The release of the web browser has taken place , as well as the mobile version for the Android platform. Firefox 78 falls into the category of Extended Support Release (ESR) branches, with updates released over the course of a year. Additionally, an update from the previous with long-term support (with two more updates, 68.11 and 68.12, expected soon). The Firefox 79 branch is set to transition, with the release scheduled for July 28.
:
- The summary page (Protections Dashboard) has been expanded with reports on the effectiveness of tracking protection mechanisms, credential compromise checks, and password management. The new release has introduced the ability to view statistics on the use of compromised credentials, as well as track potential overlaps of saved passwords with known data leaks. This check is performed through integration with the haveibeenpwned.com database, which includes information on 9.7 billion accounts compromised due to breaches of 456 sites. The summary is available on the "about:protections" page or via the menu accessed by clicking the shield icon in the address bar (the Show Report option is replaced by Protections Dashboard).
- The Uninstaller now includes a "" button that allows users to reset settings to their default state and remove all extensions without losing accumulated data. In case of issues, users often try to resolve them by reinstalling the browser. The Refresh button provides a similar effect without losing bookmarks, browsing history, saved passwords, cookies, connected dictionaries, and form autofill data (pressing the button creates a new profile and transfers the specified databases to it). After pressing Refresh, extensions, themes, permissions, connected search engines, local DOM storage, certificates, modified settings, and custom styles (userChrome, userContent) will be lost.
- The context menu shown for tabs has been enhanced with options to undo the closure of multiple tabs, as well as to close tabs to the right of the current tab and to close all tabs except the current one.
- Screen saver activation has been disabled during video calls and conferences based on WebRTC.
- On the Windows platform for Intel GPUs at any screen resolution compositing system , written in Rust and allowing for a significant increase in rendering speed and a decrease in CPU load. WebRender offloads rendering operations to the GPU, implemented through shaders executed on the GPU. Previously, WebRender was enabled on Windows 10 for Intel GPUs when using small screen resolutions, as well as on systems with AMD Raven Ridge APU, AMD Evergreen, and laptops with NVIDIA graphics cards. On Linux, WebRender is currently activated for Intel and AMD cards only in nightly builds and is not supported for NVIDIA cards. To force activation in about:config, the settings 'gfx.webrender.all' and 'gfx.webrender.enabled' should be enabled or Firefox can be launched with the environment variable MOZ_WEBRENDER=1.
- The percentage of users from the UK who have content recommended by the Pocket service displayed on the new tab page has reached 100%. Previously, such pages were only shown to users in the USA, Canada, and Germany. Sponsored blocks are shown only in the USA and are clearly marked as advertisements. Content personalization related to selection is performed on the client side without transmitting user information to third parties (the browser loads the entire list of recommended links for the current day, which is ranked on the user side based on browsing history data). To disable recommended Pocket content, a setting is available in the configurator (Firefox Home Content/Recommended by Pocket) and the option 'browser.newtabpage.activity-stream.feeds.topsites' in about:config.
- patches that affect the performance and stability of hardware-accelerated video decoding using VA-API (supported only in Wayland-based environments).
- Increased system component requirements for Linux. Firefox now requires at least Glibc 2.17, libstdc++ 4.8.1, and GTK+ 3.14 to run on Linux.
- Following the plan to discontinue support for deprecated cryptographic algorithms, all DHE-based TLS cipher suites (TLS_DHE_*, Diffie – Hellman key exchange protocol) are disabled by default. To mitigate the potential negative impact of disabling DHE, two new AES-GCM cipher suites based on SHA2 have been added.
- Support for TLS 1.0 and TLS 1.1 protocols. To access websites over a secure connection, the server must provide support for at least TLS 1.2. According to Google, approximately 0.5% of web page downloads are still performed using outdated versions of TLS. This disabling was carried out in accordance with IETF (Internet Engineering Task Force). The reason for discontinuing support for TLS 1.0/1.1 is the lack of support for modern ciphers (such as ECDHE and AEAD) and the requirement to support older ciphers whose reliability is now questioned in the current stage of computing development (for example, support for TLS_DHE_DSS_WITH_3DES_EDE_CBC_SHA is required, and MD5 and SHA-1 are used for integrity and authentication checks). The ability to work with outdated versions of TLS can be restored by setting security.tls.version.enable-deprecated = true or using a button on the error page that appears when visiting a site with an old protocol.
- The quality of work with screen readers for visually impaired people has significantly improved (issues with cursor positioning have been resolved, freezes have been eliminated, processing of very large tables has been accelerated, etc.). For users with migraines and epilepsy, animation effects such as tab highlighting and expansion of the search bar have been reduced.
- New rules for configuring external handler applications, disabling picture-in-picture mode, and requiring the setting of a master password have been added to group policies for enterprises.
- In the SpiderMonkey JavaScript engine Named groups
- Escaping classes
- Unicode characters are added using the constructs \p{…} and \P{…}, for instance, \p{Number} defines all possible characters representing digits (including symbols like ①), \p{Alphabetic} — letters (including hieroglyphs), \p{Math} — mathematical symbols, and so on.
- Flag causes the `.` mask to match newline characters as well.
- Mode allows you to specify in a regular expression that one pattern precedes another (for example, to match a dollar amount without capturing the dollar sign).
- CSS pseudoclasses have been implemented and to bind CSS rules to a set of selectors. For example, instead of
header p:hover, main p:hover, footer p:hover {…}
you can specify
:is(header, main, footer) p:hover {…}
- CSS pseudoclasses have been included and to bind to form elements (input or textarea) that are restricted or permitted for editing.
- Support for the method has been added to create localized lists (for example, replacing 'or' with 'или', 'and' with 'и').
const lf = new Intl.ListFormat(‘en’);
lf.format([‘Frank’, ‘Christine’, ‘Flora’]);
// → ‘Frank, Christine, and Flora’
// при локали «ru» будет ‘Frank, Christine и Flora’ - A function can be included in the method added support for formatting units of measurement, currencies, scientific and compact notations (for example, "Intl.NumberFormat(‘en’, {style: ‘unit’, unit: ‘meter-per-second’})").
- A method has been added , allowing you to replace or clear existing child nodes.
- The ESR branch includes support for Service Worker and Push API (which were disabled in the previous ESR release).
- In WebAssembly, support has been added for importing and exporting 64-bit integer function parameters using the JavaScript type BigInt. An extension has also been implemented for WebAssembly , functions to return multiple values.
- In the web developer console detailed logging of errors related to Promises, including information about names, stacks, and properties, which greatly simplifies debugging errors when using frameworks like Angular.
- In the web developer tools, significant performance improvements have been made for navigating the DOM when inspecting sites that use a lot of CSS properties.
- In the JavaScript debugger, the ability to reveal shortened variable names based on the source map has been implemented when using (Log points), allowing information about the line number in the code and variable values to be output to the web console when a breakpoint is hit.
- The network inspection interface now includes information about add-ons, tracking protection mechanisms, and CORS restrictions (Cross-Origin Resource Sharing) that caused the request to be blocked.
In addition to new features and bug fixes in Firefox 78
has been closed , some of which are marked as critical, meaning they could allow an attacker to execute code by opening specially crafted pages. Currently, detailed information about the fixed security issues is not available, but the list of vulnerabilities is expected to be released within a few hours.
Source: opennet.ru
