The release of the web browser Firefox 132 has occurred, and updates for previous long-term support branches — 115.17.0 and 128.4.0 — have been formed. The Firefox 133 branch has entered beta testing, with a release scheduled for November 26.
Key Features in Firefox 132:
- In strict Enhanced Tracking Protection (ETP) mode, when opening pages in private browsing, access to all third-party cookies set by domains different from the current page is now blocked. domain For example, whereas previously third-party code from site "C" embedded via iframe on sites "A" and "B" could access common cookies set for those sites, now cookies set by site "C" will be unavailable when loading code from sites "A" and "B." Third-party cookies are used for tracking user movements between sites in advertising network codes, social media widgets, and web analytics systems.
- The "Copy Without Site Tracking" option is now grayed out in the context menu if the selected link does not contain parameters for tracking transitions between sites. The range of supported parameters for tracking transitions in URLs has been expanded, for instance, allowing the removal of parameters used on LinkedIn and Shopee sites.
- The logic for handling favicon icons has changed with the automatic upgrade of HTTP to HTTPS. If an icon is only available via HTTP, its loading will now be blocked.
- Support for the hybrid key exchange algorithm "mlkem768x25519" has been added in TLS 1.3, which is resistant to quantum computer attacks and combines X25519 ECDH with the ML-KEM algorithm (CRYSTALS-Kyber), recently standardized by the U.S. National Institute of Standards and Technology (NIST). ML-KEM utilizes cryptographic methods based on solving lattice theory problems, with solution times being similar on both classical and quantum computers.
- Support for the TLS extension for certificate compression during the handshake phase (RFC 8879) has been implemented, which speeds up the connection setup since the bulk of the traffic during the handshake is attributed to certificate data transmission.
- The API for EME (Encrypted Media Extensions) has implemented a module supporting the copy protection technology PlayReady developed by Microsoft, providing DRM (Digital Rights Management) elements for viewing encrypted video content in 1080p and 4K Ultra HD on PlayReady-supporting streaming platforms. Initially, the availability of PlayReady is enabled for a small percentage of users, but the user base will gradually expand over time.
- The WebRender API for SVG filters eBlend, feColorMatrix, feComponentTransfer, feComposite, feDropShadow, feFlood, feGaussianBlur, feMerge, and feOffset has included hardware acceleration for rendering, which has improved performance when working with certain types of graphical content.
- Support for wide-gamut color space has been implemented for Windows and macOS platforms, which is currently limited to P3 profiles with 8-bit color representation per channel.
- In the macOS builds, session recovery features have been enhanced (Firefox now automatically launches if the session is interrupted due to a system reboot) and the ability to share the screen has been added.
- The HTMLVideoElement API has added the method requestVideoFrameCallback(), allowing for frame-by-frame video processing.
- The MediaStreamTrack API has added the method getCapabilities() to determine the range of permissible property values related to audio and video content (sample rate, latency, number of channels, aspect ratio, size, FPS, etc.);
- In the elements <link>, <script> и <img> добавлен атрибут «fetchpriority», позволяющий выставить относительный приоритет загрузки того или иного ресурса, который будет учтён при планировании порядка загрузки ресурсов, загружаемых через HTTP/2 и HTTP/3. Для установки приоритетов в API HTMLLinkElement, HTMLScriptElement и HTMLImageElement также реализовано свойство fetchPriority, а в конструктор Request() добавлена поддержка параметра «options.priority». Среди допустимых значений приоритета: auto, low и high.
- Following other browsers, Firefox has discontinued support for the Server Push technology defined in the HTTP/2 and HTTP/3 standards, which allows the server to send resources to the client without waiting for explicit requests.
- The web development tools have restored the ability to debug external devices connected via USB. In the web console, support for logging Service Worker operations has been resumed using the console.log API.
- In the Android version, the address bar for new installations has been moved to the top of the screen by default. You can move the address bar down by using the setting 'Customize > Toolbar'. In the 'viewport' meta tag, the 'interactive-widget' parameter now defaults to 'resizes-visual', which allows the appearance of the on-screen keyboard to change the size of the visual viewport but does not alter the layout viewport, helping to avoid resource-intensive content redraws.
In addition to new features and bug fixes, Firefox 132 has addressed 17 vulnerabilities. Two vulnerabilities are marked as critical, and an additional 7 vulnerabilities, categorized under CVE-2024-10467, are related to memory handling issues such as buffer overflows and accessing already freed memory areas. Potentially, these issues could lead to the execution of malicious code when specially crafted pages are opened.
In the translated beta version of Firefox 133, it is now possible to view tabs from other devices through the menu in the upper right corner. In the Linux builds, support for additional touchpad gestures has been added (for example, two-finger tap to pause inertial scrolling). In the Android version, desktop mode is enabled by default on devices with large screens.
Source: opennet.ru
