A corrective release of Firefox 125.0.2 is available, which disables the file download blocking feature from untrusted URLs introduced in the Firefox 125 branch. In some situations, this functionality led to the downloading of other files instead of the requested ones (for example, with the 'dom.block_download_insecure' setting enabled, attempting to download a CSV file would lead to downloading an HTML page instead). The dangerous download blocking mode is set to be improved and reactivated in one of the upcoming releases.
The release notes also mention another unusual issue that is planned to be addressed in the next update, Firefox 125.0.3, scheduled for April 30. The essence of the problem is that after updating to Firefox 125, some users experienced new tabs opening spontaneously with the URL 'https://0.0.0.1' in the address bar. This effect occurred only on the Windows platform. Investigation revealed that the tabs appear when trying to launch another instance of Firefox from the command line while Firefox is already running. Users who encountered this issue and did not launch new instances of Firefox themselves are advised to check their systems with antivirus software, as this activity could be the result of malware.
The appearance of a tab with the address 'https://0.0.0.1' was caused by a bug in the 'Application Launch Prefetcher' handler. In the Firefox 125 branch, when starting an additional process, the method nsWinRemoteClient::SendCommandLine is used, adding the option '/prefetch:1' to the command line, which during parameter parsing gets converted to '-prefetch 1'. The '-prefetch' parameter is subsequently ignored, and the remaining '1' is interpreted as a URL to open (equivalent to launching 'firefox.exe 1'), which leads to the attempt to open the site 'https://0.0.0.1'.
Source: opennet.ru
