The release of the web browser has taken place , as well as Firefox 68.6 for the Android platform. Additionally, an update has been formed with long-term support . Soon moving to the stage of The Firefox 75 branch will transition, with its release scheduled for April 7 (project for 4-5 weeks) ). For the beta branch of Firefox 75 formation for Linux in Flatpak format.
:
- The Linux builds utilize an isolation mechanism , aimed at blocking the exploitation of vulnerabilities in third-party function libraries. At this stage, isolation is enabled only for the library , responsible for rendering fonts. RLBox compiles the C/C++ code of the isolated library into low-level WebAssembly intermediate code, which is then packaged as a WebAssembly module with permissions specified only for that module. The compiled module operates in a separate memory space and has no access to the rest of the address space. In the event of a vulnerability being exploited in the library, the attacker will be restricted and unable to access the main process's memory areas or transfer control outside the isolated environment.
- DNS over HTTPS (DoH) for users in the USA. CloudFlare (mozilla.cloudflare-dns.com) is suggested as the default DNS provider downward API support (simultaneously with this in of Roskomnadzor), and NextDNS is available as an option. Change the provider or enable DoH in countries other than the USA in the network connection settings. More about DoH in Firefox can be read in .
- Support for TLS 1.0 and TLS 1.1 protocols. To access websites over a secure connection, the server must provide support for at least TLS 1.2. According to Google, approximately 0.5% of web page downloads are still performed using outdated versions of TLS. This disabling was carried out in accordance with IETF (Internet Engineering Task Force). The reason for discontinuing support for TLS 1.0/1.1 is the lack of support for modern ciphers (e.g., ECDHE and AEAD) and the requirement to support outdated ciphers, the reliability of which has been called into question at the current stage of computing technology (e.g., support for TLS_DHE_DSS_WITH_3DES_EDE_CBC_SHA is required, and integrity and authentication checks use MD5 and SHA-1). An error will occur when trying to use TLS 1.0 and TLS 1.1 starting with Firefox 74. The possibility to work with deprecated versions of TLS can be restored through the setting security.tls.version.enable-deprecated = true or using a button on the error page that appears when accessing a site with an old protocol.
- In the release notes, the extension , which automatically blocks Facebook widgets embedded on third-party sites used for authentication, commenting, and liking, is recommended. Facebook identification parameters are isolated in a separate container, making it difficult to link the user with the visited sites. Access to the main Facebook site remains, but it is isolated from other sites.
For more flexible isolation of arbitrary sites, the extension is suggested with the implementation of the contextual container concept. Containers provide the ability to isolate different types of content without creating separate profiles, allowing information from different groups of pages to be separated. For example, it is possible to create separate, isolated areas for personal communication, work, shopping, and banking operations or to organize the simultaneous use of different user accounts on one site. Each container uses separate storage for Cookies, Local Storage API, indexedDB, cache, and OriginAttributes content.
- A setting called 'browser.tabs.allowTabDetach' has been added to about:config, allowing the prevention of detaching tabs into new windows. Accidentally detaching a tab is one of the most annoying shortcomings of Firefox, which now needs fixing. 9 years. The browser allows you to drag a tab into a new window with the mouse, but under certain circumstances, the tab can detach into a separate window, especially when moving the mouse carelessly while clicking on the tab.
- support for add-ons installed through unofficial means and not tied to user profiles. This change affects only the installation of add-ons in shared directories (/usr/lib/mozilla/extensions/, /usr/share/mozilla/extensions/ or ~/.mozilla/extensions/), processed by all instances of Firefox on the system (without binding to the user). This method is commonly used for pre-installing add-ons in distributions, for unsolicited insertion alongside third-party applications, for integrating malicious add-ons, or for separately delivering an add-on with its own installer. In Firefox 73, previously forcibly installed add-ons were automatically moved from the shared directory to individual user profiles and can now be managed through the built-in add-on manager.
- In the browser's built-in add-on Lockwise, which offers the 'about:logins' interface for managing saved passwords, there appeared an option for sorting in reverse order (from Z to A).
- WebRTC has enhanced protection against leaking information about the internal IP address during voice and video calls using the '' mechanism, which hides the local address behind a dynamically generated random identifier defined via Multicast DNS.
- The position of the picture-in-picture mode toggle has been changed, which overlapped the button to go to the next image in the photo batch upload interface on Instagram.
- In JavaScript The operator "?." is designed for one-off checks across the entire chain of properties or calls. For example, by using "db?.user?.name?.length", you can now access the value of "db.user.name.length" without prior checks. If any element is processed as null or undefined, the output will return "undefined".
- Support for the Object.toSource() method and the global function uneval() on websites and extensions.
- A new event has been added and its associated property , which allows a handler to be invoked when the user changes the interface language.
- HTTP header processing has been enabled (), allowing sites to prohibit the embedding of resources (such as images and scripts) loaded from other domains (cross-origin and cross-site). The header can take two values: "same-origin" (allows only resource requests from the same scheme, host name, and port) and "same-site" (allows only requests from the same site).
Cross-Origin-Resource-Policy: same-site
- The HTTP header has been enabled by default , which allows managing the behavior of APIs and enabling certain capabilities (for example, access to the Geolocation API, camera, microphone, fullscreen mode, autoplay, encrypted-media, animations, Payment API, synchronous mode of XMLHttpRequest, etc.). For iframe blocks, the attribute "" has been separately proposed, which can be used in the page code to assign permissions for certain iframe blocks.
<iframe src=»https://example.com» allow=»fullscreen»></iframe>
Feature-Policy: microphone 'none'; geolocation 'none'
If a site allows access to a resource through the "allow" attribute for a specific iframe, and a request is made from the iframe to obtain permissions for working with that resource, the browser now displays a permission dialog in the context of the main page and delegates the permissions granted by the user to the iframe (instead of separate confirmation for the iframe and the main page). However, if the main page does not have permissions for the resource requested through the allow attribute, access for the iframe to the resource is granted immediately , without displaying a dialog to the user.
- CSS property support for ‘’ is enabled by default, which determines the position of text underlining (for example, when displaying text vertically, underlining can be arranged on the left or right side, and when horizontally, it can be positioned not only at the bottom but also at the top). Additionally, in the control styles for underlining CSS properties, and support for the use of percentage values has been added.
- In the CSS property , which defines the line style around elements, the 'auto' value is now allowed by default (previously it was due to issues in GNOME).
- In the JavaScript debugger, the ability to debug nested Web Workers has been implemented, allowing them to be paused and stepped through using breakpoints.
- In the web page inspection interface, warnings are now displayed for CSS properties that depend on positioned elements with z-index, top, left, bottom, and right.
- For Windows and macOS, the ability to import profiles from the Chromium-based Microsoft Edge browser has been implemented.
In addition to new features, Firefox 74 rectified , of which 10 (grouped under and ) are marked as potentially capable of allowing code execution by an attacker when opening specially crafted pages. It is worth noting that memory issues, such as buffer overflows and accesses to already freed memory areas, have recently been flagged as dangerous but not critical.
Source: opennet.ru
