Firefox 156 is the second release since Mozilla moved to a twice-monthly release schedule, and the blog OMG Ubuntu notes it has faster start-up times for its built-in PDF viewer and also lower CPU usage when viewing large JPEG images: In Firefox 156, the browser now uses libjpeg-turbo's IDCT scaling to reduce images during decoding, rather than loading a full-size image into memory and then shrinking it. Benchmarks from the bug report show up to 20x less memory used during very large image loading, and decoding is up to twice as fast. Since these speeds were quite fast already, there's no perceptible difference to users. Behind the scenes, it's more efficient. Firefox's built-in PDF viewer starts up to 45% faster in this release. The browser now loads the background PDF.js worker sooner, rather than launching it only when needed. Sponsored suggestions in the address bar are live for users in France, Germany and Italy (Ouais!, Juhu!, etc). These are already available in some other locales. Don't want them? Disable them via Settings > Search > Firefox Suggest > Suggestions from Sponsors. Besides that, the rest of this release is primarily bug fixes — worthwhile and welcome as always. And in about two weeks Firefox 157 will be released, reports PC World. "That update should add support for JPEG XL (JXL), a modern image format that offers the same quality as JPEG at a significantly smaller size. Although JPEG XL was launched in 2021, Safari is the only browser to support it yet. For a short period, Chrome also supported it, but that ended in 2022." Also, a recent Firefox blog post emphasized that it supports whatever level of AI engagement "is right for you... Because the only person telling you how much AI you need should be you." Opting out of upcoming and current AI features on your browser should not require endless navigation through multiple Settings pages. That's why Firefox offers an AI controls section within its General Settings panel. A single, easily located place where you can block current and future AI features and related pop-ups with the swipe of a toggle... For the many people who sit in the middle of the AI usage spectrum, we made sure you can opt in and out of specific features in line with your preferences. Capabilities like AI translations, image alt text in Firefox PDF viewer, tab group suggestions, and key points in link previews can all be individually switched on and off, ensuring you can enjoy such offerings on a case by case basis as it suits your needs... Smart Window is Firefox's most integrated AI experience, but that doesn't mean it compromises our commitment to choice, privacy, and transparency. Our newest window type, which we've been polishing and testing in beta, uses only the context you share with it to help you move work forward and across the finish line. When permitted by you, its built-in, AI-powered assistant can work directly with your open tabs and browsing history to connect the dots. This means comparing information, generating recommendations, summarizing pages, and planning projects without having to feed every crumb of context from your previous and current browsing activity each time you enter a new prompt. And if you want to block Google's AI Overviews, there's over 100 extensions to choose from.

Read more of this story at Slashdot.

The browser refreshes fix multiple use-after-free, sandbox escape, and privilege escalation bugs.

The post Chrome and Firefox Updates Patch Dozens of Vulnerabilities appeared first on SecurityWeek.

Firefox 154 "brings a number of usability improvements," writes PC World: The free built-in VPN, introduced with Firefox 149, continues to offer a selection of virtual locations — temporarily extended to 28 countries until the end of August... The free VPN is currently available to Firefox users in the US, Canada, the UK, France, and Germany. In addition, the free VPN can now also be used in Firefox for Android (rolling out gradually) with iOS to follow soon. Firefox 154 also begins adding the privacy-focused search engine Startpage to its address-bar search options for desktop users in Germany, France, Austria, Switzerland, and the Netherlands (the home markets for the Netherlands-based search engine). And Startpage is also coming soon to Android and iOS. "When so much of the web experience is decided by a handful of very large companies, a search option that's private by design and European by origin isn't a small thing," explains a Mozilla blog post, with Ajit Varma, Head of Firefox, saying this now gives millions of people in Europe one-click access to "real results, zero profiling, AI-free." Queries aren't stored or linked to you, and there are no AI answers pushed above your search results. In fact, there's no AI at all. Based in the Netherlands, Startpage built its product around a simple idea: great search and personal privacy can go hand in hand... Firefox users were choosing Startpage long before today — to the tune of more than a billion searches a year, every one of them required some assembly: an extension, a manual setting, a workaround... Startpage ranks among the most-requested search engines in the Firefox community. When demand is this clear, our job is to remove the friction... Most browsers have already decided how you're going to search. Firefox hasn't. Pick your search engine, control what happens to your queries, decide who sees data about you, even turn AI on or off. It should always be your call. Not everyone wants the same thing from search, and a browser shouldn't pretend they do. "Firefox has always been the browser for people who want to make their own decisions about the web," said Startpage President Stewart Marlborough, "which makes it a natural home for private search." Nvidia's GeForce NOW cloud-gaming platform is also now officially supported on Firefox, expanding access across even more devices," according to a Nvidia blog post: Members can outfox big downloads and jump into high-performance PC gaming directly from the browser — no waiting on lengthy game installs or updates. The experience delivers GeForce RTX-powered performance at up to 1440p and 120 frames per second for GeForce NOW Ultimate members. Simply download the latest version of Firefox, head to play.geforcenow.com and start playing. The cloud handles the heavy lifting, so games are ready to play without taking up valuable storage space on the device. Firefox joins Chrome, Edge and Opera in supporting GeForce NOW on Windows browsers. Mozilla's own blog post even includes an animation of the Firefox mascot playing games: Gamers put real effort into making their rigs their own, and Firefox gets that. Users can choose themes, custom colors, and tab settings to customize their setup, instead of sitting there like just another window. We also know online gaming doesn't happen in just one window. It's social and sometimes spontaneous. With Firefox, you can have a Discord call running in Split View, a guide open in another tab, or Reddit pulled up between matches. Then go full screen when you're ready to play, no need to switch browsers to stream games. "In the security report for Firefox 154, Mozilla lists 58 resolved security vulnerabilities, 54 of which were discovered and reported by external security researchers," notes PC World. ("Mozilla classifies 17 of these vulnerabilities as high risk.") With Firefox 155 (scheduled for September 1), Mozilla is switching to a fortnightly release cycle for major versions, like Google Chrome and Microsoft Edge.

Read more of this story at Slashdot.

The bugs could lead to code execution, privilege escalation, sandbox escape, and information disclosure.

The post Chrome, Firefox Updates Patch Dozens of Vulnerabilities appeared first on SecurityWeek.

The latest release of Firefox 153.0.3 includes several enhancements: Smart Window includes: The suggestion list now shows more results, making it easier to find history and switch to open tabs. (Bug 2019042) The assistant can now answer questions directly using web search results from Exa, instead of handing off to a search engine. (Bug 2046183, Bug […]

Microsoft Corp. today pushed security updates to fix at least 77 vulnerabilities in its Windows operating systems and other software. There are no pressing “zero-day” flaws this month (compared to February’s five zero-day treat), but as usual some patches may deserve more rapid attention from organizations using Windows. Here are a few highlights from this month’s Patch Tuesday.

Two of the bugs Microsoft patched today were publicly disclosed previously. CVE-2026-21262 is a weakness that allows an attacker to elevate their privileges on SQL Server 2016 and later editions.

“This isn’t just any elevation of privilege vulnerability, either; the advisory notes that an authorized attacker can elevate privileges to sysadmin over a network,” Rapid7’s Adam Barnett said. “The CVSS v3 base score of 8.8 is just below the threshold for critical severity, since low-level privileges are required. It would be a courageous defender who shrugged and deferred the patches for this one.”

The other publicly disclosed flaw is CVE-2026-26127, a vulnerability in applications running on .NET. Barnett said the immediate impact of exploitation is likely limited to denial of service by triggering a crash, with the potential for other types of attacks during a service reboot.

It would hardly be a proper Patch Tuesday without at least one critical Microsoft Office exploit, and this month doesn’t disappoint. CVE-2026-26113 and CVE-2026-26110 are both remote code execution flaws that can be triggered just by viewing a booby-trapped message in the Preview Pane.

Satnam Narang at Tenable notes that just over half (55%) of all Patch Tuesday CVEs this month are privilege escalation bugs, and of those, a half dozen were rated “exploitation more likely” — across Windows Graphics Component, Windows Accessibility Infrastructure, Windows Kernel, Windows SMB Server and Winlogon. These include:

–CVE-2026-24291: Incorrect permission assignments within the Windows Accessibility Infrastructure to reach SYSTEM (CVSS 7.8)
–CVE-2026-24294: Improper authentication in the core SMB component (CVSS 7.8)
–CVE-2026-24289: High-severity memory corruption and race condition flaw (CVSS 7.8)
–CVE-2026-25187: Winlogon process weakness discovered by Google Project Zero (CVSS 7.8).

Ben McCarthy, lead cyber security engineer at Immersive, called attention to CVE-2026-21536, a critical remote code execution bug in a component called the Microsoft Devices Pricing Program. Microsoft has already resolved the issue on their end, and fixing it requires no action on the part of Windows users. But McCarthy says it’s notable as one of the first vulnerabilities identified by an AI agent and officially recognized with a CVE attributed to the Windows operating system. It was discovered by XBOW, a fully autonomous AI penetration testing agent.

XBOW has consistently ranked at or near the top of the Hacker One bug bounty leaderboard for the past year. McCarthy said CVE-2026-21536 demonstrates how AI agents can identify critical 9.8-rated vulnerabilities without access to source code.

“Although Microsoft has already patched and mitigated the vulnerability, it highlights a shift toward AI-driven discovery of complex vulnerabilities at increasing speed,” McCarthy said. “This development suggests AI-assisted vulnerability research will play a growing role in the security landscape.”

Microsoft earlier provided patches to address nine browser vulnerabilities, which are not included in the Patch Tuesday count above. In addition, Microsoft issued a crucial out-of-band (emergency) update on March 2 for Windows Server 2022 to address a certificate renewal issue with passwordless authentication technology Windows Hello for Business.

Separately, Adobe shipped updates to fix 80 vulnerabilities — some of them critical in severity — in a variety of products, including Acrobat and Adobe Commerce. Mozilla Firefox v. 148.0.2 resolves three high severity CVEs.

For a complete breakdown of all the patches Microsoft released today, check out the SANS Internet Storm Center’s Patch Tuesday post. Windows enterprise admins who wish to stay abreast of any news about problematic updates, AskWoody.com is always worth a visit. Please feel free to drop a comment below if you experience any issues apply this month’s patches.

Brian King // On a recent webapp test, I got a little frustrated with all the extra HTTP requests showing up in my Burpsuite Proxy History from connections that Firefox […]

The post Towards a Quieter Firefox appeared first on Black Hills Information Security, Inc..