1 hardware decode acceleration on macOS for M3 Macs. * Firefox now supports the AV1 codec for Encrypted Media Extensions (EME), enabling higher-quality playback from video streaming providers. * NVIDIA RTX Video Super Resolution (“VSR”) is now available in Firefox. RTX VSR enhances and sharpens lower resolution video when upscaled to higher resolutions and also removes blocky artifacts commonly visible on low bitrate streamed video. VSR requires at least a 20-series or higher NVIDIA RTX GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver version R530 or higher. The feature can be enabled in the NVIDIA control panel. * NVIDIA RTX Video HDR is now available in Firefox. RTX Video HDR automatically converts SDR video to vibrant HDR10 in real time, letting you enjoy video with improved clarity on your HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550 or higher. The feature can be enabled in the NVIDIA control panel. * Developer: * Firefox now supports DNS prefetching for HTTPS documents via the `rel="dns-prefetch"` link hint. This standard allows web developers to specify domain names for important assets that should be resolved preemptively. * Firefox will now automatically try to upgrade ,