A corrective release of Firefox 148.0.2 is available, addressing 5 vulnerabilities. 4 vulnerabilities are caused by memory management issues, such as buffer overflows and access to already freed memory areas. One of the buffer overflows affects code for rendering audio and video in the Android version. These issues could potentially lead to the execution of arbitrary code by an attacker when specially crafted pages are opened. A non-memory-related issue exists in the CSS parsing code, allowing for Same-origin restrictions to be bypassed.
Among the non-security fixes:
- Fixed an incorrect redirect to the address bar when entering a search query on the new tab page.
- Resolved an issue that prevented formatting changes in certain web text editors (for example, bold or italic selections would stop working).
- Eliminated the issue of automatic video playback on YouTube despite enabling autoplay blocking. This issue arose when holding the Ctrl key after opening a page with a video, which is commonly used on screen reader systems.
- Corrected an error that caused some absolutely positioned elements to align to the left instead of being centered upon loading.
- Fixed a bug that resulted in a blank recommendation to switch tabs for pages lacking a 'title' tag.
- Resolved an issue that led to reduced video quality on Windows systems with NVIDIA GPUs when Video Super Resolution mode was enabled.
Several other events related to Firefox:
- Mozilla has reversed its decision to discontinue support for the ESR branch of Firefox 115 and extended the publication of updates until the end of August. However, support will be limited to Windows 7-8.1 and macOS 10.12-10.14 platforms, and functionality for Firefox 115 cannot be guaranteed on other operating systems. According to Mozilla statistics, as of March 2, 2026, 5.33% of Firefox users are still using Windows 7. It is stated that Mozilla will make a decision regarding the future of the Firefox 115 branch in July.
- Details have been revealed about the abnormally high number of vulnerabilities (60 compared to the typical 10-20) fixed in the release of Firefox 148. Firefox 148 includes fixes for issues identified through a security enhancement initiative conducted by Mozilla in collaboration with Anthropic. During an analysis of the Firefox codebase using the AI model Claude Opus 4.6, 22 confirmed vulnerabilities were found, 14 of which were assigned a high danger level. Additionally, 90 bugs unrelated to security were discovered. As a demonstration of AI capabilities, for one of the vulnerabilities (CVE-2026-2796), the Claude Opus 4.6 model was used to create a working exploit.
- In the stable builds of Firefox, the setting "browser.tabs.notes.enabled" has appeared on the about:config page, allowing users to activate the experimental Tab Notes feature to attach arbitrary notes to tabs. A button for adding notes is placed in the context menu and is also displayed on the thumbnail that appears when hovering over a tab.
Source: opennet.ru
