«  Firefox 149 release uplifts  »
Go to Current release

Uplifts by Product
71 uplifts

Uplifts and Backouts
Bug Component Summary
1999263 XPCShell Harness The temporary folder might be deleted before we attempt to generate a minidump
2012763 Experimentation and Telemetry Consider updating NimbusGeckoPrefHandler architecture and follow-ups
2017451 Media Music controls in the notification drawer fail to work
2019462 Homepage Stretched Kit wallpaper when homepage doesn't show any content and composable toolbar at the bottom is used
2021783 Homepage nightly crashes when switching back to normal mode from private browsing
2023638 Homepage Put the Edge to Edge background behind a feature flag enabled in Nightly
2025134 Share Sharing tabs from locations in the app aside from the menu are always shared as private
Uplifts and Backouts
Bug Component Summary
2013107 Experimentation and Telemetry Implement Playstore attribution retry mechanism.
2019983 Enterprise Policies Introduce a new policy that maps directly to the AI controls
2020285 Site Reports www.public.nm.eurocontrol.int - Drop-down buttons from "Network Headline News" section does not show content when expanded
2021894 Storage: IndexedDB Use-After-Free in PBackgroundIDBDatabase though [@ mozilla::dom::indexedDB::(anonymous namespace)::DatabaseFile::WriteSucceededClearBlobImpl]
2022225 Disability Access APIs Heap-use-after-free in the DocAccessibleParent::Unbind from a compromised content process via PDocAccessible
2022238 Widget: Gtk [Wayland] Toolbar stops responding to clicks
2022252 Graphics: ImageLib Heap-buffer-overflow WRITE in [@ mozilla::image::Downscaler::DownscaleInputLine]
2022294 DOM: Networking data-race heap-use-after-free in FetchParent::RecvFetchOp
2022365 IP Protection Add enterprise policy for disabling VPN
2022369 Networking: Cookies Heap use-after-free in the parent process in [@ RemoveOldestCookies]
2022590 Security Add telemetry probes to track impressions of network error pages and their category
2023007 JavaScript: WebAssembly Compartment mismatch with a structured clone of a CCW to a WebAssembly.Memory
2023026 JavaScript: Standard Library Uninitialized heap memory disclosure in CreateBigInt
2023130 Graphics Heap-use-after free (?) / shadowed variable in RemoteTextureMap::WaitRemoteTextureReady
2023191 Graphics: Text Heap buffer overflow caused by wrong allocation size in WROTSAlloc::Grow
2023201 Sync ’Send to device’ option doesn’t work if the tab was sent from Firefox View’s ‘Open tabs’ section
2023364 Graphics: Text OTS COLRv1 TOCTOU via zero-copy shmem
2023545 DOM: Streams Heap-use-after-free in `ReadableByteStreamControllerRespondInReadableState`
2023555 Audio/Video Out-of-bounds access in EncodeOnePacket
2023648 Inspector: Rules The var() function seems to be broken when it spans several lines
2023800 Security New error pages contain misleading information on http errors
2023829 Graphics: CanvasWebGL Out-of-bounds write via WebGLParent::RecvReadPixels
2023958 Networking: DNS DNSPacket::FillBuffer does not reject too large responses from DNS query
2024074 DOM: Core & HTML AddressSanitizer: heap-use-after-free [@ Length] with READ of size 8
2024160 Sidebar Allow moz-remote-image (SVG favicons) in the synced tabs sidebar
2024417 DOM: Core & HTML Heap use-after-free in [@ ClientSource::Focus] calling SnapshotState after FocusWindow runs blur handler that removes iframe
2024433 DOM: Core & HTML Use-after-free in [@ nsContentList::NamedItem] after adoptNode failure clears HasID without notifying observers
2024437 DOM: Core & HTML Heap use-after-free in [@ HTMLFieldSetElement::InsertChildBefore] via dangling mFirstLegend after failed insert
2024453 DOM: Core & HTML Heap use-after-free in [@ NodeIterator::NodePointer::MoveToNext] when BlastSubtreeToPieces skips mutation observers
2024461 Graphics: Canvas2D Heap-use-after-free in [@ CanvasRenderingContext2D::StrokeImpl] on dash array freed by setLineDash during filter flush
2024462 SVG Use-after-free in [@ SVGFragmentIdentifier::ProcessMediaFragment] — raw SVGSVGElement* held across SetCurrentTime flush
2024472 DOM: Bindings (WebIDL) Use-after-free in [@ DocumentOrShadowRoot::OnSetAdoptedStyleSheets] via stale ObservableArray proxy after adoptNode
2024474 Graphics: Canvas2D UAF (double-delete) in [@ ClientWebGLContext::~ClientWebGLContext] via NotLostData resurrection from ~ProgramKeepAlive
2024477 DOM: Networking Use-after-free in [@ nsXHRParseEndListener::HandleEvent] via orphaned listener on XHR reuse with responseType=document
2024514 IP Protection Channelfilter is not removed when VPN is paused while activating.
2024647 SVG SVG text dominant-baseline values text-before-edge and text-after-edge are not respected
2024780 IP Protection Add UTM paramets to the Mozilla VPN subscription upgrade URL in the about:settings
2025401 Storage: IndexedDB IndexedDB heap use-after-free in [@ FileInfo::UpdateReferences] — ReleaseSavepoint fails to reset mSavepointDelta
2025402 Layout: Form Controls Use-after-poison in [@ nsListControlFrame::Select] via stale frame pointer in HTMLSelectElement::OnOptionSelected after synchronous script
2025422 Audio/Video Stack-buffer-overflow in [@ ADTSTrackDemuxer::Read] due to int32 truncation of >2GB stream length
2025468 Audio/Video: Playback Stack buffer overflow in [@ H265::ParseStRefPicSet] via unbounded numDeltaPocs growth in inter-predicted reference picture sets
2025472 Audio/Video Use-after-free in [@ MediaEncryptedEvent::GetInitData] — untraced JS::Heap<> write after DropJSObjects in CC Unlink
2025475 Audio/Video Heap use-after-free in [@ MediaSession::NotifyMetadataUpdated] via MediaEventListener reconnected after Shutdown
2025477 Audio/Video Heap use-after-free in [@ RemoteCDMChild::RejectPromise] — Shutdown fails to clear dangling mKeys raw pointer
2025492 Audio/Video: Web Codecs Heap use-after-free in [@ ImageDecoder::CheckOutstandingDecodes] via Object.prototype.then reentrancy during ImageDecodeResult promise resolution
2025505 Audio/Video: Web Codecs Heap-use-after-free in [@ ImageDecoder::Close] via missing kungFuDeathGrip in [@ WorkerShutdownWatcher::OnShutdown]
2026109 Printing: Output Print renders all the <option> items in a <select> element instead of the selected one only
2026299 SVG Heap-use-after-free in [@ SVGViewportElement::GetViewBoxTransform] via synchronous FontFace Promise resolution during font-relative unit resolution
2026305 Layout: Tables Bitfield overflow in [@ CellData::SetRowSpanOffset] with rowspan=0 causes wild pointer dereference in border-collapse layout
2026426 Graphics: ImageLib Update libpng to new version v1.6.56 from 2026-03-25 22:47:06 (includes fixes for CVE-2026-33416, CVE-2026-33636)
2026688 DOM: Web Authentication Crash in [@ mozilla::Maybe<T>::emplace<T> | mozilla::dom::SerializeWebAuthnRequestOptions]
2026959 Other Fix Trellix exclusion check for closing KsecDD
2027191 Search Update partnerCode validation to support dots in search-config-v2-schema
2027888 Enterprise Policies Homepage/Startpage policies no longer work
2027944 General Add partner mapping for specific attributed users
2028034 Graphics: WebRender Fix dirty_rect empty check to account for device_size
2028128 Homepage Wallpaper selection tool offers the unavailable Edge to Edge option for 149.0.1
2028335 General Updating l10n-changesets on release to include latest translations
2028943 Tooling Perma fenix release org.mozilla.fenix.utils.SettingsTest.defaultWallpaperIsEdgeToEdgeWhenEdgeToEdgeFeatureEnabled | org.junit.ComparisonFailure: expected:<[edge-to-edge]> but was:<[default]>
2022554 Other …
2024436 Other …
2017867 Other …
2026287 Other …
2025364 Other …