The release of the Firefox 124 web browser has occurred, along with an update for the long-term support branch — 115.9.0. The Firefox 125 branch has entered beta testing, with a release scheduled for April 16.
Key innovations in Firefox 124:
- On the Firefox View page, which simplifies access to previously viewed content, the ability to sort the list of open tabs by order of opening or recent activity has been added.
- The default settings for the 'Recent browsing' section on the Firefox View page have been changed (bookmarks are hidden). You can choose to show recently viewed tabs, bookmarks, recent downloads, and tabs saved in the Pocket service.
- The built-in PDF viewer now supports keyboard navigation through text using the caret (Caret Navigation), which is typically used by people with disabilities.
- On the Windows platform, the efficiency of filling out the jump list in the taskbar has been improved.
- On the macOS platform, a specific API for this platform has been utilized in all types of fullscreen windows.
- A method AbortSignal.any() has been added, which returns a signal that is aborted if any of the original signals are aborted; this can be used in fetch() to combine multiple abort signals, such as AbortSignal.timeout() and AbortController.
- When creating a WebSocket, the use of HTTP/HTTPS and relative URLs is now allowed.
- The ability to apply CSS pseudo-elements ‘::first-letter’ and ‘::first-line’ to the SVG element has been added, allowing for different styling or font changes for the first letter and the first line of text.
- For extension developers, the runtime.onPerformanceWarning event has been implemented, allowing for the identification of situations when the browser detects performance issues with an extension (such as slow content processing scripts).
- An experimental capability to increase or decrease the size of ArrayBuffer, as well as increase the size of SharedArrayBuffer, has been provided. New methods ArrayBuffer.prototype.resize() and SharedArrayBuffer.prototype.grow() have been proposed.
- The default version for Android includes handling of the screen gesture for pulling down to refresh the page. It also implements the use of the Drag & Drop API for moving plain text and HTML markup with a mouse, among other things, for transferring content from external applications.
In addition to new features and bug fixes, Firefox 124 has addressed 16 vulnerabilities. 2 vulnerabilities are marked as critical, and 8 as high risk. 7 vulnerabilities (6 classified under CVE-2024-2615 and CVE-2024-2614) are caused by memory handling issues, such as buffer overflows and access to already freed memory areas. These issues could potentially allow an attacker to execute their code when opening specially crafted pages. The marked critical vulnerabilities (CVE-2024-2615) allow bypassing all additional isolation mechanisms. The CVE-2024-2607 vulnerability due to a JIT error on Armv7-A systems allows for a return address register overwrite and execution of the attacker's code. The CVE-2024-2605 vulnerability allows using Windows Error Reporter to bypass Sandbox isolation and execute code.
Source: opennet.ru
