The release of the Firefox 140 web browser has taken place. Firefox 140 is classified as one of the long-term support (ESR) branches, with updates being released over the course of a year. Additionally, updates for previous long-term support branches 115.25.0 and 128.12.0 have been produced. The Firefox 141 branch has entered beta testing, with its release scheduled for July 22.

Key Innovations in Firefox 140:

• The vertical tabs panel now allows resizing of the pinned tabs area, used for quick access to important pages. To increase the number of pinned tabs (by reducing the space for regular open tabs), simply move the section divider with the mouse.
• The context menu displayed when right-clicking on a tab or group of selected tabs now includes an 'Unload Tab' option, allowing tabs to be unloaded from memory to reduce memory consumption and CPU resources.
• The ability to add custom search engines has been provided. To add search engines on websites using the <link rel="search"…> tag to describe search engine parameters, you can use the 'Add Search Engine' item in the context menu displayed when right-clicking on the search field. A search engine can also be added in the configurator (Settings > Search > Add).
• In the interface for customizing the toolbar (Customize toolbar… in the panel's context menu), the option to remove the shortcut to the list of extensions has been implemented. If the button with extensions is hidden, access to the extensions management interface can be obtained via the 'Extensions' button in the main menu.
• When translating the content of the entire page into another language, only the content of the visible part of the page is translated initially, with the remaining content translated as the user scrolls. This change reduces resource consumption and increases the interface responsiveness during translation.
• For users in Poland, Italy, and Austria, the address autofill feature in web forms has been enabled, which was previously available only for the USA, UK, Canada, Germany, and France.
• Components related to the Pocket service have been removed from the toolbar and new tab opening page, as Mozilla has discontinued its support.
• Access to device drivers via ioctl is restricted in the implementation of sandbox isolation for Linux.
• Support for the 'aria-keyshortcuts' attribute, defined in the ARIA (Accessible Rich Internet Applications) specification for individuals with disabilities, has been added, allowing key combination specifications to switch focus to elements.
• The CookieStore API has been introduced, enabling the retrieval, setting, and deletion of cookies asynchronously from scripts executed in the context of HTML pages or Service Workers.
• The Custom Highlight API has been implemented, designed for arbitrary style changes to highlighted text areas, allowing for custom highlighting beyond the fixed styles provided by the browser for highlighted areas (::selection, ::inactive-selection) and syntax error highlighting (::spelling-error, ::grammar-error). For example, this new API allows web frameworks providing text editing tools to implement their own text highlighting mechanisms, different highlighting during simultaneous collaborative editing by multiple users, and error marking during spell checking. Previously, creating non-standard highlighting required complex manipulations of the DOM tree, but the Custom Highlight API offers ready-made operations for adding and removing highlights without affecting the DOM structure and applying styles tied to Range objects.
• Support for the pointerrawupdate event has been added, enabling tracking of pointer movements. Compared to the 'pointermove' event, the new event is generated more frequently and as data becomes available, which can be critical for applications that require high-accuracy pointer movement tracking.
• In private browsing mode, sites are allowed to use Service Workers for background tasks and to utilize the IndexedDB API and DOM Cache with encrypted storage.
• The size and style of the font in

  elements have been unified, which are now independent of the use of

  within

  ,

• The serialization of HTML attributes now includes the escaping of characters '' to complicate certain types of XSS attacks. The methods Element.innerHTML, Element.outerHTML, Element.getHTML, ShadowRoot.innerHTML, and ShadowRoot.getHTML will now replace the characters '' with '<' and '>' when serializing HTML to a string.
• The web development tools in the inspection panel have enhanced search capabilities within the DOM tree of the current page. It is now possible to sort search results by the number of found elements and support for pseudo-classes.
• In the Android platform version, bookmark management has been simplified (a 'Select All' button has been added to perform operations on multiple bookmarks at once). Enhanced protection in private browsing mode has been implemented.

In addition to new features and bug fixes, Firefox 140 has addressed 17 vulnerabilities. Six of these vulnerabilities are due to memory management issues, such as buffer overflows and access to already freed memory areas. These problems may potentially lead to the execution of malicious code when opening specially crafted pages. Notably, there is an issue with the built-in WebCompat extension in Firefox, which allows the identification of browser instances, including when viewing pages in private mode. This vulnerability is due to the ability to obtain a persistent identifier (UUID) through resource analysis provided by the WebCompat extension.

In the beta version of Firefox 141, memory consumption on the Linux platform has been reduced, and the requirement to restart after updating through the package manager has been removed.

Source: opennet.ru