The release of the web browser has taken place , as well as Firefox 68.9 for the Android platform. Additionally, an update has been formed. with long-term support . Soon moving to the stage of the branch Firefox 78 will transition, with the release scheduled for June 30.
:
- a new service page "about:certificate" for accessing the built-in certificate viewing interface. The interface allows you to display a list of root and saved certificates, view details for each certificate, and export certificates (import support is not yet available).
- Experimental support for AVIF image format (AV1 Image Format) has been added, utilizing intra-frame compression technologies from the AV1 video encoding format (supported since Firefox 55). To enable AVIF in about:config, there is an option image.avif.enabled. The container for distributing compressed data in AVIF is identical to HEIF. AVIF supports both images in HDR (High Dynamic Range) and wide-gamut color space, as well as in standard dynamic range (SDR).
- for which the compositing system is enabled , written in Rust and allowing for a significant increase in rendering speed and a decrease in CPU load. WebRender offloads the rendering operations of the page's content to the GPU, which are implemented through shaders running on the GPU. WebRender is now on hardware with , AMD Raven Ridge APU, AMD Evergreen, and on laptops with NVIDIA graphics cards running Windows 10. To force enable it in about:config, you should activate the settings "gfx.webrender.all" and "gfx.webrender.enabled" or launch Firefox with the environment variable MOZ_WEBRENDER=1.
- In the address bar, the parsing of search phrases. Words with a dot are now evaluated for relevance to (for example, previously entering keys like "test.log" led not to a search but to an attempt to open a site, while entering "data:url" with spaces and a question mark led to a search rather than loading).
- disabling the tracker blocking , requests for which in extensions do not lead to a notification about confirming new permissions during the installation or update of the extension, but are displayed when the extension directly invokes an operation that requires elevated rights. The permissions that can be declared as optional include management, devtools, browsingData, pkcs11.
proxy and session. The motivation for adding optional permissions is mentioned as a desire to reduce the burden on users when updating extensions and to enable updates without mandatory permission confirmation (previously, if a user disagreed with the permissions, the extension would not be updated). - For users in the United Kingdom on the new tab page the display of content recommended by the Pocket service. Previously, such pages only to users from the USA, Canada, and Germany. Content personalization related to recommendations is performed on the client side without transmitting user information to third parties (the entire list of recommended links for the current day is loaded into the browser, ranked based on browsing history). It should be noted that sponsored blocks are shown only in the USA and are clearly marked as advertisements; in other countries, sponsored articles are not yet used. To disable recommended Pocket content, there is a setting in the configurator (Firefox Home Content/Recommended by Pocket) and the option "browser.newtabpage.activity-stream.feeds.topsites" in about:config.
- In the configurator, a new item has been added to the cookie blocking methods dropdown in the tracking protection settings for dynamic cookie isolation based on the domain displayed in the address bar ("", where first and third-party inserts are determined based on the site's base domain). In about:config, the interface can be enabled via the setting "browser.contentblocking.reject-and-isolate-cookies.preferences.ui.enabled" or directly with "network.cookie.cookieBehavior = 5".
- To simplify navigation on touchscreen devices on the bookmarks bar (when opening a new tab, the new Megabar address bar partially overlaps the bookmarks bar, leaving little space for clicks).
- New modal dialogs are tied to individual tabs and do not block the entire interface. To control the binding of dialogs in about:config, options "prompts.defaultModalType", "prompts.modalType.confirmAuth", and "prompts.modalType.insecureFormSubmit" have been added (1 — content binding, 2 — tab binding, 3 — window binding).
- In about:config A new setting middlemouse.openNewWindow, which allows disabling the use of the middle mouse button to open links in a new tab.
- The setting browser.urlbar.update1.view.stripHttps (support for the setting browser.urlbar.trimURLs is retained).
- From the Gecko engine completely disabling the tracker blocking
XUL Grids. - By default, automatic rotation of JPEG images based on Exif data is enabled.
- The setting 'browser.urlbar.oneOffSearches' has been removed. To hide the buttons for alternative search engines that appear when you start typing in the address or search bar, you can select the necessary search engines on the page about:preferences#search.
- Text that exceeds the 'maxlength' limit is no longer truncated when pasted into and
- A method has been added (String#replaceAll), returns a new string (the original string is not changed) in which all matches based on the given pattern are replaced. Patterns can be either simple masks or regular expressions.
- The value of the label set using the 'label' attribute in the element is ensured to be displayed, if the content of the element is not filled.
- The property is implemented in IndexedDB .
- experimental support for layout in grid containers.
- In developer tools for assessing potential compatibility issues across different browsers (shows in which browsers certain CSS properties tied to the selected element are supported). It is enabled via the setting devtools.inspector.compatibility.enabled in about:config.
- A significant portion has been added into the JavaScript debugger. Loading times are faster and step-by-step debugging has been improved with reduced memory consumption. Code representation matching (source map) has been enhanced, allowing insight into variables from original source texts when debugging final modules. When clicking on a highlighted line in the Call Stack window and starting step execution (Step over, F10), the debugger will execute the code until it reaches the line following the highlighted one. A menu has been added to the panel (gear icon), which currently includes only one option to disable JavaScript. It is now possible to set conditional breakpoints (watchpoints) that pause execution when specific values are changed or read (previously you could only pause execution when reading or changing separately).
- A menu has been added to the network activity inspection interface that gathers log management functions (saving logs between website reloads, importing HAR files, recording HAR files). A context menu has been added to the request blocking panel ('Request Blocking') to enable, disable, and remove blocked items.
- support for FTP has been postponed until the release of Firefox 79, but an option to manage FTP activity (network.ftp.enabled in about:config) has already been added.
In addition to these innovations and bug fixes in Firefox 77, 9 vulnerabilities, of which 7 are classified as critical:
- Four vulnerabilities (grouped under and
) are caused by memory handling issues, such as buffer overflows and dereferencing freed memory areas. These problems potentially allow an attacker to execute code when opening specially crafted pages. - The vulnerability
CVE-2020-12406 is caused by a lack of type checking when deleting NativeTypes objects and could potentially be exploited to execute attacker code. - The vulnerability CVE-2020-12405 is caused by dereferencing a freed memory block (Use-after-free) in SharedWorkerService and is likely limited to causing a crash.
- The vulnerability CVE-2020-12399 relates to the NSS library being susceptible to side-channel attacks, an attacker to recover the private key for DSA digital signatures based on timing analysis.
Source: opennet.ru
