Mozilla Releases Firefox 131 With Tab Preview and Text-Specific Links

Mozilla has released Firefox 131 for multiple platforms, addressing security vulnerabilities and introducing some new features. The update fixes at least seven high-risk security issues, none reportedly exploited in the wild. New features include Tab Preview, which displays thumbnails and details when hovering over background tabs, and temporary location permission storage. Firefox now also supports URL fragment text directives, allowing users to link to specific text passages on web pages.

The actual stuff which was fixed.

[Seven Spirals]

Here is a more detailed description of the fixes. This story abstract was too ... abstract:

• CVE-2024-9391: Users could be prevented from exiting full-screen mode in Firefox Focus for Android, potentially allowing address bar spoofing.
• CVE-2024-9392: A compromised content process could bypass site isolation, allowing the arbitrary loading of cross-origin pages.
• CVE-2024-9393: Cross-origin access to PDF contents was possible through multipart responses, particularly affecting Android users.
• CVE-2024-9395: A specially crafted filename could obscure the file extension in the download dialog, primarily affecting Android.
• CVE-2024-9396: Memory corruption could occur when cloning certain objects, although it's unclear if this was exploitable.
• CVE-2024-9397: A clickjacking vulnerability could allow bypassing directory upload UI protection.
• CVE-2024-9398: External protocol handlers could be enumerated via popups, allowing attackers to check installed applications.

going to give Firefox a spin

[FudRucker]

on my android phone, i hate chrome and never use it, vivaldi is a little better but has some annoyances so the fox gets a turn

Re:

[FudRucker]

due to network slowness the downloading of Firefox will have to wait

Re: going to give Firefox a spin

[drinkypoo]

They probably haven't fixed their massive memory leak that has me restarting FF multiple times a day with any heavy use

Re:

[Tool Man]

They probably haven't fixed their massive memory leak that has me restarting FF multiple times a day with any heavy use

What bletcherous, stone-age version are you using? I've had it open constantly for ages at a time, on Linux and Mac anyway, with no issues. (Could also be something in add-ons, or you're just trolling)

Re:

[drinkypoo]

The Android version specifically has this problem, especially with javascript-heavy sites like faceboot. I am using the Linux version right now, it has no such problems, but I also have 32GB of RAM on my PC and reboot daily so I probably wouldn't know even if it did blow up.

Re:

[Tool Man]

Fair enough! I haven't got an Android device to try it on, and the iOS one is still mostly reskinned Safari with some Firefox tweaks.

For anyone else reading, going to about:memory shows you options to garbage-collect memory, and see where it all goes. Maybe this works on Android as well?
Speaking of Android and memory, I wonder if add-ons like Auto Tab Discard would help declutter a significant amount.

Re: going to give Firefox a spin

[Malc]

Never mind that you use Facebook ;), why do you reboot daily? Linux users have long touted how infrequently they have to reboot, especially compared with Windows that needs to do it every time you sneeze. Itâ(TM)s also the worst desktop OS for restoring session state, which makes rebooting even more annoying.

Re:

[drinkypoo]

Never mind that you use Facebook ;), why do you reboot daily?

I just like to have my machine off when I'm not using it. The boot process is so short that it doesn't matter. It takes like 1/4 as long as it does before my work windows 10 laptop is usable despite the metric shitton of stuff I have loading at boot. The session state works well enough for me, except I have to reposition my firefox windows. Luckily I can just slap them off to the side of the display to get them where I want them.

Disabling tab previews

[fahrbot-bot]

New features include Tab Preview, which displays thumbnails and details when hovering over background tabs, ...

There are 2 about:config setting for this and changes to both take effect immediately w/o restarting.

browser.tabs.hoverPreview.enabled
-- Display/Hide (completely disable) General-Tabs preference: "Show an image preview when you hover on a tab"
-- Note: If disabled (hidden) will still show title bar text on tab hover.

browser.tabs.hoverPreview.showThumbnails
-- Enable/Disable General->Tabs preference: "Show an image preview when you hover on a tab"
-- Note: If disabled will still show title bar text and URL on tab hover.

I have both disabled as I find them annoying.

Re: Disabling tab previews

[devslash0]

As fuck.

Re:

[nmb3000]

I actually like hoverPreview enabled but showThumbnails disabled. The formatted popup is more pleasant than the native OS tooltip.

Re:

[Mousit]

New features include Tab Preview, which displays thumbnails and details when hovering over background tabs, ...

I have both disabled as I find them annoying.

What's particularly sad is they don't even follow standard UI practices in regards to timing. While I immediately disabled thumbnail views, I actually like the look of the hoverPreview, the text. However, the pop-up is INSTANT upon mouseover, rather than waiting the customary ~1 second before pop-up occurs. The classic info pop-up (what FF does when hoverPreview.enabled is turned off) actually follows this convention of short delay, so Mozilla is inconsistent in implementation even within this single fun

Re:

[groobly]

Anything that does something due to hovering sucks and should always be disabled.

"List all Tabs" is back

[IWantMoreSpamPlease]

Just underneath the "close" button in Windows. I'd love to get rid of that...again, but it doesn't seem as easy as last time it surfaced. Anyone know how to get rid of it?

Re:

[fahrbot-bot]

Just underneath the "close" button in Windows. I'd love to get rid of that...again, but it doesn't seem as easy as last time it surfaced. Anyone know how to get rid of it?

Have tried this from How to remove the "List all tabs" button introduced in Firefox v131.0 [reddit.com] and it works.

Add to "userChrome.css":

#alltabs-button { display: none !important; }

Re:

[IWantMoreSpamPlease]

Yes thank you, I did find this, but that's a lot of steps to do to get rid of a "simple" (though unwanted) icon. I'm waiting for Mozilla to pull a Chrome and make additions permanent. It's not a good PR move for Mozilla IMO.

Re:

[Mousit]

I'm waiting for Mozilla to pull a Chrome and make additions permanent. It's not a good PR move for Mozilla IMO.

That is unfortunately basically what they did, and quite deliberately. There's a Bugzilla [mozilla.org] entry specifically regarding this change where they explicitly note "advanced users" can still use userChrome.css, but everyone else can get fucked (they don't add the last part but I feel it's implied).

And yeah, I have a suspicion even userChrome.css is on the chopping block sooner or later. After all, as that Reddit post points out, first you have to hit about:config and turn on toolkit.legacyUserProfileCustomiza

Re:

[fahrbot-bot]

Enabling and creating the userChrome.css file isn't too bad and I already use it to reduce the whitespace between menu items, as even the "Normal" density seems a little excessive.

Tab Preview is an annoying Gimmick

[devslash0]

When I hover over a tab I just want to switch to it. I know what the tab has in it based on the favicon and text. Hover tooltip is just a needless gimmick that gets in the way, makes me waste time trying to dismiss it and annoys the hell out of me every single time.

Text Fragments

[nmb3000]

I'm actually most excited for Firefox adding support for Text Fragments [web.dev] in this release. It seems like a small thing, but I very often find myself wanting to link to a specific part of a webpage that doesn't have any convenient document fragments. Chrome has had the feature for a while now, so glad to see it in Firefox as well.

There's no built-in easy way to create a text fragment (hopefully coming), but there is a Google Labs addon for Firefox which adds it to the context menu: Link to Text Fragment [mozilla.org].

Re:

[Tony Isaac]

That's weird that they didn't add a context menu to create the link in the first place. That seems like an integral part of the feature.

Re:

[HighPerformanceCoder]

I can see the point of this, to deeplink into somebody else's web page, but it is obviously a fragile link. So you'd want to quote the text anyway, and then provide a link to back it up. People do understand when the source text changes, and can search within a page to see where the original text might have come from.

If it's you own text you're deeplinking to, then just adding an html anchor tag to the source suffices to enable deeplinking to the point of the document.

More bloat to the browser core..

[Rexdude]

..that used to be possible through UI integrated XUL extensions before Mozilla chose to dump the technology and copy Chrome's web extension model (together with much else).

If you ask fifty users what additional features they want in a browser you'll get 50 different answers; simply adding them all to the browser core only bloats it and makes it more complex to maintain. To say nothing of a larger attack surface. All the so called features that Mozilla has introduced in the last several years (Pocket integ