Firefox Enterprise Adds DLP and AI Controls to Block Sensitive Data Leaks

Mozilla released Firefox Enterprise 158.0 on October 13, 2026, introducing its first dedicated enterprise browser with built-in data loss prevention and AI-use controls.

The browser combines Firefox with a self-hosted Admin Console, giving security teams central control over browsing, web access, and how employees share company data. According to Mozilla’s Firefox Enterprise release notes, organizations must deploy the console on their own infrastructure.

Supporting services, including browser updates, Sync, telemetry, and crash collection, also run within the organization’s environment. This setup keeps management data under company control rather than relying on an external management service.

The main addition is DLP, which lets administrators block or warn about pasting, file uploads, downloads, and printing on selected websites.

Teams can display custom messages explaining restrictions. For example, they can block employees from pasting company information into unapproved AI tools while keeping approved services available.

Firefox Enterprise Adds DLP and AI Controls

Built-in checks run locally in the browser, so content doesn’t travel over the network for inspection. Organizations using a third-party DLP agent through Firefox’s Content Analysis interface retain that setup.

Firefox Enterprise turns off its built-in DLP and hands inspection to the existing agent. Warnings and blocks appear in the Admin Console, though administrators can turn off that logging.

The focus on browser data controls comes as AI tools create new exposure risks. Cyber Security News previously covered the BioShocking AI browser attack, where researchers manipulated browsing context to make AI agents expose sensitive information. Firefox’s release notes describe controls over data movement, not a specific fix for that attack.

Employees must sign in through the company’s single sign-on provider before browsing. Firefox Enterprise supports OpenID Connect and follows the provider’s multi-factor authentication requirements.

Administrators can also require device security conditions, including disk encryption and running endpoint protection, before allowing access. Firefox signs employees out if their device no longer meets those conditions.

Profile encryption is enabled by default. Browsing history, form data, saved logins, and TLS session tokens are encrypted using a key supplied by the Admin Console.

A copied profile folder cannot be decrypted without that key. Optional watermarks can show an employee’s email address and the time on sensitive pages, helping trace shared images without physically preventing screenshots.

The console supports more than 130 enterprise policies, including restrictions on extensions and update controls. These controls address risks highlighted in earlier reporting on AI browser extension vulnerabilities that exposed private sessions and data. Lockdown Mode can disable JavaScript JIT compilation, block service workers, prevent HTTP downgrades, and isolate selected sites.

Security event logging is optional for each event type, with records sent to the organization’s console rather than Mozilla. Teams can integrate with SIEM systems and remotely sign out lost devices. Firefox Enterprise also inherits security fixes from Firefox 158, while access requires a deployed console and an early-access request.

An EDR alert reveals an attack. But can it tell the full story? Discover how to reconstruct the attack timeline.