Firefox 128 Release

The release of the Firefox 128 web browser has taken place. Firefox 128 falls under the category of extended support release (ESR) branches, with updates released over the course of a year. Additionally, an update for the previous extended support release branch—115.13.0—has been formed (two more updates, 115.14 and 115.15, are expected in the future). The Firefox 129 branch has entered beta testing, with a release scheduled for August 6.

Key features in Firefox 128:

• Support has been added for translating selected text fragments on the page (previously, only full page translation was supported). The translation feature can be triggered via the context menu, which appears when right-clicking on the selected block. The built-in translation system in Firefox performs translations on the user's local system without relying on external cloud services. This system is based on the open-source Bergamot engine, which serves as a wrapper over the Marian machine translation framework that utilizes a recurrent neural network (RNN) and transformer-based language models.
• A new simplified and unified dialog for clearing user data has been proposed, improving the categorization of data and adding details about the size of data saved over the selected time period.
  
• In the dropdown window shown while typing in the address bar, in addition to recommended links, recently performed and trending search queries are displayed. This feature is currently enabled only for users in the USA and Canada.
• A widget for displaying the weather forecast has been added to the page that appears when a new tab is opened. Configuration options to enable the widget are provided in about:config with settings for browser.newtabpage.activity-stream.showWeather and browser.newtabpage.activity-stream.system.showWeather.
• In private browsing mode, the option to play protected content from streaming services like Netflix has been provided.
• When using a proxy with the SOCKS5 protocol, the sending of DNS queries through the proxy is enabled by default. For SOCKS4, DNS queries are still sent through the local resolver.
• On-the-fly rendering of various types of content with MIME types text/* is enabled without the need to pre-load such files before viewing.
• The root certificate used for verifying browser extensions and content signed by Mozilla has been updated.
• Support has been added for the experimental IPA (Interoperable Private Attribution) API, which allows ad networks to collect and process statistics on the effectiveness of ad campaigns while maintaining user privacy. To prevent the disclosure of individual user data during statistics processing, cryptographic mechanisms such as differential privacy and multi-party computation (MPC) are employed, enabling independent participants to perform computations without accessing each other's data (websites, browsers, and advertisers individually do not have access to all information) and to perform operations on encrypted data. The API is available in 'origin trial' mode and can be disabled in privacy settings under 'Website Advertising.'
• Support has been added for resizing ArrayBuffer objects and for increasing the size of SharedArrayBuffer objects, allowing the size of ArrayBuffer to be changed without creating a new buffer and transferring data into it. New methods ArrayBuffer.prototype.resize() and SharedArrayBuffer.prototype.grow() have been proposed.
• The WebRTC API has been updated with the setCodecPreferences method, which allows certain codecs to be disabled during connection negotiation and also enables the order of codec preferences to be changed.
• Values in the HTTP Accept header sent server when requesting documents and images have been aligned with the Fetch API specification and are closer to the behavior of other browsers. The header now sends 'text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/png,image/svg+xml,*/*;q=0.8' (compared to the previous version, 'image/png' and 'image/svg+xml' have been added).
• Support for the HTTP header 'Priority' has been added, which allows the transmission of information about the priority of request processing (RFC 9218) during the first access to a resource.
• Support has been added for the CSSPropertyRule interface, the CSS @property rule, and the registerProperty() method, allowing the registration of custom CSS properties with inheritance, type checking, and default values.
• CSS provides the ability to specify relative values when defining colors. For example, to obtain blue, one can specify "rgb(from red 0 0 255)".
• The CSS property "content" now includes the option to define alternative text for content that includes an image.
• The methods Request.bytes(), Response.bytes(), PushMessageData.bytes(), and Blob.bytes() have been added, allowing the formation of a typed Uint8Array from Request, Response, PushMessageData, and Blob objects.
• The method MediaKeys.getStatusForPolicy() has been added to retrieve information about the CDM module used for decrypting protected DRM content.
• When enabling the setting "image.jxl.enabled" in about:config, the MIME type image/jxl is passed in the Accept header, indicating support for processing images in the JPEG XL format.
• Experimental support for the CHIPS (Cookies Having Independent Partitioned State) technology has been added, allowing cookies to be isolated within the first-party context using a new attribute "Partitioned." domain In normal conditions, third-party code from site "C," embedded on sites "A" and "B," can process cookies shared between those sites. However, when specifying the "Partitioned" attribute, cookies set by site "C" will be completely isolated when loading code from sites "A" and "B." An option has been added in about:config to enable this: network.cookie.CHIPS.enabled.
• In the web developer tools, hovering the cursor over a CSS rule selector now displays a tooltip with information about the specificity of the CSS rule, helping to understand why a given CSS rule is applied before another rule.
• In the inspection panel, incorrect applications of custom CSS properties are now highlighted if their definitions do not match the used values. For example, the situation below is marked where a color is specified instead of a size in the property "—b":
• On the macOS platform, for recording audio from the microphone using the API getUserMedia, the system's provided audio processing engine is utilized to achieve higher quality.
• In the Android version, on devices with Android 14 and newer versions, the creation and use of Passkey keys in third-party passwordless authentication management applications using biometric identifiers such as fingerprint or facial recognition have been permitted.

In addition to new features and bug fixes, Firefox 128 addresses 20 vulnerabilities. Eight of these vulnerabilities are rated as critical, with six related to memory management issues like buffer overflows and accessing freed memory areas. These problems could potentially allow an attacker to execute code by opening specially crafted web pages.

Source: opennet.ru