release of the web browser , as well as Firefox 68.7 for the Android platform. Additionally, an update has been created. with long-term support . Soon moving to the stage of The Firefox 76 branch will transition, with a release scheduled for May 5 (project for 4-5 weeks) ).
:
- For Linux, the formation of in Flatpak format has begun.
- The address bar design has been updated. Now, when clicking on the address bar, a dropdown list of the most frequently used links appears without needing to start typing. The search result suggestions have been optimized for better performance on smaller screens. In the context recommendation area, tips for resolving typical browser issues are displayed.
The display of the https:// protocol and the subdomain 'www.' in the dropdown link block shown while typing in the address bar has been discontinued (for example, links with different content such as https://opennet.ru and https://www.opennet.ru will become indistinguishable). The http:// protocol is displayed in search results unchanged.
- For Linux, the behavior when clicking in the address bar has been changed (to match Windows and macOS) — a single click selects all content without copying it to the clipboard, a double click selects a single word, and a triple click selects all content and copies it to the clipboard.
- If the user refreshes the page in private browsing mode, Firefox will interpret this as a problem and suggest images that are not in the visible area will not be loaded until the user scrolls the page to the location just before the image. To manage lazy loading on pages, an attribute '' has been added to the 'img' tag, which can take the value 'lazy.' It is expected that lazy loading will help reduce memory consumption, lower traffic, and increase the speed of page loading. A parameter 'dom.image-lazy-loading.enabled' has been added to about:config to manage lazy loading.
- full support for WebGL in environments using the Wayland protocol. Until now, the performance of WebGL in Linux builds of Firefox has been lacking due to the absence of hardware acceleration, resulting from issues with gfx drivers for X11 and the application of different standards. With the use of Wayland, the situation has improved thanks to the emergence of a new , utilizing the mechanism . In addition to hardware acceleration, the WebGL backend has also support for H.264 video decoding acceleration using VA-API (Video Acceleration API) and FFmpegDataDecoder (support for VP9 and other video encoding formats in Firefox 76). For managing the enabling of acceleration in about:config, the parameters "widget.wayland-dmabuf-webgl.enabled" and "widget.wayland-dmabuf-vaapi.enabled" are provided.
- For users in the UK, the display of paid sponsor blocks on the homepage in the content recommended by Pocket is enabled. The blocks are clearly marked as ads and can be disabled in the settings. Previously, ads were available only to users in the US.
- a mode to clear old cookies and site data when accessing sites with tracking codes that the user did not interact with. The mode is aimed at combating tracking through redirects.
- of modal dialogs tied to individual tabs without blocking the entire interface.
- the ability to install and open websites as applications (Apps), allowing users to organize their work with the site like a regular desktop application. To enable in about:config, it is necessary to add the setting "browser.ssb.enabled=true", after which the context menu for page actions (three dots in the address bar) will include the "Install Website as App" option, allowing a shortcut for separately opening the current site on the desktop or in the apps menu. Development the development of the concept of '' (SSB), which implies opening a site in a separate window without menus, an address bar, and other elements of the browser interface. Only links to pages of the active site open in the current window, while clicking on external links leads to the creation of a separate window with a regular browser.
- implementation of the "" mode activated via the HTTP header "X-Content-Type-Options", which now also disables the logic of automatic MIME type detection for HTML documents, not just for JavaScript and CSS. The mode helps protect against attacks related to MIME type manipulation. The browser by default analyzes the type of content being processed and handles it based on the specified type. For example, if HTML code is saved in a ".jpg" file, when opened, this file will be processed as HTML, not as an image. An attacker can use an image upload form for a jpg file containing HTML with JavaScript code, after which they can publish a link to this file, and when directly opened, the JavaScript code will execute in the context of the site the upload was made to (allowing them to access cookies and other site-associated user data of the person opening the link).
- Local caching of all trusted PKI certificates from certificate authorities recognized by Mozilla has been ensured, improving compatibility with improperly configured web servers.
- The use of the Web Crypto API is prohibited on pages opened over unencrypted HTTP.
- A direct composition mode has been implemented for Windows, enhancing performance and bringing the compositing system closer to implementation. , written in Rust and offloading rendering operations to the GPU.
- An experimental feature has been implemented for macOS allowing the use of client certificates from the operating system's shared certificate store (to enable this in about:config, the option security.osclientcerts.autoload must be activated). This feature was available only for Windows starting from Firefox 72.
- Following Linux, the isolation mechanism has been utilized in builds for macOS, , aimed at blocking the exploitation of vulnerabilities in third-party function libraries. At this stage, isolation is enabled only for the library , responsible for rendering fonts. RLBox compiles the C/C++ code of the isolated library into low-level WebAssembly intermediate code, which is then packaged as a WebAssembly module with permissions specified only for that module. The compiled module operates in a separate memory space and has no access to the rest of the address space. In the event of a vulnerability being exploited in the library, the attacker will be restricted and unable to access the main process's memory areas or transfer control outside the isolated environment.
- The 'type' attribute in the element can now only accept the value 'text/css'.
- Functions have been implemented in CSS , and .
- For the CSS property supporting the value 'all', which mandates a mandatory line break for underlining and strikethrough when crossing text glyphs (previously, the 'auto' value adaptively created breaks and did not exclude touches, whereas with 'all', touches with glyphs are completely prohibited).
- Support for for JavaScript class instances has been included, allowing predefined properties to be initialized outside the constructor.
class ClassWithStaticField {
static staticField = 'static field'
} - Support for the class has been added , which provides methods for parsing and processing locale parameters for language, region, and script, as well as for reading and writing Unicode extension tags and saving user locale settings in a serialized format;
- The Function.caller property implementation has been aligned with the latest draft of the new ECMAScript specification (instead of TypeError, now null is returned if the call is made from a function with the strict, async, or generator attribute).
- A method has been added to HTMLFormElement , which initiates programmatic form data submission similar to clicking a submit button. This function can be used when developing custom submit buttons, for which calling form.submit() is insufficient since it does not trigger interactive validation of parameters, generate a 'submit' event, or transmit data bound to the submit button.
- The submit event is now implemented by the SubmitEvent object rather than Event. SubmitEvent includes new properties that allow you to get the element that triggered the form submission. For example, SubmitEvent enables the use of a single handler shared across different buttons and links leading to form submission.
- Correct event propagation of the click event has been implemented when calling the click() method for detached elements (which are not part of the DOM tree).
- In the API The ability to bind animations to the initial or final keyframe has been added, and the browser will compute the final or initial state automatically (it is sufficient to specify only the first or last keyframe). By default, Animation.timeline getter, Document.timeline, DocumentTimeline, AnimationTimeline, Document.getAnimations(), and Element.getAnimations() are included.
- The ability to activate the page profiling interface without installing a separate add-on has been added, via the 'Enable Profiler Menu Button' button on the website . The mode for analyzing the performance of only the active tab has been added.
- The web console has introduced an instant expression evaluation mode, allowing developers to quickly identify and fix issues when entering complex expressions by outputting preliminary results as they type.
- In for measuring areas of the page (Measuring Tool) has added the ability to resize the rectangular frame (previously, if you released the mouse button, the frame could not be resized, and in case of imprecise targeting, one had to measure from scratch).
- The page inspection interface has introduced support for element search using XPath expressions in addition to the previously available search using CSS selectors.
- The ability to filter WebSocket messages using regular expressions has been added (previously only text masks were supported).
- JavaScript debugger now supports binding breakpoints to WebSocket event handlers.
- The interface for analyzing network activity has been cleaned up. The rendering of tables has been optimized for handling a large number of connections simultaneously. Column separators and buttons for applying filters have been made more contrasting. The network request blocking panel now allows the use of the '*' symbol in URL masks (enabling assessment of site behavior under resource loading failure conditions).
In addition to new features and bug fixes, Firefox 75 has addressed issues. , some of which are marked as critical, meaning they could allow an attacker to execute code by opening specially crafted pages. Currently, detailed information about the fixed security issues is not available, but the list of vulnerabilities is expected to be released within a few hours.
Source: opennet.ru
