Firefox 148.0

Added an AI Controls section to Settings for managing AI-enhanced features. Learn more .

Firefox now has improved support for screen readers accessing mathematical formulas embedded in PDFs .

Remote improvements are now decoupled from telemetry requirements in Firefox Settings. You can now opt into receiving remote browser changes even if you have opted out of sharing telemetry or participating in our experimental studies.

Firefox Backup is now available on Windows 10 to users who also use the “Clear history when Firefox closes” capability. Backups will not include any data which is set to be cleared when Firefox is closed.

The following languages are now available for translation : Translation into and from Traditional Chinese.

New Tab wallpapers will now appear on new container tabs as well as new default tabs.

Fixed an issue where a language pack could become disabled after a major update, causing Firefox to display in the wrong language.

On Windows, dragging a downloaded image to Adobe Illustrator now correctly inserts the image instead of its URL.

Various security fixes .

Firefox now supports the Sanitizer API , which provides new methods for HTML manipulation. The element.setHTML() method enables developers to insert HTML content similarly to element.innerHTML , but without the security vulnerabilities such as cross-site scripting (XSS). A complementary method, document.parseHTML() , is also available for parsing HTML safely.

Developer Information

With the release of Firefox 148, we are pleased to welcome the developers who contributed their first code change to Firefox in this release, 18 of whom were brand new volunteers! Please join us in thanking each of these diligent and enthusiastic individuals, and take a look at their contributions: Charlotte Wilson [:cswilson252]: 1774438

Document Picture-in-Picture API (Nightly): dom.documentpip.enabled The Document Picture-in-Picture API makes it possible to open an always-on-top window that can be populated with arbitrary HTML content such as a video with custom controls or a set of streams showing the participants of a video conference call. ( Firefox bug 1858562 ).

Custom media queries : layout.css.custom-media.enabled The @custom-media CSS at-rule defines aliases for long or complex media queries. Instead of repeating the same hardcoded <media-query-list> in multiple @media at-rules, it can be defined once in a @custom-media at-rule and referenced throughout the stylesheet whenever needed. ( Firefox bug 2004653 ).

The initial about:blank document is now Web-compatible. If the first navigation of a browsing context goes to about:blank , it completes synchronously and is no longer replaced by a second parser-generated document.

Service worker support for WebGPU has been added, making it available in all worker contexts. Service workers allow WebGPU to run in the background, which is particularly useful for extensions and other pages that can meaningfully share resources across multiple tabs and time periods.

Firefox now supports the Iterator.zip() and Iterator.zipKeyed() methods from the joint iteration proposal. This allows zipping together underlying iterators into an iterator over values grouped by position, similar to zip in many other languages.

Firefox now supports the Trusted Types API , which is primarily aimed at preventing cross-site scripting attacks.

Firefox now supports the location.ancestorOrigins attribute.

Firefox now supports the NavigationPrecommitController.addHandler() interface of the Navigation API . This allows registering a post-commit navigation handler during the pre-commit phase, to allow a multi-step navigation process.

Firefox now supports the position-try-order property as part of CSS Anchor Positioning , controlling the order of fallback positioning attempts.

Firefox now supports the CSS shape() function, which allows defining responsive free-form shapes in properties that take shapes like clip-path . Unlike path() , it uses standard CSS syntax, supports various CSS units, and allows mathematical functions.

The initial about:blank document now loads synchronously. A browsing context's first navigation may resolve to about:blank (for example, when the initial URL is empty or explicitly set to about:blank ). In these cases, Firefox no longer replaces the initial empty document with a second, asynchronously loaded one, and instead fires the load event synchronously on the initial document. ( Firefox bug 543435 ).

The position-area property in CSS anchor positioning now correctly keeps the anchored element within the viewport. ( Firefox bug 2008537 ).

The position-try-order property in CSS anchor positioning is now supported and allows changing the order in which position fallback options are tried based on the space available. This also affects the position-try shorthand property. ( Firefox bug 1989059 ).

The overflow , overflow-x , and overflow-y CSS properties can now be used on replaced elements such as images, in the same way that they are used with other elements. Prior to this, replaced elements were always clipped to their bounding container. ( Firefox bug 1999100 ).

The CSS shape() function is now available by default. shape() is a <basic-shape> data type that enables you to define a shape in the clip-path and offset-path properties using one or more "shape commands". These commands are very similar to the SVG path commands . The shape() function is similar in some respects to the path() function, but unlike path() , which uses the SVG path syntax, shape() uses standard CSS syntax. This allows you to use CSS units and CSS math functions, which makes it easy to create and edit shapes. ( Firefox bug 1982941 ).

The Iterator.zip() and Iterator.zipKeyed() static methods are now supported. These "zip" together multiple input iterators, returning a new iterator that yields the group of input elements at each iteration step. They are useful when you need to combine data from multiple input iterators that are positionally aligned (the first value yielded by the first iterator corresponds to the first value yielded by the other iterators, and so on). ( Firefox bug 2003333 ).

The TC39 Legacy RegExp features in JavaScript proposal has been implemented. This updates RegExp.prototype.compile() so that a TypeError is thrown if it is called on a subclass of RegExp , or if the method is called on a RegExp that was defined in a different realm. RegExp static properties, such as RegExp.$1 – RegExp.$9 and RegExp.input (and its alias RegExp.$_ ), are normalized to be configurable and non-enumerable. In particular this means that they can be deleted from the RegExp object. ( Firefox bug 1306461 ).

The HTML Sanitizer API is now supported, along with related methods like setHTML() . This allows you to sanitize HTML before inserting it into the DOM, giving you full control over the resulting content, and reducing the risk of XSS attacks. ( Firefox bug 1650370 ).

The Trusted Types API is now supported. This provides mechanisms to ensure that properties and functions that can potentially be used as vectors for XSS attacks are only able to be called with data that has been passed through a transformation function. The mechanisms allow auditing of unsafe uses of code. They don't mandate how the data is transformed, but might, for example, be used to sanitize unsafe HTML elements from user-provided strings. ( Firefox bug 1994690 ).

The Location.ancestorOrigins property is now supported, which enables you to determine whether a document is being embedded in an <iframe> and, if so, by which site(s). ( Firefox bug 1085214 ).

The movementX and movementY properties on the pointerrawupdate event are now populated when the pointer is moved — previously these were set to zero. ( Firefox bug 1987671 ).

The NavigationPrecommitController.addHandler() method of the Navigation API is now supported. This can be used to dynamically register a post-commit navigation handler inside a pre-commit handler, which is useful when the actions of the committed navigation depend on data fetched in the pre-commit phase. ( Firefox bug 2009004 ).

The "paste" command can now be used with Document.execCommand() in web content (in addition to web extensions). This is implemented using the Clipboard API and shares the same Security considerations , such as requiring transient activation and user acknowledgement when pasting cross-origin content. ( Firefox bug 1998195 ).

Fixed a race condition during initialization of required browser features when opening a new window, preventing issues when navigating immediately to another URL ( Firefox bug 1891028 ).

Fixed an interoperability issue between Marionette and WebDriver BiDi where the BiDi clientWindow ID was incorrectly used as a window handle in Marionette ( Firefox bug 2002949 ).

Added initial support for interacting with the browser's chrome scope (the Firefox window itself). The browsingContext.getTree command now accepts the vendor specific moz:scope parameter and returns chrome contexts when set to chrome and Firefox was started with the --remote-allow-system-access argument. These contexts can be used with script.evaluate and script.callFunction to execute privileged JavaScript with access to Gecko APIs. Other commands do not yet support chrome contexts, but support will be added incrementally as needed ( Firefox bug 1944568 , Firefox bug 1944570 , and Firefox bug 1851788 ).

Updated the emulation.setGeolocationOverride and emulation.setScreenOrientationOverride commands to implement the new reset behavior: contexts are reset only when the contexts parameter is provided, and user contexts only when the userContexts parameter is specified ( Firefox bug 1998732 and Firefox bug 1998734 ).

Fixed a race condition in browsingContext.create where opening a new tab in the foreground could return before the document became visible ( Firefox bug 2003857 ).

Fixed an issue that occurred when a navigation redirected to an error page ( Firefox bug 2013822 ).

Fixed an issue in network.getData that caused a RangeError when decoding chunked response bodies due to a size mismatch ( Firefox bug 2004973 ).

Fixed an issue where the browsingContext.userPromptOpened and browsingContext.userPromptClosed events incorrectly reported the top-level context ID instead of the iframe's context ID ( Firefox bug 1964905 ).

Improved the performance of WebDriver BiDi commands by approximately 100 ms when the selected context is no longer available during the command execution ( Firefox bug 1934326 ).

Added the Reporting:GenerateTestReport command to generate a test report via the Reporting API ( Firefox bug 1909662 ).