firefox-140.0

[Bruce Dubbs]

New ESR.

[zeckma]

My biggest concern with this series is QA testing. It's been apparent that the newer releases just don't have QA testing done. It's been reported that they run like garbage on all sorts of hardware and operating systems. We really should test a good number of test cases for this, or update to 128.12.0. I will do some testing myself before taking on this ticket.

[Joe Locash]

I've been running 140.0 for over 24 hours now and haven't noticed any issues. gjs isn't ported to spidermonkey-140 yet though.

Edited to add: on a 12.3 system this requires nss-112 and the icu seds are no longer needed to build.

[Joe Locash]

New:

• Vertical Tabs: You can now keep more — or fewer — pinned tabs in view for quicker access to important windows. Just drag the divider to resize your pinned tabs section.
• Custom Search Engines: Firefox now supports adding even more search engines. To add a custom engine, right-click a search field of a supported website and select “Add Search Engine”, or go to Settings > Search > Add (below the search shortcuts table) to manually enter a search URL.
• Firefox Extensions: Customize your toolbar with the option to remove the extensions shortcut, giving you more control over your browser. When the button is hidden, you can access the extensions panel again at any time from the Firefox menu by clicking the Extensions menu item.
• You can now unload tabs by right-clicking on a tab (or multiple selected tabs) and selecting "Unload Tab". This can speed up performance by reducing Firefox's memory and CPU usage.
• Full-Page Translations now prioritizes translating only the content near your current view, improving speed and responsiveness. Content outside your view is skipped unless you scroll to it, reducing unnecessary resource usage.
• Firefox builds in Arabic now come with a built-in Arabic dictionary for the Firefox spellchecker.
• Address autofill enabled for users in Italy, Poland, and Austria.

Security fixes: ​https://www.mozilla.org/en-US/security/advisories/mfsa2025-51/

• CVE-2025-6424: Use-after-free in FontFaceSet (high)
• CVE-2025-6425: The WebCompat WebExtension shipped with Firefox exposed a persistent UUID (moderate)
• CVE-2025-6426: No warning when opening executable terminal files on macOS (moderate)
• CVE-2025-6427: connect-src Content Security Policy restriction could be bypassed (moderate)
• CVE-2025-6428: Firefox for Android opened URLs specified in a link querystring parameter (moderate)
• CVE-2025-6429: Incorrect parsing of URLs could have allowed embedding of youtube.com (moderate)
• CVE-2025-6430: Content-Disposition header ignored when a file is included in an embed or object tag (moderate)
• CVE-2025-6431: The prompt in Firefox for Android that asks before opening a link in an external application could be bypassed (low)
• CVE-2025-6432: DNS Requests leaked outside of a configured SOCKS proxy (low)
• CVE-2025-6433: WebAuthn would allow a user to sign a challenge on a webpage with an invalid TLS certificate (low)
• CVE-2025-6434: HTTPS-Only exception screen lacked anti-clickjacking delay (low)
• CVE-2025-6435: Save as in Devtools could download files without sanitizing the extension (low)
• CVE-2025-6436: Memory safety bugs fixed in Firefox 140 and Thunderbird 140 (high)

Changed:

• The Pocket toolbar icon, as well as the Pocket integrations on New Tab, have been removed per the service shutdown announcement.

[zeckma]

Replying to Joe Locash:

I've been running 140.0 for over 24 hours now and haven't noticed any issues. gjs isn't ported to spidermonkey-140 yet though.

Edited to add: on a 12.3 system this requires nss-112 and the icu seds are no longer needed to build.

I can confirm the same! Did some stress testing and I haven't found any issues myself. No seds were necessary.

[zeckma]

It should also be noted that there is an AI chatbot tab that can be opened, built-in to Firefox. It can be opened via ctrl+alt+x. The models themselves are remote, stuff like ChatGPT. It has to be an explicit action to open up the feature. But it is a new feature nonetheless.

[Xi Ruoyao]

Let's separate spidermonkey out. gjs must be adapted before upgrading spidermonkey.

[zeckma]

Fixed at 8fceb31f3598b966f57e1bc6b24a8f94f8a7069e. Will close once SA has been issued.

[zeckma]

SA-12.3-064 issued.

[zeckma]

The SA skips the MacOS and Android specific security fixes.