The release of the web browser Firefox 108 has taken place. Additionally, an update for the long-term support branch — 102.6.0 — has been formed. The Firefox 109 branch will soon enter the beta testing phase, with its release scheduled for January 17.
Key innovations in Firefox 108:
- A keyboard shortcut, Shift+ESC, has been added for quick access to the process manager page (about:processes), allowing users to evaluate which processes and internal threads consume excessive memory and CPU resources.
- Frame output scheduling for animations under high load has been optimized, resulting in improved scores on the MotionMark test.
- When printing and saving PDF forms, the ability to use characters in languages other than English has been provided.
- Support for accurate color correction of images has been implemented in accordance with ICCv4 color profiles.
- The behavior of the 'show bookmarks panel only on new tabs' mode (setting 'Only show on New Tab') has been corrected for empty new tabs.
- Settings cookiebanners.bannerClicking.enabled and cookiebanners.service.mode have been added to about:config for automatically clicking on banners requesting cookie usage permissions on websites. In the interface of nightly builds, toggles have been implemented to manage auto-clicking on cookie banners tied to specific domains.
- The Web MIDI API has been added, allowing web applications to interact with user-connected MIDI musical devices. The API is only available for pages loaded via HTTPS. When calling the method navigator.requestMIDIAccess() with connected MIDI devices, a dialog will prompt the user to install the 'Site Permission Add-on' necessary for access (see description below).
- An experimental Site Permission Add-on mechanism has been proposed to manage website access to potentially dangerous APIs and capabilities that require elevated privileges. Dangerous capabilities are those that can physically damage equipment, make irreversible changes, be used to install malicious code on devices, or lead to user data leaks. For example, in the context of the Web MIDI API, the Permission Add-on is used to provide access to a sound synthesis device connected to a computer.
- By default, support for import maps is enabled, allowing management of which URLs will be loaded when importing JavaScript files via import and import() expressions. The import map is specified in JSON format within a element with the new attribute 'importmap'. For example: { "imports": { "moment": "\/node_modules\/moment\/src\/moment.js", "lodash": "\/node_modules\/lodash-es\/lodash.js" } }
After declaring this import map in JavaScript code, you can use the expression 'import moment from "moment";' to load and execute the JavaScript module "\/node_modules\/moment\/src\/moment.js" without specifying the path (equivalent to 'import moment from "\/node_modules\/moment\/src\/moment.js";').
- The element now supports the 'height' and 'width' attributes, which define the height and width of an image in pixels. These attributes only take effect when the element is nested inside a element and are ignored when nested inside
- CSS now provides a set of trigonometric functions: sin(), cos(), tan(), asin(), acos(), atan(), and atan2().
- CSS implements the round() function to choose a rounding strategy.
- CSS has introduced the type, allowing the use of well-known mathematical constants, such as Pi and E, as well as the values for infinity and NaN in mathematical functions. For example, "rotate(calc(1rad * pi))".
- The CSS query '@container', which allows for styling elements based on the size of their parent element (similar to the '@media' query that applies not to the size of the entire viewport, but to the size of the block (container) into which the element is placed), has been added with experimental support for units cqw (1% of width), cqh (1% of height), cqi (1% of inline size), cqb (1% of block size), cqmin (the smallest value between cqi or cqb), and cqmax (the largest value between cqi or cqb). By default, this feature is disabled and can be enabled through the layout.css.container-queries.enabled parameter in about:config.
- In JavaScript, the method Array.fromAsync has been added to create an array from asynchronously incoming data.
- The HTTP header CSP (Content Security Policy) has added support for the directives 'style-src-attr', 'style-src-elem', 'script-src-attr', and 'script-src-elem', which provide functionality for style and script directives but can be applied to individual elements and event handlers such as onclick.
- A new event domContentLoaded has been introduced, triggered after the content loading is complete.
- The .get() method now includes the forceSync option for forced synchronization.
- A separate panel area has been implemented for placing WebExtension widgets.
- The logic of the blacklist for Linux drivers incompatible with WebRender has been changed. Instead of maintaining a whitelist of working drivers, a transition has been made to a blacklist of problematic drivers.
- Support for the Wayland protocol has been enhanced. Handling of the XDG_ACTIVATION_TOKEN environment variable with an activation token for the xdg-activation-v1 protocol has been added, allowing one application to focus on another. Issues occurring when moving bookmarks with the mouse have been resolved.
- Animation for the panel has been enabled on most Linux systems.
- In about:config, the gfx.display.max-frame-rate setting has been provided to limit the maximum frame refresh rate.
- Support for Emoji 14 character specifications has been added.
- The WebGL extension OES_draw_buffers_indexed is enabled by default.
- The capability to use the GPU for accelerating Canvas2D rasterization has been implemented.
- On the Windows platform, process sandboxing for GPU-interacting processes has been enabled.
- Support for SIMD instructions FMA3 (fused multiply-add with single rounding) has been added.
- The processes used to handle background tabs on the Windows 11 platform now run in 'Efficiency' mode, where the task scheduler lowers the execution priority to reduce CPU resource consumption.
- Improvements in the Android version:
- The ability to save a web page as a PDF document has been added.
- Tab grouping support has been implemented in the toolbar (tabs can be rearranged by long-pressing on the tab).
- A button has been provided to open all bookmarks from a specified section in new tabs in a new window or in incognito mode.
In addition to new features and bug fixes, Firefox 108 has resolved 20 vulnerabilities. 16 of these vulnerabilities are marked as critical, of which 14 issues (grouped under CVE-2022-46879 and CVE-2022-46878) are related to memory handling problems, such as buffer overflows and access to already freed memory areas. These issues could potentially allow for the execution of malicious code when opening specially crafted pages. The vulnerability CVE-2022-46871 relates to using code from an outdated version of the libusrsctp library, which contains unpatched vulnerabilities. The vulnerability CVE-2022-46872 allows an attacker who gains access to the page processing process to bypass sandbox isolation in Linux and read the contents of arbitrary files through manipulation of IPC messages associated with the clipboard.
Source: opennet.ru
