The release of the web browser Firefox 95 has taken place. Additionally, an update for the long-term support branch — 91.4.0 has been created. The Firefox 96 branch will soon enter beta testing, with its release scheduled for January 11.
Key innovations:
- An additional layer of isolation based on RLBox technology has been implemented for all supported platforms. This proposed isolation layer helps block security issues in third-party function libraries that are outside the control of Firefox developers but could compromise the main project if vulnerabilities are discovered. In this release, RLBox is used to isolate the Graphite, Hunspell, and Ogg libraries, while the next release expects to isolate Expat and Woff2.
The operation of RLBox involves compiling C/C++ code from the library being isolated into low-level WebAssembly intermediate code, which is then packaged as a WebAssembly module, with its permissions strictly tied to this module (for example, a string processing library will not be able to open a network socket or file). To execute, the WebAssembly module is compiled into machine code using the wasm2c compiler and runs in a separate memory space, having no access to the rest of the address space.
- The strict site isolation mode, developed under the Fission project, has been activated for all users. Unlike the previously implemented arbitrary distribution of tab processing across the available pool of processes (by default 8), the strict isolation mode moves the processing of each site into its own separate process, dividing not by tabs, but by domains (Public Suffix).
Strict isolation mode provides enhanced protection against Spectre attacks, reduces memory fragmentation, allows for additional isolation of external scripts and iframe content, more effectively returns memory to the operating system, minimizes the impact of garbage collection and intensive computations on pages in other processes, increases the efficiency of load distribution across different CPU cores, and enhances stability (a crash in the process handling an iframe will not affect the main site or other tabs). The trade-off is an overall increase in memory consumption with a large number of open sites.
- Work continues to improve support for the Wayland protocol. The Firefox port for Wayland has achieved overall functional parity with the X11 build when operating in the Fedora GNOME environment.
- The context menu for the Picture-in-Picture mode has been updated to include an option for moving the toggle button to the opposite side of the video.
- The JavaScript pre-fetch compilation technology has been implemented, enhancing page loading performance. Optimizations have been made to the memory distribution system.
- User Agent value overriding has been enabled for the Slack.com website, allowing access to additional Slack features such as voice/video calls and huddles, which were previously inaccessible when opening the site in Firefox.
- Global inputmode attribute support has been implemented across all platforms, used to specify information about the types of data that can be entered when editing a field. This information is utilized to select the most suitable on-screen keyboard for editing the current element on touch-screen devices. Previously, inputmode support was limited to the Android platform.
- The Crypto.randomUUID() function has been added, returning a cryptographically secure 36-character UUID.
- In macOS builds, CPU load during event processing has been reduced, content processing startup times have been accelerated, and energy consumption during software video decoding has been lowered, including during playback of videos from Netflix and Amazon Prime Video.
- Firefox can be installed from the Microsoft Store catalog for Windows 10 and Windows 11 platforms.
- The Android version introduces a new Homepage section in the settings menu. The 'Jump back in' page displays key images from websites (Hero Image). A confirmation prompt has been implemented when enabling the automatic tab closing mode.
- The Android version supports the CSS property cursor, which visually indicates clickable elements, making it easier for Android users using a mouse (the cursor image will change when hovering over such elements).
In addition to new features and bug fixes, Firefox 95 addresses 18 vulnerabilities, 11 of which are marked as critical. Eight of these vulnerabilities are caused by memory handling issues such as buffer overflows and accessing already freed memory areas. These issues could potentially allow an attacker to execute code when opening specially crafted pages.
Source: opennet.ru
