The previous GPG signing subkey was inadvertently added to a GitHub repository and Mozilla decided to revoke it.
The post Mozilla Issues New Firefox GPG Key Following Exposure appeared first on SecurityWeek.
As AI becomes a greater and more important presence in our everyday lives, the way we interact with the "traditional" internet is changing.
For so long the main way to access the internet, the web browser is now having to rethink how to appeal to an audience which often seeks AI-first interaction - raising new challenges for developers to create the best and most interactive experience.
We spoke to Ajit Varma, Head of Firefox at Mozilla, to find out more.
The open web matters more today than it has in years because AI is changing how people experience the internet. As a small number of platforms become the gateway to search, content and AI-powered services, it's becoming easier for a handful of companies to shape what people see and how they interact online.
That's why the principles of the open web still matter. Common standards mean developers can build without asking permission from a dominant platform, and users can choose how they access the web rather than being locked into a single ecosystem. Those principles have driven innovation for decades, and they're just as important as AI reshapes the internet.
The challenge now isn't simply keeping the web open as it exists today. It's making sure openness evolves alongside AI, so the next generation of the internet remains competitive, interoperable and accessible to everyone
Over the next five years, you’ll start to see more divergences in how browsers treat AI. Many companies will use the browser to try and push a specific AI agenda but at Firefox we’re focused on how AI can make the tasks a user wants to do in a browser better. This includes things like a personal agent that can help a user accomplish tasks, navigating the web through voice, making the web more enjoyable, and creating new vibe-coded extensions and mini-apps.
We’ll do all this in a way that is user centric. The browser should adapt to the user, rather than the other way round. Some people will want AI integrated into their everyday browsing, while others will prefer to use it for specific tasks. Maintaining trust means supporting those preferences and letting people decide how much they use AI.
Users should be able to choose any model they want including open and local models. The important thing is preserving that flexibility, so people can browse, search and get things done in a way that feels natural to them.
For me, striking the right balance starts with recognising that every user has different expectations of their browser. While context can make online experiences more useful and personalised, people should be able to understand how their data is used and decide what they are comfortable sharing. By giving users meaningful control over the features they adopt, Firefox can deliver modern experiences while continuing to protect their privacy.
This has guided our phased approach to AI, beginning with practical features such as summarisation, translation, tab organisation and optional AI chat integrations. Before introducing more advanced AI experiences such as Smart Window, we launched AI Controls so people can manage individual features or switch them off altogether.
Firefox is also model-agnostic, so users can choose or switch providers, use local models, or opt out entirely. Even though only a small minority of users disable AI features, people regularly tell us they value knowing the controls are there. Privacy and convenience can coexist when people are able to set the terms of the experience.
The biggest risk isn't AI itself, it's concentration. If the same companies control the AI models, the interface people use to access them and the browser they interact through, users lose visibility, choice and ultimately agency. That's a much bigger shift than simply moving from one technology generation to another.
What's encouraging is that the issue is becoming harder to ignore. Developers want open standards. Regulators are paying closer attention to competition. Users are asking tougher questions about transparency and control. The web has always evolved through periods of disruption, but it has remained resilient because it's built on interoperability rather than permission. AI can strengthen that model rather than replacing it with a handful of closed ecosystems. The future doesn't have to be a choice between innovation and openness. We should expect both.
AI is making it dramatically easier to build software, which means we're going to see more developers – and more people who aren't traditional developers – creating for the web. That's a huge opportunity, but only if they can build on an open platform rather than for a handful of closed ecosystems.
That's why the browser becomes even more important. It's no longer just where websites are displayed – it's becoming the layer where people interact with AI to search, create, organise information and complete tasks. As that layer becomes more powerful, it has to remain open, interoperable and centred around user choice.
For developers, that means being able to build for the web, rather than for whichever company happens to control the dominant model or platform. That's always been one of the web's greatest strengths, and it's something we shouldn't lose as AI reshapes how software is built and experienced.
Success, for me, is a web that's become more useful through AI without becoming less open. Technology should expand what's possible, not narrow the ways people can access information, build new ideas or participate online.
Innovation should continue to come from everywhere, not just a handful of dominant platforms. The web has always been at its best when anyone with a good idea can build something that reaches millions of people. That only happens when developers have open standards to build on and users aren't locked into a single ecosystem.
The web should still be the best place to build, discover and innovate because it remains accessible to everyone. If AI has expanded participation rather than concentrated power, we'll be heading in the right direction.
We differentiate through independence, choice and accountability. Most browsers are tied to larger technology ecosystems spanning across multiple systems, search, advertising and AI.
Instead, Firefox is powered by Gecko, the only remaining independent browser engine, which gives us the freedom to make product decisions around what benefits users. It ensures that Mozilla is not only advocating for these principles but actively building the underlying infrastructure that makes them possible.
That independence is commercially relevant because there’s such a clear demand for genuine choice. Firefox has been selected through EU browser choice screens more than six million times in two years and those users are five times more likely to remain with Firefox than people who find it organically.
Societally, independent engines prevent one company’s technical and commercial priorities from being the default for the entire web. They also preserve competition, interoperability and the ability to build around different values.
There are certainly some encouraging signs that regulation can restore meaningful choice. The impact of browser choice screens in Europe shows that people choose alternatives when they are presented fairly and without being steered towards a default.
However, AI is creating a new concentration risk. If the same small group of companies control the operating system, browser, search engine and AI model, it becomes much easier for them to shape how people access information and which services they encounter.
Regulation needs to keep pace not only with how AI is developed, but with how it's distributed and embedded into everyday products. However, regulation can't do this alone. Interoperability, genuine defaults and strong technical competition will matter just as much.
Trust starts with being clear about what the technology is doing. AI should be optional, transparent and designed so users can understand what information it can access, how it’s being used and who is acting on their behalf.
That’s the principle behind Firefox’s AI controls. AI features are optional and can be managed individually, while a single setting allows users to block current and future generative AI features. We also use on-device models for features such as Link Previews and Smart Tab Groups, allowing people to receive AI assistance without any data leaving their device.
Ultimately, trust isn't earned through a single feature. It's earned by being transparent about how AI works and consistently respecting the decisions people make.
It starts on the 4 Train, that straight-run subway line from Grand Central to Yankee Stadium, where I start to notice the red shirts. By the time I reach the massive gray stadium, people are circling the Bronx Bomber’s edifice like thousands of red ants, all queuing up for a rare baseball season sight: football (soccer) in Yankee Stadium.
Most of the shirts are for Premier League side Liverpool FC, but there's a smattering of Wrexham kits. Some of them look threadbare, and none feature the club’s newest sponsor: Firefox. The travel and away kits were unveiled just days before — too soon for die-hard fans to show their support for the team and its well-known but, by some measures, marginal web browser.
Walking through Babe Ruth Plaza, I follow behind the red shirts until I’m lined up behind fans who have come from as far as Arkansas and California to witness the pre-season match. None are musing about Firefox’s new Wrexham sponsorship or how Mozilla (Firefox’s parent) took over from United, which itself took over from TikTok.
The scrappy Welsh club enjoys outsized notoriety thanks to its owners, actors and entrepreneurs Rob McElhenney and Ryan Reynolds, and the popular Hulu docu-series Welcome to Wrexham, which recounts the club’s rise from the ashes and ascent to, as of last season, just short of Premier League status.
While we wait to enter the stadium, the Liverpool team arrives late — following a day of storms and flight cancellations — on a pair of giant red touring buses to hearty cheers from the crowd. Everyone knows Wrexham, but the fans seem to be with Liverpool.
As we file in, I have time to think about the connection between Wrexham and Firefox. The kits, which I view later in person and on the field, are quite fetching. On top of the bold, red stretchable fabric is the iconic Firefox flame. It makes me think of the heat Mozilla hopes to generate around its best-known product.
The fit, though, between a scrappy football team and a portal you use to navigate the web, seems tenuous and as ill-fitted as the rectangular pitch they’ve somehow jury-rigged onto the baseball diamond. A covered home plate, third base, and right field jut out awkwardly, and much later a fan tells me the pitch looked kind of messy and maybe not a great experience for some of the players.
It’s not that I don’t understand why Mozilla tied its sails to Wrexham. As I write this, Firefox sits, according to StatCounter, at 3.4% of the global browser market share. By contrast, Chrome has 69% and Safari almost 16%. Put another way, the browser wars are over.
It's not that Firefox is irrelevant, but it's not as relevant as it once was. There was a time, maybe 15 years ago, when I was firmly in the Firefox camp. I’d adopted it because I was working with so many developers, who were all using the leaner and (some thought) meaner platform. It was built on the premise of openness, running counter to Internet Explorer (RIP) and the fast-growing Google Chrome.
Over time, though, it started to suffer from the same resource-hogging issues as Internet Explorer. I eventually gave it up and migrated to Chrome, then had a dalliance with Microsoft Edge and have now settled on Chrome on the desktop and Safari for mobile. If I’m being honest, I stopped considering Firefox years ago.
As the team took the makeshiift pitch and the stands filled with red shirts, I waited for Mozilla’s relatively new CEO Anthony Enzor-DeMeo and CMO John Solomon to arrive so I could quiz them about product plans and Mozilla’s dive into AI.
Enzor-DeMeo joined Mozilla in 2024 after stints at Roofstock, Better, and Wayfair. In each, the admitted nerd appears to have held positions relating to products, technology, and engineering. Solomon comes to Mozilla from Apple and Beats.
When Enzor-DeMeo finally does arrive, he looks younger than I expected and has a sort of nervous energy. It’s been a busy few days with a lot of interviews, and when I try to ask about Mozilla and AI, he tells me he doesn’t want to do any more. Still, he’s open and affable, explaining that he’s a die-hard It’s Always Sunny in Philadelphia (Rob McElhenney is a series star) fan, so much so that when someone else says they love the show, he asks them to name their favorite episode and then, without waiting for an answer, tells us his.
Still, Enzor-DeMeo was not a closet fan of the beautiful game. Instead, Solomon, who comes from the much more culturally connected Beats brand, suggested this partnership. Enzor-DeMeo watched Reynold’s Welcome to Wrexham doc and thought, “Oh, this makes a lot of sense.”
I stared at him, wondering what he saw that I didn’t. Sure, a partnership with the Red Dragons, as Wrexham are also known (I even spotted their red dragon mascot wandering the pitch and hugging fans) makes some sense. You know, fire, dragons? And this would be Wrexham’s second tech sponsorship after TikTok, which was widely featured in early seasons of Welcome to Wrexham. Mozilla confirmed that as they film the new season, we will see the Firefox brand on display in some fashion.
I looked at Enzor-DeMeo, who was still enthusiastically talking about It’s Always Sunny in Philadelphia, and asked him, “What’s the throughline from Firefox to Wrexham?” Enzor-DeMeo smiled and quickly answered, “Underdog.”
The only thing that would’ve made the moment more perfect is if an announcer suddenly screamed, “Goooooaaaallll!” But I got it.
If you’ve never seen the documentary, Wrexham AFC was the disintegrating center of a hardscrabble town that, despite over 150 years of footballing history, had been largely forgotten and fallen to the fifth tier of the English league system. Achieving Premier League status, a feat they very nearly accomplished last season, seemed impossible. Until Reynolds and McElhenney arrived.
Sure, there are people unhappy with the way celebrity and money have throw off the balance of a well-worn system, but if you watch the doc, you know that it was never enough to throw money and fame at it. It’s a very human story with equal measures of failure and success.
Firefox is surely the underdog in the browser game. Built on its own Gecko browser engine, it stands apart from Google, Apple and Microsoft, which all have a profit motive in having you use their platforms. Mozilla’s parent organization is non-profit, and although the Mozilla Corp, under which Firefox lives, is for-profit, its revenues are used to fund the non-profit effort.
Like its competitors, Firefox has AI features, letting you access the AI chatbot of your choice in a sidebar, and using AI to help you organize tabs. It does, though, seem a bit less interested in force-feeding AI.
Still, underdog status is no guarantee of a Cinderella story, and as the game drags on with countless missed shots and a handful of fouls, I wonder if Wrexham can embarrass Liverpool in front of its US fans. A moment later, Liverpool manages at roughly 60 minutes in to sail one over the outstretched arms of Wrexham substitute goalkeeper Callum Burton.
There’s no victory for the underdog this time, but it’s the pre-season, and Wrexham and its new sponsor Firefox should have many more chances to win on the pitch.
Read more of this story at Slashdot.
Read more of this story at Slashdot.
Read more of this story at Slashdot.
Microsoft Corp. today pushed security updates to fix at least 77 vulnerabilities in its Windows operating systems and other software. There are no pressing “zero-day” flaws this month (compared to February’s five zero-day treat), but as usual some patches may deserve more rapid attention from organizations using Windows. Here are a few highlights from this month’s Patch Tuesday.
Image: Shutterstock, @nwz.
Two of the bugs Microsoft patched today were publicly disclosed previously. CVE-2026-21262 is a weakness that allows an attacker to elevate their privileges on SQL Server 2016 and later editions.
“This isn’t just any elevation of privilege vulnerability, either; the advisory notes that an authorized attacker can elevate privileges to sysadmin over a network,” Rapid7’s Adam Barnett said. “The CVSS v3 base score of 8.8 is just below the threshold for critical severity, since low-level privileges are required. It would be a courageous defender who shrugged and deferred the patches for this one.”
The other publicly disclosed flaw is CVE-2026-26127, a vulnerability in applications running on .NET. Barnett said the immediate impact of exploitation is likely limited to denial of service by triggering a crash, with the potential for other types of attacks during a service reboot.
It would hardly be a proper Patch Tuesday without at least one critical Microsoft Office exploit, and this month doesn’t disappoint. CVE-2026-26113 and CVE-2026-26110 are both remote code execution flaws that can be triggered just by viewing a booby-trapped message in the Preview Pane.
Satnam Narang at Tenable notes that just over half (55%) of all Patch Tuesday CVEs this month are privilege escalation bugs, and of those, a half dozen were rated “exploitation more likely” — across Windows Graphics Component, Windows Accessibility Infrastructure, Windows Kernel, Windows SMB Server and Winlogon. These include:
–CVE-2026-24291: Incorrect permission assignments within the Windows Accessibility Infrastructure to reach SYSTEM (CVSS 7.8)
–CVE-2026-24294: Improper authentication in the core SMB component (CVSS 7.8)
–CVE-2026-24289: High-severity memory corruption and race condition flaw (CVSS 7.8)
–CVE-2026-25187: Winlogon process weakness discovered by Google Project Zero (CVSS 7.8).
Ben McCarthy, lead cyber security engineer at Immersive, called attention to CVE-2026-21536, a critical remote code execution bug in a component called the Microsoft Devices Pricing Program. Microsoft has already resolved the issue on their end, and fixing it requires no action on the part of Windows users. But McCarthy says it’s notable as one of the first vulnerabilities identified by an AI agent and officially recognized with a CVE attributed to the Windows operating system. It was discovered by XBOW, a fully autonomous AI penetration testing agent.
XBOW has consistently ranked at or near the top of the Hacker One bug bounty leaderboard for the past year. McCarthy said CVE-2026-21536 demonstrates how AI agents can identify critical 9.8-rated vulnerabilities without access to source code.
“Although Microsoft has already patched and mitigated the vulnerability, it highlights a shift toward AI-driven discovery of complex vulnerabilities at increasing speed,” McCarthy said. “This development suggests AI-assisted vulnerability research will play a growing role in the security landscape.”
Microsoft earlier provided patches to address nine browser vulnerabilities, which are not included in the Patch Tuesday count above. In addition, Microsoft issued a crucial out-of-band (emergency) update on March 2 for Windows Server 2022 to address a certificate renewal issue with passwordless authentication technology Windows Hello for Business.
Separately, Adobe shipped updates to fix 80 vulnerabilities — some of them critical in severity — in a variety of products, including Acrobat and Adobe Commerce. Mozilla Firefox v. 148.0.2 resolves three high severity CVEs.
For a complete breakdown of all the patches Microsoft released today, check out the SANS Internet Storm Center’s Patch Tuesday post. Windows enterprise admins who wish to stay abreast of any news about problematic updates, AskWoody.com is always worth a visit. Please feel free to drop a comment below if you experience any issues apply this month’s patches.
In March 2024, Mozilla said it was winding down its collaboration with Onerep — an identity protection service offered with the Firefox web browser that promises to remove users from hundreds of people-search sites — after KrebsOnSecurity revealed Onerep’s founder had created dozens of people-search services and was continuing to operate at least one of them. Sixteen months later, however, Mozilla is still promoting Onerep. This week, Mozilla announced its partnership with Onerep will officially end next month.
Mozilla Monitor. Image Mozilla Monitor Plus video on Youtube.
In a statement published Tuesday, Mozilla said it will soon discontinue Monitor Plus, which offered data broker site scans and automated personal data removal from Onerep.
“We will continue to offer our free Monitor data breach service, which is integrated into Firefox’s credential manager, and we are focused on integrating more of our privacy and security experiences in Firefox, including our VPN, for free,” the advisory reads.
Mozilla said current Monitor Plus subscribers will retain full access through the wind-down period, which ends on Dec. 17, 2025. After that, those subscribers will automatically receive a prorated refund for the unused portion of their subscription.
“We explored several options to keep Monitor Plus going, but our high standards for vendors, and the realities of the data broker ecosystem made it challenging to consistently deliver the level of value and reliability we expect for our users,” Mozilla statement reads.
On March 14, 2024, KrebsOnSecurity published an investigation showing that Onerep’s Belarusian CEO and founder Dimitiri Shelest launched dozens of people-search services since 2010, including a still-active data broker called Nuwber that sells background reports on people. Shelest released a lengthy statement wherein he acknowledged maintaining an ownership stake in Nuwber, a data broker he founded in 2015 — around the same time he launched Onerep.
Brian King // On a recent webapp test, I got a little frustrated with all the extra HTTP requests showing up in my Burpsuite Proxy History from connections that Firefox […]
The post Towards a Quieter Firefox appeared first on Black Hills Information Security, Inc..
Login