Welcome to the Q3 2026 edition of the Firefox Security & Privacy Newsletter.

Security and privacy are core principles of Mozilla’s Manifesto and remain at the heart of Firefox’s development. This edition highlights key initiatives from Q3 2026 across three areas:

  • Firefox Security: New security features, platform improvements, hardening efforts, and security integrations in Firefox.
  • Firefox Privacy: New privacy features, enhanced protections, and privacy integrations in Firefox.
  • Community Engagement: Highlights from our security research community and bug bounty program.

Preface

Note: Some of the bugs linked below might not be accessible to the general public and restricted to specific work groups. We de-restrict fixed security bugs after a grace-period, until the majority of our user population have received Firefox updates. If a link does not work for you, please accept this as a precaution for the safety of all Firefox users.

Firefox Security

Rapid Releases, Now Even Faster: Since September 2026, Firefox has followed a faster release cycle, bringing improvements, including security fixes, to users more quickly. We also invite you to see and shape what’s next for Firefox, including upcoming security and privacy features.

Many recent releases have included more security fixes. We continue to use frontier LLMs to identify and fix security bugs in Firefox to always keep you safe online. We have also changed how we publish advisories: instead of grouping internally identified memory safety vulnerabilities under a single CVE, we now publish a separate advisory for each bug, anticipating a potential change to the CVE Numbering Rules. CVE counts alone are not a reliable measure of security, as software vendors are not required to assign CVEs to vulnerabilities they discover internally.

Know when your TLS is broken: Starting with Firefox 157, you will see warnings in the site information panel (the shield icon in the address bar) and in Settings when your connection may not be completely private. For example, if an administrator configures your Firefox to record its encryption keys, you will be able to catch that. Recording these keys could allow another software to read all of your encrypted web traffic without your knowledge.

Mozilla Root Store Policy v3.1: We are strengthening transparency and assurance in the WebPKI with Root Store Policy v3.1, which introduces stricter transparency, documentation, and audit requirements for public certificate authorities.

Email Client Spam Prevention: Firefox now treats mailto: links as popups, requiring explicit user action before opening the email client. This prevents websites from repeatedly opening email composition windows through JavaScript and overwhelming the user.

Restricting Local File Access for Extensions: Starting in Firefox 153, extensions need your explicit permission to access local files through `file://` URLs. Access is off by default for all extensions, including those already installed, so you decide which extensions can access files on your device.

Firefox Privacy

Fingerprinting Protections: Following a report on Alibaba’s use of audio fingerprinting, Tom Ritter published a data-backed analysis explaining how Firefox’s protections reduce the accuracy of fingerprinting through the Web Audio API. The story received coverage from Ars Technica, The Register, and others.

Preventing Link Tracking: Right-clicking a link and selecting Copy Clean Link will now strip tracking parameters across arbitrary subdomains, along with 130 additional tracking parameters.

Bringing Containers Directly into Firefox: Previously available as extension, Firefox 153 introduces built-in Containers, helping you keep work, personal browsing, and other activities separate. Each container maintains its own cookies and login sessions, so you could use containers for multiple accounts on the same site, or to limit online tracking by isolating certain websites in their respective containers. Firefox 155 also adds the ability to reorder containers.

Tracker Blocking Information on Android: Starting in Firefox 153, the Privacy Dashboard on Android shows which types of trackers Firefox blocks, giving you a clearer view of how Firefox protects your privacy as you browse.

Built-in Ad Blocking to iOS: Introduced on September 1, Firefox’s built-in Ad Blocker on iOS blocks many third-party ads and ad-related trackers, reducing clutter and distractions. It works alongside Enhanced Tracking Protection and can be enabled in the ‘Browsing’ settings in your Firefox on iOS.

Community Engagement

Advancing Web Security at Dagstuhl: Firefox security experts joined researchers and other browser vendors at the Dagstuhl Seminar on Web Application Security in July, presenting on LLM-assisted vulnerability detection, XSS protections, and web-scale security measurements.

Mozilla Security Research Summit: Mozilla’s Security-Engineering University Relationship Framework (SURF) is back. On November 20, 2026, we will host another invitation-only summit at TU Delft in the Netherlands, bringing together Mozilla engineers and academic researchers to explore security and privacy challenges and spark new collaborations. The summit takes place immediately after the ACM Conference on Computer and Communications Security (CCS).

TLS, QUIC, HTTP/3, and Happy Eyeballs: Max Inden gave a guest lecture at TU Dresden on modern networking protocols, covering the technologies behind fast, secure web connections.

Looking Ahead

Firefox users receive the security and privacy improvements highlighted in this newsletter through regular updates. If you haven’t tried Firefox yet, download it to experience a fast, secure browser and support Mozilla’s mission to keep the web open, safe, healthy, and accessible to everyone.

Thank you to everyone who helps make Firefox and the web more secure and privacy-focused, by reporting bugs, conducting research, contributing code, or sharing feedback.

We look forward to sharing more updates in the Q4 2026 edition.

— The Firefox Security & Privacy Teams