Firefox Security & Privacy Newsletter 2026 Q3

In the third quarter of 2026, the Firefox Security & Privacy Newsletter highlights key initiatives and advancements made by Mozilla's Firefox browser. The newsletter emphasizes the importance of security and privacy as core principles of Mozilla's Manifesto, which continue to guide Firefox's development.

Several security bugs were fixed and released at a faster pace since September 2026, with many recent releases incorporating additional security fixes. Mozilla employs frontier LLMs to identify and address security vulnerabilities in Firefox, ensuring continued online safety for users. The publication of advisories has changed, now providing a separate advisory for each bug instead of grouping them under a single CVE. This change anticipates a potential shift in the CVE Numbering Rules.

Firefox 157 introduces warnings in the site information panel and Settings when a user's connection may not be fully private. For instance, if an administrator configures Firefox to store encryption keys, users can detect this potential security risk. Mozilla has also strengthened the Mozilla Root Store Policy v3.1, introducing stricter transparency, documentation, and audit requirements for public certificate authorities.

To enhance email privacy, Firefox treats mailto: links as popups, requiring user confirmation before opening the email client. This prevents websites from repeatedly opening email composition windows via JavaScript and overwhelming users. Starting in Firefox 153, extensions must request explicit permission to access local files through `file://` URLs. By default, access is disabled for all extensions, including those already installed, allowing users to determine which extensions can access files on their devices.

Firefox 153 incorporates fingerprinting protections, inspired by a report on Alibaba's use of audio fingerprinting. Tom Ritter's data-backed analysis demonstrates how Firefox's Web Audio API protections reduce the accuracy of fingerprinting techniques. The story has garnered attention from publications like Ars Technica and The Register.

Additionally, Firefox now allows users to copy and paste links as clean links, automatically removing tracking parameters from arbitrary subdomains and 130 other tracking parameters. The browser also introduces built-in Containers, which were previously available as an extension. Built-in Containers enable users to separate work, personal browsing, and other activities, each maintaining its own cookies and login sessions. This feature helps limit online tracking and isolate specific websites in their respective containers.

For Android users, Firefox 153 displays Tracker Blocking information on the Privacy Dashboard, showing which types of trackers Firefox blocks. This provides users with a clearer understanding of how Firefox safeguards their privacy while browsing. On iOS, Firefox 155 introduces built-in Ad Blocking, which prevents many third-party ads and ad-related trackers, reducing clutter and enhancing user experience.

The ad blocker works in conjunction with Enhanced Tracking Protection and can be enabled in the 'Browsing' settings of Firefox on iOS.

Firefox security experts participated in a Dagstuhl Seminar on Web Application Security in July 2026, discussing topics such as LLM-assisted vulnerability detection, XSS protections, and web-scale security measurements. Mozilla's Security-Engineering University Relationship Framework (SURF) will host another invitation-only summit at TU Delft in the Netherlands on November 20, 2026, following the ACM Conference on Computer and Communications Security (CCS).

These events foster collaboration between Mozilla engineers and academic researchers to address ongoing security and privacy challenges.

Firefox users receive the security and privacy improvements mentioned in this newsletter through regular updates. Users are encouraged to try Firefox to experience a fast, secure browser and support Mozilla's mission to keep the web open, safe, healthy, and accessible to everyone. Mozilla thanks all contributors, bug reporters, researchers, and feedback providers for their efforts in making Firefox and the web more secure and privacy-focused.