Softpedia >Windows >Internet >Browsers >Basilisk >  Changelog

Basilisk Changelog

What's new in Basilisk 2024.02.03

Feb 4, 2024
  • Implemented a restricted version of the asynchronous clipboard API (navigator.clipboard). This API is restricted to writing only for obvious security considerations. It supports both plaintext and the standard DataTransfer methods. We did not implement the reinvented wheel concept of ClipboardItem objects.
  • Implemented support for SHA-2 (SHA-256/SHA-512/etc.) signatures for OCSP stapled responses.
  • Implemented PromiseRejectionEvent. Although this is rarely actually used, some common JS libraries (you know who you are!) use it as a feature level canary and start loading (broken!) Promise shims if it is not found, causing compatibility issues and broken websites due to the shims.
  • Aligned microtasks and Promises scheduling with the current spec and expected behavior.
  • We now no longer send click events to top levels of the document hierarchy when using non-primary buttons (use auxclick, instead, to capture these events).
  • Greatly improved the performance of box shadows.
  • Greatly improved the performance of file/data uploads over HTTP/2 (most of the secure websites out there).
  • Fixed several issues related to focus and content selection.
  • Fixed issues with the use of focus-within caused by unexpected processing of DOM events.
  • Fixed an issue with CSP not behaving as-expected when using importScripts(), and fixed a number of additional CSP-related issues.
  • Fixed a web compatibility issue with CORS preflights not sending the original request's referrer policy or referrer header.
  • Fixed a spec compliance issue with StructuredClone.
  • Fixed a crash due to clamping code introduced for SetInterval and SetTimeout timers.
  • Fixed crashes when dynamic imports are canceled (e.g. by navigation).
  • Changed <input type=file> to now have its .files property be writable following a spec change and recommendation.
  • We are now requiring and building against the C++17 language standard.
  • Updated the in-tree ffvpx lib to 6.0.
  • Added a preference to allow users to completely disable reporting of CSP errors to webmasters. Using this is strongly discouraged as it will provide essential troubleshooting information to webmasters setting up CSP, and does not pose a privacy issue, but for those who really want it, it can now be fully disabled. The preference is security.csp.reporting.enabled.
  • Updated the IntersectionObserver interface to now also accept documents for the observer root instead of only HTML elements.
  • Cleaned up various bits of code surrounding GMP, memory allocation, system libraries, vestigial Android code, freetype2 and developer tools.
  • Improved efficiency of handling D3D textures.
  • Added initial and experimental Mac PowerPC and Big Endian support.
  • Added preferences for the user to control whether or not the tab page title should be included in the window title or not. In Private Browsing mode, the default is now to not show the title in the window. This was done to avoid potential leakage to system logs (e.g. GNOME shell logs or Windows event logs) of websites visited through the recorded window title. The new preferences are privacy.exposeContentTitleInWindow and privacy.exposeContentTitleInWindow.pbm for normal mode and Private Browsing mode, respectively.
  • Fixed several crashes in DOM and relating to dynamic JavaScript module imports.
  • Removed a restriction on Fetch preflight redirects, following a spec update.
  • Improved the handling of web workers if they get aborted mid-action.
  • Linux releases on both x86_64 and aarch64 are now built with GCC 11 and Oracle Linux 8.
  • Linux aarch64 releases are no longer considered to be in beta. Autoupdates will now work for Linux aarch64 builds moving forward.
  • Linux aarch64 builds are now available with both GTK2 and GTK3.
  • Refactored easy build shell script to use Oracle Linux 8 and GCC 11.
  • Refactored easy build shell script to work on both x86_64 and aarch64.
  • Changed some default Basilisk networking preferences to better respect privacy and security out of the box.
  • Fixed broken security section in the Page Info window.
  • Security issues addressed: CVE-2023-6863, CVE-2023-6858, CVE-2024-0746, CVE-2024-0741, CVE-2024-0743 DiD, CVE-2024-0750 DiD, and CVE-2024-0753.
  • UXP Mozilla security patch summary: 7 fixed, 4 DiD, 1 rejected (which was DiD at best), 34 not applicable.

New in Basilisk 2023.12.09 (Dec 11, 2023)

  • This is a minor development and security update.
  • Important: as of this version, our beta FreeBSD binaries require at least FreeBSD 13.
  • We no longer support the data: protocol inside SVG's <use> statements.
  • Enabled more validation/error checking for WebGL on Windows to prevent potential crashes.
  • Improved secure context checking for iframes.
  • Fixed the handling of relative paths in URLs starting with multiple forward slashes.
  • Linux ARM64 was built with Clang instead of GCC due to issues with GCC on that platform.
  • Security issues addressed: CVE-2023-6204, CVE-2023-6210, CVE-2023-6209 and CVE-2023-6205 DiD
  • UXP Mozilla security patch summary: 3 fixed, 1 DiD, 14 not applicable.

New in Basilisk 2023.11.05 (Nov 6, 2023)

  • This is a major development and security update:
  • Added an initial implementation of the ReadableStreams API, improving web compatibility with sites that apparently use this API in utilitarian fashion.
  • Added support for transparency in WebM videos for the edge case of using <video> elements for transparent animated images. Major caveat: this will massively impact performance of video playback if an alpha channel is present in the video.
  • Added support for crypto.randomUUID to allow website scripting to generate random UUIDs (universally unique identifiers) through the WebCrypto interface.
  • Removed the user-agent override for Netflix, since they have stopped supporting the Silverlight browser plugin. Basilisk no longer has a way to provide Netflix DRM-controlled playback with them dropping it, so there is no longer a reason to try and force compatibility.
  • Updated the user-agent override for Spotify. While it is possible to use the website with this, it suffers from the same DRM issue and not all media will be playable (only non-encumbered media can be played in Basilisk like podcasts). Your mileage may vary.
  • Implemented timer nesting and clamping for workers, preventing timer hangs on bad website code.
  • Improved handling of drawing SVG images on canvases without explicit width or height attributes. We now follow the css-sizing-3 Intrinsic Sizes spec.
  • Improved performance of our memory allocator.
  • Updated libvpx to 1.6.1.
  • Cleaned up and updated some media playback code.
  • Removed the last vestiges of EME/DRM code from UXP, since this will never be supported in any application building on it due to the media industry's draconic policies around FOSS.
  • Removed support for DRM from Basilisk as a followup to the EME/DRM removal in UXP.
  • Removed simd.js, moving actually used SIMD handling to C++.
  • Removed the use of libav in our source, replacing its supply of FFT with the equivalent from FFMpeg.
  • Fixed potential type confusion in IonMonkey due to 3-byte opcodes.
  • Fixed an issue with tooltips persisting even if the browser window would have lost focus.
  • Fixed PerformanceObserver navigation and resource timing (default disabled for privacy); our implementation now fully passes conformance tests.
  • Fixed an issue where top-level SVG images would not be correctly clipped by positioned elements, giving the impression of wrong z-ordering as the SVG would overlap other elements.
  • Dev: Updated setInterval to fall back to 0 if no duration is supplied.
  • Dev: Updated ResizeObserver to a recent spec change, now returning an array of results for borderBoxSize and contentBoxSize instead of an object.
  • Dev: Updated Intl.NumberFormat and DefaultNumberOption() to follow spec updates. Most importantly for web compatibility, we now allow the "maximumFractionDigits" option in Intl.NumberFormat to be less than the default minimum fraction digits for the chosen locale, following the general consensus in TC39 around this issue.
  • Increased leniency (removed upper limit) of GLSL versions as they tend to be fully backwards compatible.
  • Fixed various crashes.
  • Added a safeguard to the sec-gpc header (Global Privacy Control) so it cannot be inadvertently overwritten.
  • Removed the 360 Secure Browser profile migrator from Basilisk.
  • WebRTC Spec Improvements.
  • Add ability toggle WebRTC and WebAssembly under Tools->Preferences->Content.
  • Enable PerformanceObserver by default in Basilisk.
  • Security fixes: addressed CVE-2023-5722, CVE-2023-5723, CVE-2023-5724, CVE-2023-5727 and several other issues without a CVE number assigned to them.
  • UXP Mozilla security patch summary: 6 fixed, 2 DiD, 19 not applicable.

New in Basilisk 2023.10.03 (Oct 3, 2023)

  • This is a bugfix and a critical security update:
  • Added WASM sign extension opcodes.
  • Added GTK version to "Help->About" on GTK builds.
  • Removed some unused Android/b2g/iOS code from Basilisk.
  • Removed some obsolete Crash Reporter and Error Reporting code from Basilisk.
  • Remove some unused code related to Mozilla telemetry from Basilisk.
  • Remove some unused stub functions from Basilisk.
  • Remove obsolete prefs related to the previously mentioned code removals from Basilisk.
  • Rewrite some code in Basilisk to use the text preprocessor at build time instead of AppConstants at run time.
  • Set Basilisk to always ask where to save files by default.
  • Fixed an issue in BigInt typedArray costructors.
  • Added some safety checks for Performance Observers.
  • Fixed JSON BigInt regressions.
  • Upgraded usrsctp library to a version over 5 years newer, fixing various security issues and potential bugs in sites using WebRTC DataChannels.
  • Fixed an issue with libvpx encoding (CVE-2023-5217)
  • Fixed an issue with dead Promise wrappers in JavaScript DiD
  • Fixed an issue with Alternative Services DiD

New in Basilisk 2023.09.15 (Sep 16, 2023)

  • This is a critical security update.
  • Fixed a WebP decoder issue (CVE 2023-4863)
  • Rebase our PDF.js version on files from the Seamonkey PDF.js addon as well as files ported from Firefox 60.9.0. This upgrades our PDF.js version to 2.3.235, which pulls in almost 3 years of security updates and bugfixes.
  • Following the discussion in this forum post, we've introduced GTK2 builds of Basilisk for Linux.

New in Basilisk 2023.09.12 (Sep 13, 2023)

  • Implemented the BigInt primitive type for JavaScript. See implementation notes.
  • Implemented Big(U)Int64 array support.
  • Implemented ergonomic brand checks for JavaScript class fields.
  • Aligned the Performance API with the Timeline v2 spec.
  • Aligned the handling of flex/grid percentages resolving against the parent with other browsers. See implementation notes.
  • Added or updated several user-agent overrides for problematic websites.
  • Added 2 preferences to allow users to disable CSS animations and transitions. See implementation notes.
  • Improved compatibility with MacOS 14.
  • Fixed an important, intermittent JavaScript crash related to garbage collection.
  • Fixed several crashes.
  • Fixed several debug build related issues.
  • Fixed an issue building on SunOS related to the spelling library.
  • Updated PDF.js to 1.6.467 from Firefox 53.
  • Developer: Added ASan support for building with MSVC.
  • Developer: Implemented automated builds using GitHub Actions and automated process of mirroring Basilisk to GitHub.
  • Added the .xll file extension to the executable extensions list.
  • Security issues addressed: several potential security issues that do not have a CVE number. DiD
  • UXP Mozilla security patch summary: 1 fixed, 3 DiD, 17 not applicable.
  • Implementation notes
  • The BigInt primitive (base number format) in JavaScript allows JavaScript to handle excessively large integers (whole numbers). This primitive is especially useful for specialized scientific applications that need very large yet accurate numbers, but has seen widespread adoption for an as of yet unknown reason as part of web frameworks, causing general web compatibility issues for Basilisk when scripts expect BigInt support and instead have an error thrown. We have now implemented this primitive for use so we no longer have compatibility issues with these frameworks. It is still unknown why BigInt is in use there and for what. Critical note: BigInt might be tempting to consider for JS-backed cryptography but this is very ill-advised, as BigInt operations are, by their nature, not constant-time and allow timing and side-channel attacks.
  • Flex and grid item sizes in percentages would previously be resolved against the parent like other elements, according to a very long-standing practice that stems from the Internet Explorer days. Mainstream browsers have, however, made an exception for flex items and grid items to no longer do this. We have now made the same exception for these types of elements which should solve layout issues on some websites (notably reserving too much space for items, often resulting in very large areas of whitespace or items being pushed out of view).
  • Two preferences were added (layout.css.animation.enabled and layout.css.transition.enabled) to allow users to completely disable CSS-based animations and transition effects. This was a request by users as both a performance and accessibility consideration. Please note that in some cases, disabling animations and transitions may have an impact on final web page layout, so you may run into some issues when disabling these animations and transitions as the web pages were designed to use them.

New in Basilisk 2023.07.18 (Jul 19, 2023)

  • This is a major development update, further improving web compatibility.
  • Added the (hidden) preference browser.history.menuMaxResults to allow users to control how many history entries are listed in the menu. Setting this to 0 will hide history menu entries altogether, and any positive number configures how many entries the entries are limited to. The default if not defined is 15.
  • Switched C++ language level used to C++14 on all platforms.
  • Web compatibility and scripting improvements:
  • Implemented geometry .from* static constructors for web compatibility.
  • Implemented partial support for CSS calc() in color keywords.
  • Implemented Array "find from last" feature (findLast and findLastIndex).
  • Implemented Object.hasOwn(object,property).
  • Implemented several additional Intl API methods and functions. This improves web compatibility with sites making use of things like hourCycle, advanced DateTimeFormat, Intl.Locale, and Intl as a constructor.
  • Cleaned up some unused code.
  • Removed support for Mozilla "experiment" type extensions.
  • Improved the JavaScript garbage collector's sweeping. This should fix a few intermittent crashes and improve performance.
  • Implemented some structural changes to the source to make future porting easier, and preparing for switching to C++17.
  • Removed handling of symlinks for directory listings to prevent potential security issues by walking symlinks when uploading. This effectively reverts a change made in Firefox 50 where this functionality was introduced. A case of "Not such a good idea after all" ;-)
  • Updated the list of extensions on Windows treated as "executable".
  • Security issues addressed: CVE-2023-37208.
  • Made preparations for requiring Authorization in CORS ACAH preflight.
  • Since no browser honors this part of the spec at the moment this is left disabled until there is consensus among browsers.
  • Fixed intermittent crashes related to the performance API.
  • Fixed intermittent issues with JavaScript malfunctioning in chrome scripts (causing faults in the UI and extensions).
  • Added ability to specify build version in mozconfig when compiling Basilisk.
  • UXP Mozilla security patch summary: 2 fixed, 2 rejected, 20 not applicable.

New in Basilisk 2023.06.20 (Jun 20, 2023)

  • This is a small bugfix and stability update.
  • There were no applicable Mozilla security bugs this time around.
  • Fixed a crash in devtools in some OOM situations.
  • Fixed crashes when internal script execution was blocked by extensions.
  • Fixed crashes with WebComponents' ::slotted selector.
  • Disabled incremental cycle collector by default to avoid performance regressions.
  • Updated the default override for chase.com to work around issues.

New in Basilisk 2023.05.17 (May 17, 2023)

  • This updates the UXP/Goanna platform version to 6.2.
  • Implemented dynamic module imports. See implementation notes.
  • Implemented exporting of async functions in modules.
  • Implemented JavaScript class fields. See implementation notes.
  • Implemented logical assignment operators ||=, &&= and ??=.
  • Implemented a solution for websites using the officially deprecated ambiguous window.event. This is disabled by default but can be enabled through about:config's dom.window.event.enabled preference. See implementation notes.
  • Implemented self.structuredClone()
  • Implemented Element.replaceChildren. Once again primarily a web developer note.
  • Improved Shadow DOM :host matching.
  • Implemented WebComponents' CSS ::slotted() and related functionality.
  • Improved page caching in our memory allocator.
  • Added support for FFmpeg 6.0, especially important for bleeding-edge Linux distros.
  • Fixed a potential drawing deadlock for images, specifically SVG. This solves a number of hang-on-shutdown scenarios.
  • Fixed various crashes related to WebComponents and our recent JavaScript work.
  • Fixed various build-from-source issues on secondary target platforms.
  • Fixed handling of async (arrow) functions declared inside constructors.
  • Fixed various small JavaScript conformance issues.
  • Fixed an issue where JavaScript (only in modules) would not properly create async wrappers.
  • Updated the DOM Performance API to the current spec (User Timing L3).
  • See implementation notes, especially if you intend to use this in web content for critical functionality.
  • Updated keypress event handling to send keypress events on Ctrl+Enter.
  • Updated internal JavaScript structures to make future porting easier, as well as improve JavaScript performance.
  • Updated window handling and styling on Mac.
  • Updated the Freetype lib to 2.13.0.
  • Updated the Harfbuzz lib to 7.1.0.
  • Updated our DNS lookup calls to use inet_ntop() instead of the deprecated inet_ntoa().
  • Updated the Fetch API to use the global's base URL instead of the entry document's base URL for spec compliance.
  • We no longer support the outmoded fontconfig on GTK systems.
  • We no longer parse or return the body of known-empty responses from servers (content-length of 0, or in case of HEAD or CONNECT methods).
  • Implemented scaled font caching on GTK, improving performance.
  • Fixed a build issue when building for Linux on ARM64 on later distros.
  • Split out more parts of the browser into separate .dll files on Windows to reduce compiler strain and an oversized xul.dll
  • Removed mozilla::AlignedStorage (code cleanup).
  • Builds for FreeBSD now use xz for packaging instead of bzip2.
  • Merged the preference dom.getRootNode.enabled into the dom.webcomponents.enabled pref. See implementation notes.
  • Fixed a potential DoS issue with JPEG decoding.
  • Fixed a potential issue in Windows widget code that could lead to crashes.
  • Disabled potentially hazardous external protocols on Windows.
  • Added known-problematic .dlls to the internal blocklist.
  • Security issues addressed: CVE-2023-32209, CVE-2023-32214 and several others that do not have a CVE designation.
  • UXP Mozilla security patch summary: 4 fixed, 1 rejected, 27 not applicable.
  • Implementation notes:
  • JavaScript modules have various methods of being loaded into web page content. One of the later introduced methods is a function-style import() declaration, so-called "dynamic module imports" that has been used by various web frameworks, causing issues for Basilisk resulting in blank pages in most cases (since the websites would not actually use document structure HTML, but rather JavaScript to create content, all from imported modules). This has been a major web compatibility issue lately and we're pleased to announce that this complex bit of machinery has been implemented.
  • JavaScript's language specification is continuing to be watered down from a prototyping language towards a more "C-like" hybrid. As part of that effort, JavaScript classes were introduced in ECMAScript 6, and now further expanded in ES2022 with class fields and private class fields/methods, as well as statics. We should have a complete implementation of this now, which constitutes the more important parts of the ES2022 language update.
  • The use of the outdated Microsoft Internet Explorer global window.event has been a pervasive web compatibility issue for us, especially since it was officially deprecated and we never implemented this ambiguous and unreliable property that is highly-context sensitive. Websites should use the event as passed into the event handler to get the event source instead. However, since neither Chrome nor Firefox have dropped this and seem to be playing a game of "chicken", it remains in use on the web. To deal with this conflict, we have now implemented the equivalent behind a preference to enable users to (temporarily) use the global window.event while webmasters update their websites. We hope the Google camp will finally drop this one soon so we can be done with this legacy quirk. will finally drop this one soon so we can be done with this legacy quirk.
  • The DOM Performance API was updated to the User Timing level 3 spec. It should be critically noted that the DOM Performance API was never designed to be used as a matter of course on published content, and was designed only for page performance analysis use by web designers. Of course, as part of making dev tools available to the web, a lot of abuse ensued because of the accurate navigation and timing measurements that this API can provide (looking at you, Google!). Because of tight integration with web content analysis, the older spec implementation we had was causing issues and actually breaking some services, so we updated it, but with a few important key differences:
  • In Basilisk, we keep navigation timing disabled because it's a notable privacy issue for the data it can gather (exact navigational events and timings). If you're a web dev and need these timing measurements, you can enable them with dom.enable_performance_navigation_timing.
  • Our implementation, contrary to the spec, does not allow unlimited recording of performance events (effectively logging every page event!) which can also rapidly eat up memory. Instead we enforce a sane default quota that should be roomy enough for all legitimate use, but prevents runaway resource use or extensive logging of user actions.
  • If the set quota is reached, a warning will be printed in the console and the recorded performance events will be thrown away. If you (foolishly) rely on Performance API events for your web application to function, be aware this may cause compatibility issues as the API was, again, not designed to be used in such a fashion. For event handling, there are much better alternatives available which do not involve extensive recording of user data or relying on a developer tool API.
  • We've historically implemented the DOM getRootNode function as it was being used in the wild as a standalone function, however its main intent has always been to be a helper function part of Shadow DOM/WebComponents. As such we have now merged the preference into the WebComponents preference, enabling and disabling it along with the rest of our WebComponents implementation.

New in Basilisk 2023.05.01 (May 1, 2023)

  • Fixed a crash in CompareDocumentPosition with Shadow DOM.
  • Fixed a crash with display:contents styling.
  • Added a preference to disable the TLS 1.3 protocol downgrade sentinel (see implementation notes).
  • Changed the way large clipboard copy/paste operations are handled, improving privacy (see implementation notes).
  • Improved filename safety when saving files to prevent potential environment leaks (bis).
  • Improved sanity checks of MIME type headers.
  • Security issues addressed: CVE-2023-29545 and CVE-2023-29539.
  • UXP Mozilla security patch summary: 2 fixed, 1 rejected, 49 not applicable.
  • Implementation notes :
  • Some proxies and middleware boxes improperly handle the TLS 1.3 protocol handshake causing an insecure downgrade to TLS 1.2. With our recent update of NSS, Basilisk no longer allows this kind of protocol downgrade when trying to establish a TLS 1.3 connection to a server. The resulting error is ssl_error_rx_malformed_server_hello with an inability to connect to the server. To enable users to still connect to the servers or devices in question, we've added an option to switch off the downgrade sentinel. To switch it off as a temporary workaround, set security.tls.hello_downgrade_check to false.
  • If copy and paste operations to/from the browser are performed, Basilisk writes clipboard contents to disk in a temporary cache file if the copy/paste amount is particularly large, to avoid using large amounts of memory to hold this data. The average paste/clipboard size doesn't tend to hit this limit in which case it is just held in memory.
  • Previously, these cache files, while in the O.S. temporary file location (%TEMP% or /tmp), would not be consistently cleaned up, potentially causing privacy issues if persisted. This was changed to using auto-cleaning anonymous temp files, improving user privacy and relying less on the O.S. or user performing cleanup of temporary file storage. Thanks to Sandra for pointing this out and providing the patch.

New in Basilisk 2023.04.04 (Apr 6, 2023)

  • Shadow DOM and CustomElements, collectively making up WebComponents, have been enabled by default which should bring much broader web compatibility to the browser for many a site that uses web 2.0+ frameworks. See implementation notes.
  • Tab titles in the browser now fade if they are too long instead of using ellipses, to provide a little more readable space to page titles. Note that this may require some updates to tab extensions or themes.
  • A number of site-specific overrides have been updated or removed because they are no longer necessary or current with the platform developments in terms of web compatibility. We could use your help evaluating the ones that are still there; see the issue on the Pale Moon repo.
  • Updated our promises and async function implementation to the current spec.
  • Implemented Promise.any()
  • Fixed several crashes related to regular expression code.
  • Improved regular expression object handling so it can be properly garbage collected.
  • Fixed some VP8 video playback.
  • Fixed an issue where the caret (text cursor) would sometimes not be properly visible.
  • Updated the embedded emoji font.
  • Implemented the :is() and :where() CSS pseudo-classes.
  • Implemented complex selectors for the :not() CSS pseudo-class.
  • Implemented the inset CSS shorthand property.
  • Implemented the env() environment variable CSS function. See implementation notes.
  • Implemented handling for RGB encoded video playback (instead of just YUV).
  • Implemented handling for full-range videos (0-255 luminance levels) giving better video playback quality.
  • Removed the WebP image decoder pref. See implementation notes.
  • Enabled the Web text-to-speech API by default (only supported on some operating systems).
  • Updated NSPR to 4.35 and NSS to 3.79.4
  • Cleaned up unused "tracking protection" plumbing. See implementation notes.
  • Cleaned up URI Classifier plumbing (Google SafeBrowsing leftover).
  • Fixed several intermittent and difficult-to-trace crashes.
  • Improved content type security of jar: channels. DiD
  • Improved JavaScript JIT code generation safety. DiD
  • Fixed potential crash scenarios in the graphics subsystem. DiD
  • Improved filename safety when saving files to prevent potential environment leaks.
  • Introduced Basilisk beta builds for FreeBSD, aarch64 Linux, ARM macOS, and Intel macOS. (thanks dbsoft!)
  • Security issues addressed: CVE-2023-25751, CVE-2023-28163 and several others that do not have a CVE.
  • UXP Mozilla security patch summary: 1 fixed, 4 DiD, 14 not applicable.

New in Basilisk 2023.03.07 (Mar 8, 2023)

  • This is a bugfix update:
  • Revert tab title fading feature that was added in v2023.03.04. Caused various issues with tab titles and addons such as Tab Mix Plus.

New in Basilisk 2023.03.04 (Mar 5, 2023)

  • This is a bugfix and security update.
  • Fixed a crash in the new regular expression code.
  • Added {Extended_Pictographic} unicode property escape to regular expressions.
  • Fixed a regression in regular expressions for literal parsing of invalid ranges.
  • Updated NSS to pick up fixes.
  • Security issues addressed: CVE-2023-25733 DiD, CVE-2023-25739 DiD and CVE-2023-0767.
  • UXP Mozilla security patch summary: 1 fixed, 2 DiD, 14 not applicable.

New in Basilisk 2023.01.26 (Jan 26, 2023)

  • Most important changes:
  • Implemented Regular Expression named capture groups.
  • Implemented Regular Expression unicode property escapes.
  • Re-implemented Regular Expression lookaround/lookbehind (without crashing this time ;) ).
  • Implemented progressive decoding for JPEG-XL.
  • Implemented animation for JPEG-XL.
  • Renamed CSS offset-* properties to inset-* to align with the latest spec and the web.
  • Fixed CSS inheritance and padding issues in some cases.
  • Aligned parsing of incorrectly duplicated HSTS headers with expected behavior (discard all but the first one).
  • Implemented a method to avoid memory exhaustion in case of (very) large resolution animated images.
  • Updated the JPEG-XL and Highway libraries to a recent, stable version.
  • Cleaned up some unused CSS prefixing code.
  • Improved the ability to link on *nix operating systems with other linkers than gcc's default.
  • Stability improvements (potential crash fixes).
  • Security issues addressed: CVE-2023-23598, CVE-2023-23599 and several others that do not have a CVE number.
  • UXP Mozilla security patch summary: 4 fixed, 2 DiD, 19 not applicable.

New in Basilisk 2023.01.07 (Jan 8, 2023)

  • Added support for the JPEG-XL image format.
  • Implemented regular expressions lookaround/lookbehind.
  • Aligned CORS header parsing with the updated spec. See implementation notes.
  • We no longer fire keypress events for non-printable keys. See implementation notes.
  • Added support for MacOS 13 "Ventura" in the platform, primarily benefitting White Star.
  • Fixed potentially problematic thread locking code on *nix platforms.
  • Fixed some small issues in the display and operation of the Web Developer tools.
  • Removed unused but performance-impacting panning and tab animation measuring code. (telemetry leftovers)
  • Improved code for SunOS builds.
  • Updated Internationalization data for time zones.
  • Fixed a buffer overflow for Mac builds.
  • Fixed an issue with plugins not receiving keypress events properly.
  • Added some extra sanity checks to our zip/jar/xpi reader to avoid issues with corrupt archives.
  • Aligned cookie checks with RFC 6265 bis. See implementation notes.
  • Removed obsolete code in Windows widgets that could cause potential issues with long paths and file names on supported versions.
  • Fixed several crashes.
  • Security issues addressed: CVE-2022-45411, CVE-2022-46876, CVE-2022-46874 and several others that do not have a CVE number
  • UXP Mozilla security patch summary: 6 fixed, 1 DiD, 1 deferred, 45 not applicable.

New in Basilisk 2022.11.04 (Nov 6, 2022)

  • This is a security and compatibility update.
  • Note: The Basilisk branding has been removed from the Basilisk repository.
  • Added detection suport for the newly-released MacOS 13 (Ventura).
  • Fixed a potential heap Use-After-Free risk in Expat. (CVE-2022-40674) DiD
  • Fixed potentially undefined behavior in our thread locking code. DiD
  • Fixed a potentially exploitable crash in the refresh driver.
  • Fixed potentially undefined behavior when base-64 decoding. DiD
  • Implemented a texture size cap for WebGL to prevent potential issues with some graphics drivers. DiD
  • Updated site-specific overrides to address issues with ZoHo.
  • UXP Mozilla security patch summary: 1 fixed, 2 DiD, 6 not applicable.

New in Basilisk 2022.09.28 (Sep 29, 2022)

  • Implemented .at(index) JavaScript method on built-in indexables (Array, String, TypedArray).
  • Implemented the use of EventSource in workers.
  • Enabled the sending of the Origin: header by default on same-origin requests.
  • Changed how Basilisk is built. We have made build system changes to reduce build times and pressure on the linker on all platforms. Note that Basilisk is not yet built with Visual Studio 2022. This change will be done in the next release.
  • Changed how Basilisk handles standalone wave audio files (.wav). See implementation notes.
  • Improved string normalization.
  • Updated the handling of CSS "supports" to now accept unparenthesized strings (spec update).
  • Updated the handling of flex containers in web pages for web compatibility.
  • Fixed various issues when building for Mac OS X.
  • Fixed various C++ standard conformance issues in the source code.
  • Fixed several issues building on SunOS and Linux with various configurations and gcc versions.
  • Fixed an issue with regular expressions' dotAll syntax and usage. See implementation notes.
  • Switched custom hash map to std::unordered_map where prudent.
  • Cleaned up and updated IPC thread locking code.
  • Removed spacing for accessibility focus rings in form controls to align styling of them with expected metrics.
  • Removed the unnecessary control module for building with non-standard configurations of the platform.
  • Removed the -moz prefix from min-content and max-content CSS keywords where it was still in use.
  • Updated the search engines included with Basilisk. Basilisk now includes the same search engines as Pale Moon.
  • Fix issue where PDF.js was completely broken in the previous release.
  • Fixed an important stability and performance issue related to hardware acceleration.
  • Implemented Global Privacy Control in the Basilisk settings.
  • Fix issue where the 32-bit Windows installer would not execute on 32-bit Windows systems.
  • Remove Mozilla related default bookmarks. Update default bookmarks.
  • Update compatmode override for Firefox to 102.0.
  • Update user agent overrides to improve compatibility with Facebook.
  • Security fixes: CVE-2022-40956 and CVE-2022-40958.
  • UXP Mozilla security patch summary: 2 fixed, 11 not applicable.

New in Basilisk 2022.08.06 (Aug 7, 2022)

  • Fixed several application crash scenarios. DiD
  • Fixed a number of thread locking/mutex issues. DiD
  • Fixed a leak of content types due to inconsistent error reporting. (CVE-2022-22760)
  • Fixed an issue with iframe sandboxing not being properly applied. (CVE-2022-22759)
  • Fixed a potential leak of bookmarks from the exported bookmarks file if it included a malicious bookmarklet.
  • Fixed an issue with drag-and-drop. (CVE-2022-22756)
  • Fixed a potential crash due to truncated WAV files.
  • Fixed a memory safety issue with XSLT. (CVE-2022-26485)
  • Fixed a potential crash issue on bing.com.
  • Fixed some thread locking issues. DiD
  • Worked around a Mesa driver bug that could cause crashes.
  • Fixed a potential resource access issue in devtools. DiD
  • Security issues with CVEs addressed: CVE-2022-1097, CVE-2022-28285 (DiD) and CVE-2022-28283 (DiD).
  • Implemented Global Privacy Control, taking the place of the unenforceable "DNT" (Do Not Track) signal. Through GPC, you indicate to websites that you do not want them to share or sell your data.
  • Implemented "optional chaining" (thanks, FranklinDM!).
  • Implemented setBaseAndExtent for text selections.
  • Implemented queueMicroTask() "pseudo-promise" callbacks.
  • Implemented accepting unit-less values for rootMargin in Intersection observers for web compatibility, making it act more like CSS margin as one would expect.
  • Improvements to CSS grid and flexbox rendering and display following spec changes and improving web compatibility.
  • Improved performance of parallel web workers in JavaScript.
  • Improved display of cursive scripts (on Windows). Good-bye Comic Sans!
  • Updated various in-tree libraries.
  • Added support for extended VPx codec strings in media delivery via MSE (RFC-6381).
  • Fixed a long-time regression where the browser would no longer honor old-style body and iframe body margins when indicated in the HTML tags directly instead of CSS. This improves compatibility with particularly old and/or archived websites.
  • Fixed several crashes and stability issues.
  • Removed all Google SafeBrowsing/URLClassifier service code.
  • Restored Mac OS X code and buildability in the platform.
  • Removed the non-standard ArchiveReader DOM API that was only ever a prototype implementation.
  • Removed most of the last vestiges of the invasive Mozilla Telemetry code from the platform. This potentially improves performance on some systems.
  • Removed leftover Electrolysis controls that could sometimes trick parts of the browser into starting in a (very broken) multi-process mode due to some plumbing for it still being present, if users would try to force the issue with preferences. Obviously, this was a footgun for power users.
  • Removed more Android/Fennec code (on-going effort to clean up our code).
  • Removed the Marionette automated testing framework.
  • Security issues addressed: CVE-2022-29915, CVE-2022-29911, and several issues that do not have a CVE number.
  • Implemented "nullish coalescing operator" (thanks, FranklinDM!) for web compatibility.
  • Fixed various crash scenarios in XPCOM.
  • Fixed an important stability and performance issue related to hardware acceleration.
  • Fixed a long-standing issue where dynamic datalist updates for <select> and similar elements wouldn't properly update the option list.
  • Disabled broken links to MDN articles in developer tools.
  • Updated media support to include support for libavcodec 59/FFmpeg 5.0 for MP4 playback on Linux (thanks, Travis!)
  • Enabled the date picker for <input type=date>. See implementation notes.
  • Re-enabled the use of FIPS mode for NSS. See implementation notes.
  • Improved memory handling and memory safety in the JavaScript engine, further reducing current and future crash scenarios.
  • Improved memory handling in the graphics subsystem of Goanna.
  • Updated FFvpx to v4.2.7
  • Slightly reduced strictness of media checking for improved compatibility with questionable "gif" video encoders used on major websites.
  • Cleaned up the way file pickers (file open/save/save as dialogs) are handled on Windows.
  • Restored the gMultiProcessBrowser property of the browser for Firefox extension compatibility. See implementation notes.
  • Improved the way data is transferred to and from canvases to prevent memory safety issues.
  • Reduced blocking severity for some extensions that were marked hard blockers for GRE (but aren't for UXP).
  • Security issues addressed: CVE-2022-31739, CVE-2022-31741, and other security issues that do not have a CVE number.
  • Updated the list of blocked external protocol handlers to combat abuse of OS-supplied services on Windows.
  • Fixed a potential issue with revoked site certificates when connecting through a proxy.
  • Updated site-specific user agent overrides to work around bad sniffing practices of dropbox and vimeo.
  • Security issues addressed: CVE-2022-34478, CVE-2022-34476, CVE-2022-34480 DiD, CVE-2022-34472, CVE-2022-34475 DiD, CVE-2022-34473 DiD, CVE-2022-34481 and a memory safety issue that doesn't have a CVE number.
  • Implemented CSS white-space: break-spaces for web compatibility.
  • Implemented Intl.RelativeTimeFormat for web compatibility.
  • Implemented "Origin header CSRF mitigation". This is still disabled by default to investigate potential issues with CloudFlare-backed sites.
  • Implemented support for async generator methods in JavaScript.
  • Added preliminary support for building on Apple Silicon like M1/M2 SoC.
  • Added support for building with Visual Studio 2022.
  • Improved the handling of CSS "sticky" elements in tables.
  • Improved stack size limits on all platforms. See implementation notes.
  • Updated function.toString handling to align with the updated JavaScript spec. This should improve web compatibility.
  • Updated Unicode support to Unicode v11, and updated the ICU library accordingly. Building without ICU is no longer supported.
  • Updated many in-tree third-party libraries to pick up various performance and stability improvements.
  • Updated site-specific user-agent overrides to work around issues with Google fonts, Citi bank (again!) and MeWe.
  • Removed some leftover (and unused) telemetry code in the platform and front-end.
  • Fixed an issue with VP9 video playback on Windows on some systems.
  • Fixed an issue with the add-ons manager not properly handling empty update URLs.
  • Fixed a major performance regression on *nix based systems due to incorrect thread handling.
  • Fixed volume handling when building with the sndio audio back-end.
  • Cleaned up some unnecessary code from the source tree for unused build back-ends, Firefox marketplace "apps", and the rather ridiculous moz://a protocol handler.
  • Updated NSS to 3.52.8 to pick up several defense-in-depth security fixes.
  • Basilisk profile directory changed to reflect vendor change in application.
  • Restore ability to build Basilisk on Mac OS X.
  • Removal of telemetry code from Basilisk.
  • UXP Mozilla security patch summary: 11 fixed, 14 Did, 4 rejected, 91 not applicable

New in Basilisk 2022.01.27 (Jan 27, 2022)

  • Important: This is the final public release of Basilisk from the original developer. As such, it comes without an internal updater and will not check for future updates to the application.
  • To remain updated and secure, it is recommended at this point that you look for a different web browser like Pale Moon to continue browsing in a safe and secure manner.
  • Be mindful of hacks: There are currently no people eligible to continue Basilisk as a product under the Basilisk name. If you see any future updates claiming/pretending to be official Basilisk or an official continuation, they are most likely scams and should not be trusted with your browsing.
  • Improved application library loading security. DiD
  • Fixed an issue in JavaScript serialization. DiD
  • Fixed a potential out-of-bounds issue in IndexedDB. DiD
  • Fixed a potential issue in widget data handling code. DiD
  • Fixed potentially exploitable crashes in handling truncated/corrupt media files or streams.
  • Fixed an issue in the DOM FileReader code.
  • Updated NSS to 3.52.3 to address a security issue.
  • Updated the installer to fix a rights elevation issue.
  • Fixed the following security issues: CVE-2022-22736, CVE-2022-22741, CVE-2021-4140, CVE-2022-22746, CVE-2022-22744 and CVE-2022-22747.

New in Basilisk 2021.12.13 (Dec 14, 2021)

  • Added some extra sanity checks to timers and text fragments.
  • Added a potential crash safeguard in program threading logic.
  • Security issues addressed: CVE-2021-43537, CVE-2021-43541, CVE-2021-43536, CVE-2021-43545 and CVE-2021-43542.
  • Mozilla Security Patch Summary: 5 fixed, 3 DiD, 10 not applicable.

New in Basilisk 2021.11.14 (Nov 14, 2021)

  • Fixed overall browser bustage due to branch confusion and telemetry removal.

New in Basilisk 2021.11.13 (Nov 13, 2021)

  • This is a development, bugfix and security update:
  • Fixed several intermittent thread sanity issues.
  • Added a preference to enable compatibility mode with earlier TLS 1.3 specifications.
  • Fixed several potentially crashy code issues (DiD).
  • Security issues addressed: CVE-2021-38508 and CVE-2021-38503.
  • Mozilla Security Patch Summary: 3 fixed, 5 DiD, 19 not applicable.

New in Basilisk 2021.09.27 (Sep 27, 2021)

  • Implemented promise.allSettled().
  • Implemented global origin on windows and workers.
  • Improved performance of memory allocations.
  • Updated SQLite to 3.36.0.
  • Fixed several crashes.
  • Security issues addressed: CVE-2021-38492.
  • Mozilla Security Patch Summary: 1 fixed, 7 DiD, 22 not applicable.

New in Basilisk 2021.07.19 (Jul 20, 2021)

  • This is a development, bugfix and security update:
  • Enabled brotli compression for http for sites that support it.
  • Implemented EventTarget as a constructor.
  • Updated Windows 10 toolkit styling.
  • Updated the port blacklist (removed 10080).
  • CSS: Implemented calc() and animation support for stroke-dashoffset.
  • Added support for checking boolean preferences to chrome CSS style sheets, to support more advanced theming options.
  • Added support for dynamic dark color capable themes in CSS.
  • Updated ResizeObserver implementation to a more recent specification.
  • Removed a metric ton of Macintosh code.
  • Removed obsolete system theme support from the layout engine.
  • Fixed several crashes.
  • Linux: blocked particularly old versions of Mesa/Nouveau drivers due to issues.
  • Security issues addressed: CVE-2021-30547 and several other issues that don't have a CVE number.
  • Unified XUL Platform Mozilla Security Patch Summary: 3 fixed, 3 DiD, 2 deferred (DiD), 12 not applicable.

New in Basilisk 2021.04.27 (Apr 28, 2021)

  • This is a development, bugfix and security update
  • Enabled the scrollbar-width CSS keyword by default
  • Removed unit restriction on SVG width and height attributes
  • Implemented prefers-color-scheme CSS keyword (defaults to "light")
  • Added CSS values smooth, high-quality and pixelated to the image-rendering keyword
  • Implemented Intl.NumberFormat.formatToParts() to allow deconstruction of localized number formats by scripts
  • Reinstated the dom.details_element.enabled preference and fixed a rendering issue with summary/details html elements
  • Fixed an issue with CSP .nonce attributes on elements
  • Added port restrictions for WebRTC PeerConnections to prevent network abuse through WebRTC connections
  • Fixed an overflow in clip paths, potentially causing them to be rendered incorrectly
  • Added a warning to opening from history if it would spawn many new tabs
  • Fixed forcing an icon type image even for invalid icons in search plugins
  • Security issues addressed: CVE-2021-23986, CVE-2021-23981 and defense-in-depth fixes for CVE-2021-29946, CVE-2021-23994, several crashes and potential document parser confusion
  • Unified XUL Platform Mozilla Security Patch Summary: 2 fixed, 5 defense-in-depth, 21 not applicable

New in Basilisk 2021.03.17 (Mar 18, 2021)

  • This is a small bugfix update
  • Changed the version of NSS to a custom build to address certificate import and (hopefully also) keygen issues
  • Updated the embedded emoji font for Yet More Professions With All Skin Colors&tm
  • Updated the YouTube Studio useragent for compatibility

New in Basilisk 2021.03.11 (Mar 12, 2021)

  • Added support for missing ES2019 JavaScript functions and specifications.
  • Fixed an issue with useragent updates.
  • Folder uploads through input elements now require user interaction on Windows 10.
  • Mitigated a potential problem with history location/state change updates if used in rapid succession.
  • Fixed a problem with WebCrypto failing to work properly with AES-GCM.
  • Updated various libraries for compatibility and security.
  • Fixed several memory safety hazards and potential browser crashes
  • Security issues fixed: CVE-2021-23973, CVE-2021-23974.
  • Unified XUL Platform Mozilla Security Patch Summary: 4 fixed, 2 defense-in-depth, 19 not applicable.

New in Basilisk 2021.02.06 (Feb 8, 2021)

  • This is a development, bugfix and security update
  • Added a preference (browser.tabs.allowTabDetach) to control whether "tearing off" of tabs is allowed
  • Updated some needed user-agent overrides for web compatibility with a few large sites
  • Added support for the scrollbar-width CSS keyword
  • Fixed a javascript performance issue
  • Enabled several platform features by default for web compatibility
  • Removed the use of <menuitem> in page content
  • Fixed several memory safety hazards and potential browser crashes
  • Security issues fixed: CVE-2021-23962, CVE-2021-23953 and ZDI-CAN-12197
  • Unified XUL Platform Mozilla Security Patch Summary: 4 fixed, 6 defense-in-depth, 22 not applicable

New in Basilisk 2021.01.05 (Jan 5, 2021)

  • This is a development and security update.
  • Fixed the display of dates and times to honor what the user has set in their regional settings.
  • Disabled the use of the legacy database format for stored passwords and certificates.
  • Worked around crashes and run-time issues with module scripts.
  • Moved the global user-agent override to the networking component. Please note that this may interfere with some "user agent spoofing" extensions.
  • Fixed a website layout issue with table-styled elements potentially overlapping when placed inside a flexbox.
  • Updated the list of prohibited ports the browser can use.
  • Updated NSS to 3.59.1
  • Security issues fixed: CVE-2020-26978 and CVE-2020-35112.
  • Unified XUL Platform Mozilla Security Patch Summary: 3 fixed, 16 not applicable.

New in Basilisk 2020.11.25 (Nov 26, 2020)

  • Aligned CSS tab-size with the specification and un-prefixed it.
  • Updated Brotli library to 1.0.9.
  • Updated JAR lib code.
  • Cleaned up HPKP leftovers.
  • Disabled the DOM filesystem API by default.
  • Removed Phone Vibrator API.
  • Fixed an issue where the software uninstaller would not remove the program files it should.
  • Fixed a devtools crash related to timeline snapshots.
  • Fixed several data race conditions.
  • Security issues fixed: CVE-2020-26960, CVE-2020-26951, CVE-2020-26956, CVE-2020-15999 and several memory safety hazards.
  • Unified XUL Platform Mozilla Security Patch Summary: 5 fixed, 4 defense-in-depth, 3 rejected, 19 not applicable.

New in Basilisk 2020.09.11 (Sep 12, 2020)

  • Updated JavaScript module loading in accordance with the spec for web compatibility.
  • Disabled a function related to WebComponents to prevent mis-detection.
  • Improved compatibility with websites that try to style standard form elements.
  • Updated the SQLite library to 3.33.0.
  • Changed media errors to be a more generic response, improving user privacy.
  • Improved code stability (fixed a number of crashes).
  • Updated the NSS library for various connection security fixes.
  • Security issues addressed in this release: CVE-2020-15664, CVE-2020-15666, CVE-2020-15667, CVE-2020-15668 and CVE-2020-15669.
  • Unified XUL Platform Mozilla Security Patch Summary: 4 fixed, 1 defense-in-depth, 1 rejected, 9 not applicable.

New in Basilisk 2020.06.10 (Jun 11, 2020)

  • Implemented URLSearchParams' sort() function
  • Implemented ES2020 globalThis for web compatibility
  • Implemented node.getRootNode() for web compatibility
  • Improved our WebM media parser to be more tolerant to different encoding styles.
  • Improved our MP3 media parser to be more tolerant to different encoding styles and particularly tiny files/stream chunks.
  • Improved performance of table drawing for more corner cases
  • Changed the way images without a src are handled in page layouts to align with the Chrome-pushed spec.
  • Added modern MIPS support
  • Split out the ICU data file from xul.dll on Windows
  • Fixed a regression in WebAudio channel handling due to a landed security fix.
  • Fixed a regression preventing scripting from properly disabling input controls
  • Fixed an issue with border radius sometimes not being honored in tables
  • Fixed some build issues in non-standard configurations.
  • Removed more telemetry code
  • Removed the in-browser speech recognition engine and API
  • Removed support for the obsolete and unmaintained NVidia 3DVision stereoscopic interface.
  • Changed handling of braille blanks in the ui (CVE-2020-12409)
  • Mitigated a potential timing attack against DSA keys in NSS (CVE-2020-12399)
  • Mitigated a potential use-after-free hazard in EME code.
  • Unified XUL Platform Mozilla Security Patch Summary: 1 fixed, 2 defense-in-depth, 7 not applicable.

New in Basilisk 2020.05.08 (May 8, 2020)

  • On-going work for implementing ShadowDOM v1, aligning the way DOM works as-needed.
  • On-going work for solving dependency issues in C++ throughout the entire tree.
  • Removed unused Contextual Identity Service.
  • Implemented URLSearchParams sort().
  • Enabled DOM High resolution timestamps.
  • Removed support for obsolete NV 3DVision stereoscopic hardware.
  • Fixed a potential vulnerability in the zip file reader. DiD
  • Fixed a potential vulnerability in the JavaScript JIT compiler related to aliases. DiD
  • Ported several upstream devtools fixes (addresses CVE-2020-12392 and CVE-2020-12393).
  • Ported upstream sctp fix (addresses CVE-2020-6831).
  • Improved memory safety of come WebAudio calls.
  • Improved memory safety in the XUL window destructor. DiD
  • Unified XUL Platform Mozilla Security Patch Summary: 4 fixed, 3 DiD (Defense-in-depth), 15 not applicable.

New in Basilisk 2020.04.17 (Apr 18, 2020)

  • This is a small compatibility update.
  • Enabled building of AV1 codec support (for real this time).

New in Basilisk 2020.04.15 (Apr 15, 2020)

  • Changed site-specific overrides to use an operating system macro instead of hard-coding a version.
  • Changed the way hardware acceleration is set on various operating systems.
  • Fixed an incorrect preference preventing automatic updates by default.
  • Changed the geolocation service requests to https thanks to a generous service donation by IP-API.com.
  • Changed the security storage database type to SQLite.
  • Enabled AV1 support in all builds; this was erroneously not built in recent releases.
  • Fixed several potential crashes.
  • Re-imported the ExtensionStorage js module for use by browser extensions.
  • Removed the use of high-resolution Windows system timers from the layout refresh driver; this should help with some performance and battery life issues.
  • Fixed an issue with element outlines sometimes being drawn too large.
  • Fixed an issue with grid cell sizing.
  • Fixed an issue with layout frames (e.g. selection popups) being wrongly positioned.
  • Removed a potentially dangerous and otherwise ineffective optimization from the JavaScript engine.
  • Fixed unwanted behavior where created/focused pop-up windows could potentially cover the DOM fullscreen notification, hiding it from users. (CVE-2020-6810)
  • Fixed an issue where copying data as a curl request from developer tools would not properly escape parameters. (CVE-2020-6811)
  • Updated our sctp library code with several upstream fixes.
  • Fixed an issue with the release of document content viewers (CVE-2020-6819). Defense-in-depth.
  • Fixed an issue with handling functions with rest parameters. Defense-in-depth.
  • Removed HTTP Public Key Pinning (HPKP)
  • Removed HSTS preloading list support since these lists are no longer efficient.

New in Basilisk 2020.03.11 (Mar 12, 2020)

  • This is a small bugfix and compatibility update.
  • Cleaned up front-end code.
  • Fixed behavior for YouTube to prevent the deprecated interface being selected again.

New in Basilisk 2020.03.04 (Mar 5, 2020)

  • This is a major development update:
  • New modular setup for building: Basilisk has been split off from the UXP platform repository and will be maintained as its own application with UXP as a platform module.
  • Implemented asynchronous iterators (await iterator.next() and for await loops) (ES2018)
  • Aligned document.open() with the overhauled specification.
  • Implemented promise-based media playback.
  • Enabled seeking to next frame in media files.
  • Improved table drawing performance again after the rewrite for sticky positioning making it slow.
  • Aligned the way DOM styles are computed with mainstream browser behavior.
  • Increased the maximum XML nesting depth to 2048 levels for extreme corner cases and to conservatively align with other browsers.
  • Implemented an NSS performance optimization for Master Password use with limited effect.
  • Implemented non-standard legacy CSSStyleSheet rules functions.
  • Implemented the html5 <dialog> element. To switch this on, flip dom.dialog_element.enabled to true.
  • Implemented CustomElements v1. (preffed, not functional yet due to reliance on shadowDOM).
  • Implemented rule processing stub for font-variation-settings.
  • Implemented optional catch binding (ES2019).
  • Changed the way hardware acceleration is controlled from applications.
  • Updated CSP processing to allow custom scheme wildcards to be specified without a port.
  • Removed the (unused) DOM promise implementation.
  • Disabled some logging in production builds.
  • Disabled allowing remote jar: URIs by default for security reasons. If you need this functionality for your non-standard environment, you can enable it with the preference network.jar.block-remote-files, but please consider moving away from this method of providing web-based applications.
  • Completely removed showModalDialog.
  • Performed various tree-wide code cleanups.
  • Removed various gadgeteering/redundant/dead DOM APIs (casting/presentation, FlyWeb)
  • Removed "Copy raw data" button from the troubleshooting information page, since it's never used by us in that format, and users mistakenly keep using it instead of copying text.
  • Removed a bunch of Android support code.
  • Backed out a large code cleanup patch for causing subtle issues in website operation (e.g. WordPress). This will have to be revisited later; the reintroduced code is not in use in practice.
  • Fixed several crashes.
  • Fixed a parsing issue with <template> tags.
  • Fixed an issue with form elements sometimes being incorrectly disabled.
  • Fixed some potential crashing scenarios with WebGL on Linux.
  • Fixed a potential pointer issue issue in cubeb. (DiD)
  • Fixed a crash due to ES6 modules (CVE-2020-9545).

New in Basilisk 2020.02.18 (Feb 18, 2020)

  • Fixed an issue in CSP blocking requests without a port for custom schemes.
  • Fixed a potentially hazardous crash in layers.
  • Fixed random crashes on some sites using IndexedDB.
  • Changed the way the application can be invoked from the command-line to prevent a whole class of potential exploits involving modified omnijars.
  • Fixed an issue in the HTML parser after using HTML5 template tags, allowing JavaScript parsing and execution when it should not be allowed, risking XSS vulnerabilities on sites relying on correct operation of the browser. (CVE-2020-6798)
  • Unified XUL Platform Mozilla Security Patch Summary: 2 fixed, 2 DiD, 10 not applicable.

New in Basilisk 2020.02.06 (Feb 7, 2020)

  • This is a small bugfix and compatibility update.
  • Backed out regular expression lookbehind code for causing crashes.
  • Fixed an issue where some poorly-implemented FTP servers could hang the browser.
  • Changed behavior for YouTube to prevent the deprecated interface being selected by default.

New in Basilisk 2020.01.12 (Jan 12, 2020)

  • This is a security, bugfix and development update.
  • Please note: from this release forward, windows archives are compressed with 7-zip, and Linux tarballs with xz.
  • Added sticky positioning feature to HTML table parts.
  • Removed the non-standard watch()/unwatch() debugging features. Some Firefox extensions will have to be updated to compensate for this.
  • Fixed retrieving of certificates in the certificate exception dialog.
  • Updated multiple third-party libraries, fixing numerous bugs.
  • Removed Adobe PrimeTime EME CDM support.
  • Enabled basic implementation of module type scripting.
  • Implemented additional JavaScript features (regex lookbehind, regex dot-all flag, regex .matchAll(), promise .finally()).
  • Disabled HPKP preload list and the HPKP feature by default.
  • Added support for Emoji 12 (Unicode 12.0).
  • Updated NSS to 3.41.4 to address CVE-2019-11756 and CVE-2019-11745.
  • Security issues fixed: CVE-2019-17019, CVE-2019-17026, and several potentially exploitable crashes and memory safety hazards that don't have a CVE number.
  • Unified XUL Platform Mozilla Security Patch Summary: 4 fixed, 15 DiD, 28 not applicable.

New in Basilisk 2019.10.31 (Oct 31, 2019)

  • This is a security and bugfix update.
  • Updated timezone data for internationalization functions.
  • Fixed the option to use hardware acceleration over RDP for Windows 8.1 and 10.
  • Fixed an issue with inner window navigation potentially leaking.
  • Fixed a startup crash caused by Qihoo 360 Safeguard/360 Total Security.
  • Ported some expat parser fixes from upstream.
  • Ported several NSS upstream fixes to our build.
  • Aligned handling of U+0000 in the html5 parser with expectations.
  • Added size checks to WebGL data buffering.
  • Fixed build issues with newer glibc versions.
  • Fixed build issues for ARM targets.
  • Worked around a gcc9 compiler issue that would prevent building with it.
  • Security issues fixed: CVE-2019-15903, CVE-2019-11757, CVE-2019-11763 and several potentially exploitable crashes and memory safety hazards that don't have a CVE number.
  • Unified XUL Platform Mozilla Security Patch Summary: 6 fixed, 6 DiD, 1 rejected, 24 not applicable.

New in Basilisk 2019.09.12 (Sep 13, 2019)

  • Fixed an issue where saving a webpage to disk would sometimes drop tags from the document.
  • Fixed an issue with click-to-play plugin content throwing up a blank notification.
  • Fixed an issue in the renderer where region intersections would sometimes return the wrong result.
  • This fixes a regression caused by the fix for CVE-2016-5252.
  • Fixed security issues: CVE-2019-11744, CVE-2019-11752, CVE-2019-11737, CVE-2019-11746, CVE-2019-11750, CVE-2019-11747 and CVE-2019-11738.
  • Unified XUL Platform Mozilla Security Patch Summary: 7 fixed, 1 DiD, 1 already covered, 22 not applicable.

New in Basilisk 2019.09.03 (Sep 3, 2019)

  • Implemented JavaScript parser improvements and several TC39 spec revisions for web compatibility.
  • Improved performance of the JavaScript engine.
  • Added support for gzip-compressed SVG-in-Opentype fonts.
  • Updated internationalization code to support updated time zones and the Japanese Reiwa era.
  • Updated NSS to a custom version to have better encryption strength for master passwords.
  • Added several performance improvements to DOM, the rendering engine and the parser.
  • Improved general security of access to FTP-sourced resources
  • Changed the way file access is handled from scripts to prevent cross-file access.
  • Fixed SVG alignment issues causing blurry display of SVGs.
  • Added support for Matroska media containers and AAC audio.
  • Fixed security issues: CVE-2019-11719, CVE-2019-11711, CVE-2019-11715, CVE-2019-11717, CVE-2019-11714 (DiD), CVE-2019-11729 (DiD), CVE-2019-11727 (DiD), CVE-2019-11730 (DiD), CVE-2019-11713 (DiD) and several networking and memory-safety hazards that do not have CVE numbers.
  • Fixed several memory safety hazards and crashes

New in Basilisk 2019.06.08 (Jun 9, 2019)

  • Removed unused code: contextual identity, crash reporter leftovers, SecurityUI telemetry, "enhanced" new tab tiles.
  • Updated the installer and internal updater.
  • Removed all Firefox Accounts code and replaced the Sync client for compatibility.
  • Implemented JavaScript parser improvements and the TC39 toString() revision proposal for web compatibility.
  • Improved handling of url() tokens in CSS to better handle incorrect syntax.
  • Updated the embedded emoji font for broader emoji coverage.
  • Fixed print failure for some web pages.
  • Fixed Linux XRender performance issues over remote connections (e.g. X2Go).
  • Improved JavaScript engine performance: dead compartment collection,
  • Fixed an address bar focus issue in Private Browsing mode.
  • Improved rendering performance for certain websites (with complex event regions).
  • Implemented several ECMAScript 2019 features (String trimStart/trimEnd, Array flat/flatMap, Symbol description)
  • Fixed security issues: CVE-2019-7317, CVE-2019-11701, CVE-2019-11698, CVE-2019-9817 (DiD), CVE-2019-11700, CVE-2019-11696 and CVE-2019-11693.
  • Fixed several memory safety hazards and crashes.

New in Basilisk 2019.03.27 (Mar 27, 2019)

  • Added several site-specific overrides for web compatibility.
  • Aligned http "Accept:" headers with the fetch spec, with the exception of image requests to continue allowing content negotiation.
  • Fixed potential denial-of-service issues involving FTP (loading of subresources and spamming errors).
  • Aligned URLSearchParams with the spec.
  • Fixed a corner case for flexbox layouts, improving rendering of some websites.
  • Fixed Widevine compatibility issues.
  • Fixed security issues: CVE-2019-9791, CVE-2019-9792, CVE-2019-9796, CVE-2019-9801, CVE-2019-9793, CVE-2019-9794, CVE-2019-9808, CVE-2019-9790, CVE-2019-9797, CVE-2019-9804 and ZDI-CAN-8368.
  • Fixed several memory safety hazards and crashes.
  • Windows binaries are now code-signed again (including the setup program for the installer).

New in Basilisk 2019.03.08 (Mar 9, 2019)

  • Changed location to allow an empty string set on search to clear URL parameters.
  • Removed WebExtension support from the platform.
  • Implemented the "origin-clean" algorithm for ImageBitmap.
  • Switched to using C++11 thread-safe statics in the entire application.
  • Fixed several Skia security vulnerabilities (CVE-2018-18356, CVE-2018-18335 and CVE-2019-5785).
  • Fixed a crash due to frames in some uncommon situations.
  • Aligned textarea placeholder strings with the spec (preserve line breaks).
  • Removed the Windows maintenance service code.
  • Improved http basic auth DOS protection heuristics.
  • Fixed arrows on some toolkit controls.
  • Added a Netflix site-specific override to fix Silverlight playback.

New in Basilisk 2019.02.11 (Feb 11, 2019)

  • Removed experimental WebExtension support from the browser.
  • Please check your add-ons; you may need to find alternatives for extensions that are no longer supported.
  • For background to this change, please see the following forum announcement.
  • Removed more telemetry code from the platform.
  • Finalized spec compliance of the IntersectionObserver API, and enabled it by default.
  • Related this, also fixed a number of browser crashes.
  • Switched to the new ffmpeg decode API to avoid dropping of frames.
  • Removed Mozilla-proprietary AudioContext constructor, improving spec compliance of WebAudio.
  • Aligned Element.ScrollIntoView() with the spec.
  • Fixed a buffering issue in the WebP decoder that caused intermittent browser crashes.
  • Changed the Add-on Manager to the same one used by Pale Moon, unifying add-on handling.
  • Note: Some extensions that modify/style the Add-on Manager will have to be updated to work with Basilisk 2019 versions as a result.
  • Improved resource-efficiency for internal stopwatch timers.
  • Improved handling of incorrectly-encoded CTTS in media files, resolving some playback issues of videos.
  • Updated SQLite lib to 3.26.
  • Improved the Cycle Collector and Garbage Collector.
  • Set the Incremental Garbage Collection time slice to 20 ms for more efficient JavaScript memory handling (regression fix).
  • Improved fullscreen navigation bar handling in the situation it has focus when switching to full screen.
  • Aligned instanceof with the final ES6 spec.
  • Fixed a potential use-after-free in IndexedDB code. (DiD)
  • Improved proxy handling to avoid localhost getting proxied. (CVE-2018-18506)
  • Fixed several potentially-exploitable memory safety hazards and crashes. (DiD)
  • Improved Windows DIB clipboard data handling.

New in Basilisk 2018.12.18 (Dec 19, 2018)

  • Added a preference (network.http.upgrade-insecure-requests) to allow disabling requests for opportunistic encryption.
  • Removed more telemetry code from the platform.
  • Added experimental support for the AV1 video codec for MP4 containers (disabled by default).
  • Cleaned up some media handling code, removing obsolete components for older target platforms.
  • Ported all applicable security fixes from Gecko/64. Most of these fixes were merely defense-in-depth.
  • Fixed a crash when using http pipelining over some broken proxies.
  • Enhanced the WebP decoder to properly handle animated lossy and lossless WebP.
  • Removed VR hardware support (both display and input types) from the platform.
  • Updated the GMP update service URL to improve compatibility with DRM-encumbered media.
  • Removed support for Firefox Accounts and changed the Sync client to work with Sync 1.1 (Weave).
  • The default server for using Sync is now the Pale Moon Sync server.
  • Please see this announcement on the forum for more details.
  • Updated NSPR to 4.20.
  • Updated NSS to 3.41, finalizing our platform support for TLS 1.3.
  • Fixed a spec compliance issue with the location.protocol setter.

New in Basilisk 2018.11.07 (Nov 7, 2018)

  • Fixed an issue that prevented the browser from starting properly on some systems after the most recent update.

New in Basilisk 2018.11.04 (Nov 5, 2018)

  • Removed more telemetry code from the platform.
  • Updated libnestegg from upstream.
  • Updated ffvpx library from upstream.
  • Web dev: Make all arguments to init*Event() optional except the first.
  • Ported all applicable security fixes from Gecko/63 and intermediate point releases.
  • Fixed an issue in session storage scripting that might prematurely throw an error and interrupt session restore.
  • Resolved an issue with long menus not scrolling if a submenu was open.
  • Cleaned up and updated some installer code.
  • Made caret width normal/thick behind CJK char configurable.
  • Fixed an issue with table border scaling at various zoom levels.
  • Updated handling of multimedia (on-going).
  • Fixed a corner case behavioral issue when an Outlook-sourced mail message is dropped to the browser.
  • Removed the unfinished and disabled in-browser translation code.
  • Updated the Reader View components.
  • Added experimental AV1 support for WebM videos (disabled by default).
  • Note: This is limited to WebM videos only at the moment, so it will not yet work on MP4 videos or MSE streaming (e.g. YouTube).
  • Fixed an issue with CSS grid element sizing.
  • Updated sidebar conext menu behavior to be more in line with other browsers.
  • Fixed an issue where a separate content process could be launched despite e10s being disabled.
  • Disabled the reporting of CSS errors to the console by default to improve general performance.

New in Basilisk 2018.09.27 (Sep 28, 2018)

  • This is a development and security release.
  • Added support for local-ref URLs in SVG USE elements.
  • Reinstated part of the searchplugin API that was removed by Mozilla, improving compatibility with search-engine modifying extensions.
  • Improved compiler compatibility with GCC 8.
  • Ported all applicable security patches from Gecko/62.
  • Fixed wrong SVG sizes with non-integer values for viewBox width/height.
  • Fixed a performance regression when many workers are in use simultaneously.
  • Improved browser session restore speed by skipping unnecessary notifications.
  • Fixed a crash with http authentication.
  • Fixed a performance issue caused by rapid-fire timers due to value overflow.
  • Fixed an issue with launching executable files not working.
  • ixed an issue where sites allowed to store offline data could not be Fremoved from the permission list.
  • Fixed an issue with common dialog boxes having incorrect sizes for their content.
  • Fixed a regression: ICC v4 color profiles would not be honored.
  • Remove the blocking of binary components in extensions.
  • Added a preference to enable (experimental!) asynchronous panning and zooming on desktop.
  • Fixed a potential crash when using SOCKS.
  • Fixed a potential privacy issue in non-standard environments. (CVE-2017-7797)
  • Fixed a memory leak when using SHA256 crypto.

New in Basilisk 2018.09.05 (Sep 5, 2018)

  • Added new DataTransfer constructor (spec compliance).
  • Aligned CSS layout flex grid with latest spec.
  • Made the MP4 reader less sensitive to corrupt data.
  • Improved media handling (ongoing).
  • Updated NSPR/NSS and enabled the use of latest draft TLS 1.3.
  • Changed the way network/cert errors are handled and displayed.
  • Fixed an ANGLE rendering issue (WebGL2 crash fix).
  • Added support for sbgp and sgpd boxes in EME.
  • Fixed "sticky" menus in High Contrast themes.
  • Updated zlib to 1.2.11.
  • Enabled Direct3D9 accelerated layers as a fallback if Direct3D11 can't be used.
  • Tuned the network stack for efficiency.
  • Fixed a number of performance issues with the browser.
  • Improved Mac OS X theming (unreleased).
  • Improved compatibility with GCC 8.
  • Reinstated RC4 and 3DES as weak cyphers as an option to enable use in non-standard environments (not enabled for the web by default).
  • Removed most telemetry calling code from C++ and the JS TelemetryStopwatch. This prevents most data gathering and improves performance.
  • Added an option (browser.newtabpage.add_to_session_history) to decide whether to store "about:newtab" in the session history for workflows of people wanting to use the back button to return to the QuickDial page.
  • Added an option (ui.menu.allow_content_scroll) to override the OS convention to prevent scrolling of content when contextual menus are open.
  • Added a horizontal scroll action option for mouse wheel.

New in Basilisk 2018.06.01 (Jun 1, 2018)

  • Updated our strings for soft-blocked items so people will cry less when we do our job and warn about known-problematic add-ons.
  • Fixed a regression in site-specific user-agent overrides that would prevent proper application on subdomains.
  • Improved the reader view API.
  • Removed more dead code from our tree (crashreporter components, gonk).
  • Removed DMD code.
  • Removed jprof profiler code.
  • Removed the SPS profiler.
  • Slimmed down IPC (ongoing).
  • Removed the Social API code.
  • Fixed some media back-end crashes and instabilities.
  • Updated the fetch API to be more web-compatible.
  • Limited maximum accepted image sizes for PNG images to prevent abuse/browser DoS.
  • Blocking of top-level data: navigations is now enabled by default.
  • Fixed security issues: CVE-2017-0381, CVE-2018-5174, CVE-2018-5155, CVE-2018-5173, CVE-2018-5177, CVE-2018-5159, CVE-2018-5167, CVE-2018-5154 and CVE-2018-5178.
  • Fixed a number of stability and memory safety hazards that do not have CVE numbers.

New in Basilisk 2018.05.15 (May 15, 2018)

  • This is a development release.
  • Updated FFvpx lib to latest upstream.
  • Improved the memory allocator for multi-core and modern O.S. use.
  • Improved thread locking (mutexes).
  • Added support for FFmpeg 4.0/libavcodec 58.
  • Added some fixes for the performance timer API.
  • Improved consistency of color emoji display.
  • Fixed vertical lines in tabs on higher DPI screens.
  • Improved full-screen control animation.
  • Ported security and stability fixes from Mozilla.
  • Reinstated the use of xrender for proper Linux X11 performance.
  • Fixed unsafe "instanceof" negations.
  • Removed the e10s sandbox.
  • Removed dead widget code.
  • Removed legacy non-ICU Intl code.

New in Basilisk 2018.04.26 (Apr 26, 2018)

  • This is a bugfix release.
  • Added blocking of top-level data: URLs.
  • Fixed several issues with docshell loads.
  • Resolved issues with application.ini not allowing non-mcp applications to be official and have their own vendor.
  • Regression fix: WebExtensions - commands API does not support shortcuts with space or numbers.
  • Regression fix: Set a sandboxName on the WebExtensions Content Script sandboxes.
  • Regression fix: (Windows) Security - Certificate Stores - NSSCertDBTrustDomain allows end-entities to be their own trust anchors.
  • Regression fix: Re-implemented several improvements for pointer events.
  • Regression fix: DOM - Fix incorrect TypeError: Response body is given with a null body status.
  • Re-introduced some site-specific overrides that were erroneously removed (fixes e.g. dailymotion).
  • Regression fix: Optimize operations on roots of deeply-nested frame trees (layout performance).
  • Tweaked fullscreen API settings (add unprefixed API calls, remove too-long duration black fade).
  • Removed Google Safebrowsing selections from preferences by default (it's disabled).
  • Reverted the incomplete addition of the pluralforms Intl API as it caused problems.

New in Basilisk 2018.04.24 (Apr 24, 2018)

  • This is the first release on the re-forked and re-based UXP. Regressions are possible as a result. Please do let us know if you find something that regressed.
  • New release based on UXP (take 2) which is an earlier Mozilla fork-point.
  • Updated Javascript to fully cover ES6 and a good portion of the later specs.
  • Implemented (in ongoing fashion) additional spec compliance patches for HTML, DOM and various other standards.
  • Includes all previous security fixes.

New in Basilisk 2018.03.21 (Mar 22, 2018)

  • This is a maintenance release.
  • Fixed CVE-2018-5127: Buffer overflow manipulating SVG animatedPathSegList.
  • Fixed CVE-2018-5129: Out-of-bounds write with malformed IPC messages.
  • Fixed CVE-2018-5130: Mismatched RTP payload type can trigger memory corruption.
  • Fixed CVE-2018-5131: Fetch API improperly returns cached copies of no-store/no-cache resources.
  • Fixed CVE-2018-5144: Integer overflow during Unicode conversion.
  • Fixed CVE-2018-5125: Memory safety bugs.
  • Fixed CVE-2018-5145: Memory safety bugs.
  • Fixed CVE-2018-5137: Path traversal on chrome:// URLs.

New in Basilisk 2018.02.14 Beta (Feb 15, 2018)

  • Restored source-editor commands for scratchpad and style editor menus.
  • Removed a bunch of Rust cruft.
  • Moved a number of flow decisions from run-time to build-time to slim the browser down.
  • Removed redundant Vista checks.
  • Removed unused crash reporter conditional code.
  • Enabled blocking of top-level data: URI navigations by default. If you need this functionality as a developer, flip security.data_uri.block_toplevel_data_uri_navigations. Note that this does not block manually entered data: URIs, only navigation to it from the browser.
  • Added the status line (response) to raw header display.
  • Removed b2g code.
  • WebExtensions: Content Script sandboxes will now have their sandboxName set.
  • Added an option to remove all session cookies for a specific domain.
  • Added a number of devtools improvements.
  • Fixed a number of crashes and instabilities in the browser.

New in Basilisk 2018.02.02 Beta (Feb 2, 2018)

  • Fixed border and caret widths for natural rounding.
  • Mitigated Meltdown/Spectre hazards.
  • Removed b2g code.
  • Fixed issues with ID-less web extensions and incorrect warnings in the add-on manager.
  • Removed unused internal extensions and components.
  • Fixed source editor controller commands.
  • Fixed X-Frame-Options sameorigin check to check all ancestors.
  • Fixed "sticky" menu colors in special accessibility ("high contrast") system themes.
  • Made XDR decoding more robust, fixing a good handful of JavaScript engine crashes.
  • Fixed security issues: CVE-2018-5099, CVE-2018-5093, CVE-2018-5113, CVE-2018-5095, CVE-2018-5098, CVE-2018-5111, CVE-2018-5109, CVE-2018-5122, CVE-2018-5091, CVE-2018-5097, CVE-2018-5102, CVE-2018-5104, and multiple potentially exploitable crashes and vulnerabilities that do not have a CVE assigned to them.

New in Basilisk 2018.01.05 Beta (Jan 5, 2018)

  • Fixed potential registry name collisions on Windows for file types and protocols.
  • Renamed Options to Preferences (Windows) and moved Preferences to the Tools menu (Linux).
  • Switched off automatic form filling of login credentials and added a preference to control this.
  • Completely removed the "Mozilla Settings Service" and "Blocklist service" client.
  • Fixed a margin issue for the navigation bar.
  • Adjusted the performance-timing resolution to prevent timing-based hardware-specific attacks ("Meltdown"/"Spectre").
  • Limited the number of shared Array Buffers for normal JS code to prevent allocation issues.
  • Disabled shared JS memory for the time being to make doubly-sure it can't be abused while "Spectre" is investigated further.

New in Basilisk 2017.12.28 Beta (Dec 29, 2017)

  • Fixed several compatibility issues with WebExtensions.
  • Disabled Mozilla's "system add-ons" service, which would allow Mozilla to remotely install add-ons.
  • Disabled Mozilla's "system settings" service, which would allow Mozilla to remotely change settings or block add-ons.
  • Updated SQLite lib to 3.21.0.
  • Added an option to block top-level data: URIs.
  • Removed referrers when opening links in new private windows.
  • Updated license and rights pages.
  • Changed the Feedback link to point to the forum instead of Mozilla.
  • Fixed an issue with exportFunction().
  • Fixed/enabled the use of Firefox Sync (Firefox Accounts).
  • Restored the toolkit Error Console for application troubleshooting.
  • Added '-jsconsole' and '-browserconsole' command-line arguments for launching of either console on startup.
  • Removed what was left of the underused Social API.
  • Changed the way element border rounding is done in Goanna to have natural rounding up/down of fractional sizes (IEEE 754).
  • Fixed a potential leak involving IndexedDB and private browsing mode.
  • Fixed a crash in ANGLE.

New in Basilisk 2017.12.01 Beta (Dec 1, 2017)

  • Fixed add-on/GMP update calls to Mozilla services
  • Enabled accessibility features
  • Enabled parental Controls features (Windows only)
  • Changed blocklist hosting to self-hosted
  • Removed leveraging the blocklist for CRL purposes
  • Included the Universal Runtime Libraries with the browser
  • No longer enforcing the "preferred" cipher suite profile on Http/2
  • Added support for the worker-src CSP directive
  • Fixed freetype glyph metrics in Skia (fixes Freetype 2.8.1+ issues)
  • Fixed an issue with ContentSecurityManager not passing the correct context
  • Fixed a number of issues with Contenteditable elements
  • Fixed a number of issues with pointer events
  • Implemented "cookie-averse document objects" to mitigate cookie injection
  • Fixed an issue with SVG text-based image masks
  • Fixed the installer checking for Firefox instead of Basilisk
  • Enabled the use of 64-bit plug-ins other than Flash and Silverlight
  • Made the SVG texture cache more lenient to large-resolution SVG images
  • Fixed several crashes and memory safety hazards
  • Fixed several security bugs: CVE-2017-7837, CVE-2017-7832, CVE-2017-7830, CVE-2017-7835, CVE-2017-7831, CVE-2017-7838, CVE-2017-7839, CVE-2017-7828, CVE-2017-7840, and several others from Firefox 57 that do not have a CVE designation