Firefox reduces browser fingerprint uniqueness after large user study
Protections in Firefox 145, measured with nearly 25 million users, cut unique fingerprints; a CCS 2026 paper documents the method.
Stories per day · 30 days
5 RSS
Relatedmozilla16emudhra9certificate-authority8chrome7openai6tls6gpt-65linux-kernel5pki4browser3browser-extensions3crypto-wallets3glm3privacy3thunderbird3bonto2credential-theft2firefox-esr2
47 stories, newest first · one card per story
Stories tagged #firefox
Microsoft patches nearly 1,100 flaws, including exploited Outlook bug
CVE-2026-124194 is the only flaw Microsoft says is already exploited; 63 of this month's fixes are rated critical.
Firefox free VPN drops its 50GB monthly cap until January 31
Signed-in desktop and Android users in supported regions get unlimited in-browser VPN traffic through that date.
Datasette stops serving link: rel=next headers to Firefox for HTML pages
Fix for #3046 prevents unnecessary prefetch requests to the next table page in Firefox.
OpenAI releases GPT-6 Cyber, rated Critical for cyber capability
Access starts with approved Daybreak Red customers after OpenAI said the model stayed in scope over 99 percent of the time.
1
Firefox before 159.0.1 affected by vulnerability fixed in 159.0.1
Canada's Cyber Centre urges users to review Mozilla's links and apply updates as they become available.
Firefox Q3 2026 Security and Privacy Newsletter Released
Details faster releases, new privacy protections like Containers and iOS ad blocking, plus LLM-assisted bug detection.
Mozilla plans staggered Firefox fixes to blunt AI patch-gap attacks
Mozilla says it now ships weekly, withholds regression tests, and will stagger sandbox-layer fixes so their patch windows do not overlap.
Essay argues open-weight models have not caused a cyber step change
The author says a leaked Claude Mythos would have accelerated incidents, not collapsed infrastructure, and cites GLM-5.3 a month after release.
1
GLM 5.3 built Firefox exploit chains from public patch gaps
Epoch AI says each successful chain cost about $1,000 and Mozilla fixed the rediscovered bug in Firefox 159.0.
Malicious Firefox extensions impersonate Phantom, Jupiter, and Bitget
Socket says the add-ons stole recovery phrases and private keys; the Phantom copy sent secrets to Telegram and moved funds.
1
Mozilla advisory AV26-1100 covers Firefox, ESR and Thunderbird flaws
Canada’s Cyber Centre lists builds before Firefox 159, ESR 115.44 and 153.6, and matching Thunderbird versions.
Chrome 156 and Firefox 159 patch more than 200 flaws
CVE-2026-118306 can run arbitrary code outside Chrome's sandbox from a crafted HTML page; no in-the-wild exploitation is mentioned.
Malicious Firefox extensions impersonated Phantom, Jupiter, and Bitget
Socket says the removed listings sent recovery phrases to bonto.io, and Phantom’s package included a multi-chain drainer.
1
Chrome 156 and Firefox 159 patch critical memory-safety flaws
Google shipped 52 fixes, four rated Critical, and Mozilla fixed 167 bugs; both credited AI-assisted bug finding.
Researcher bypasses six of eight popular SVG sanitizers
Namespace tricks, animated JavaScript URLs and XSLT data URLs execute script, including via a Firefox response header.
Firefox Smart Window adds AI form filling and webpage monitoring
The US and Canada desktop beta sends selected open-tab text to Google’s Gemini 3.1 Flash Lite.
SecPRBench measures agentic security review on real bug-introducing commits
Recall spans 32.5% to 78.1% across eight frontier models on 265 tasks from nine systems, led by Grok 4.6 and GPT-6 sol.
Firefox 153 ESR still trusts Comodo AAA, list reply says
Jakub Wilk says his Firefox 153 ESR still trusted the Comodo AAA certificate despite Mozilla bug 1957685.
Browsers block eMudhra intermediate CAs with recoverable private keys
Eight April 2025 intermediates used near all-zero keys; browsers blocked them between October 17 and October 20.
Google and Mozilla revoke eight eMudhra intermediates after weak keys
Keys were trivially recoverable from public certificates; Google saw no chaining TLS certificates in CT logs before blocking.
2
Firefox will keep security-fix tests private for a week after release
Sec-high and sec-moderate fixes must ship without tests until the Tuesday after a Tuesday release.
Mozilla, Google and Apple block compromised eMudhra certificates
Eight April 2025 intermediates used private keys smaller than 256; no abuse is evidenced, but many trust stores needed updates.
eMudhra intermediate CA key compromise triggers browser blocks
Eight intermediates chaining to major browser roots were blocked; attacks on users are not confirmed.
1