Mozilla just released Firefox 88 and we rushed to install it on our virtual browser cloud. In this blog post, we'll summarize the new features and changes in this Firefox version so that you know what to expect when cross-browser testing your webapps in it.
Try Browserling on Firefox 88 now!
New in Firefox 88
- Enhanced privacy protection - To protect against cross-site privacy leaks, Firefox 88 now isolates
window.namedata to the website that created it.
- Smooth pinch-zooming in Linux - As Linux has evolved with new touchpad drivers, Firefox 88 now supports smooth pinch-zoom gesture on Linux.
- Margin units in Print Dialog are now localized - Depending on your location, margin units are now automatically selected in centimeters or inches.
Changes in Firefox 88
- Less nagging - Firefox 88 will not prompt for access to your microphone or camera if you've already granted access to the same device on the same site in the same tab within the past 50 seconds. This new grace period reduces the number of times you're prompted to grant device access.
- Take a screenshot has been moved - The "Take a Screenshot" feature was removed from the Page Actions menu in the url bar. To take a screenshot, right-click to open the context menu. You can also add a screenshots shortcut directly to your toolbar via the Customize menu. Open the Firefox menu and select Customize.
- FTP is gone - FTP support has been disabled, and its full removal is planned for an upcoming release. Addressing this security risk reduces the likelihood of an attack while also removing support for a non-encrypted protocol.
The following section summarizes changes that affect web developer's work.
Switch between raw/formatted JSON
There's now a "Raw" switch in the developer tools that lets you switch between a raw JSON response and formatted JSON response. It can be found in the request/response tab:
- The default monospace font for MacOS has been changed to Menlo.
:user-invalidpseudo-classes have been implemented.
- Added support for RegExp match indices.
- FTP has been disabled on all releases (preference
network.ftp.enablednow defaults to false).
- The localhost URLs will refer to the loopback ip address (127.0.0.1), increasing the overall security of the connection.
DOM API Changes
- Code can now use the new static method
AbortSignal.abort()to return an
AbortSignalthat is already set as aborted.
- If the number of tracks being recorded changes, an
InvalidModificationErroris thrown from the MediaRecorder.start().
Changes for add-on developers
- Url can now be used to limit the properties for which the
tabs.onUpdatedevent is triggered.
Changes in Firefox 88 for Android
- Search engine suggestion feature makes it easier to search the web.
- Fixed an issue where video playing in fullscreen or picture-in-picture mode would not display correctly on sites using a desktop viewport.
Unresolved Issues in Firefox 88
- Some purchased video content may not play correctly due to a recent Widevine plugin update (this will be addressed in an upcoming bug fix release).
Security Fixes in Firefox 88
- CVE-2021-23994: Out of bound write due to lazy initialization.
- CVE-2021-23995: Use-after-free in Responsive Design Mode.
- CVE-2021-23996: Content rendered outside of webpage viewport.
- CVE-2021-23997: Use-after-free when freeing fonts from cache.
- CVE-2021-23998: Secure Lock icon could have been spoofed.
- CVE-2021-23999: Blob URLs may have been granted additional privileges.
- CVE-2021-24000: requestPointerLock() could be applied to a tab different from the visible tab.
- CVE-2021-24001: Testing code could have enabled session history manipulations by a compromised content process.
- CVE-2021-24002: Arbitrary FTP command execution on FTP servers using an encoded URL.
- CVE-2021-29945: Incorrect size computation in WebAssembly JIT could lead to null-reads.
- CVE-2021-29944: HTML injection vulnerability in Firefox for Android's Reader View.
- CVE-2021-29946: Port blocking could be bypassed.
- CVE-2021-29947: Memory safety bugs fixed in Firefox 88.
Email this blog post to your friends or yourself!
Enter a URL to test, choose platform, browser and version, and you'll get a live interactive browser in 5 seconds!