Firefox: форум сообщества

Hi, During some tests I found that FF 115.19.0esr can still execute arbitrary JS similarly to CVE-2024-4367. I’ve checked the versions and > 115.11esr should be patched. Any payload with ‘/JS’ taken from https://github.com/luigigubello/PayloadsAllThePDFs/tree/main will do. Since this is probably important – FontMatrix is *not* working (no JS), original PoC (https://codeanlabs.com/wp-content/uploads/2024/05/poc_generalized_CVE-2024-4367.pdf) is also *not* working. I also wasn’t able to call an external script and so far haven’t found any path to exploit it beyond an alertbox. However, it still bothers me a lot and I’d like to know whether it’s the correct, expected behavior with FF+pdf.js, is it a vulnerability, or maybe my browser was somehow corrupted or is using some other mechanism that’s not within your control (my settings? about:config?).

Steps to re-create: 1. Open file in notepad 2. Add ‘/OpenAction 99 0 R’ after ‘lang’ in ‘1 0 obj section’ 3. After ‘endobj’ add ‘99 0 obj <</Type /Action /S /JavaScript /JS (app.alert\(1\);)>>’ 4. Result – alertbox popping twice

Firefox kicks me out! My Mac works like a charme without any hardware problems. But now my favorite browser (FF) quits support. I'm amazed that a project like Mozilla does not care about sustainability. Any update in the software world must take care concerning downward compatibility - otherwise you exclude former users/customers. So why is ESR for Macos 10.9 to 10.11 not supported anymore? There are millions of Core2Duo-machines, that Mozilla sends to the trash. I'm extremely disappointed!

Bank Accounts: I can no longer access my Bank accnts online. My Bank says they no longer support my current version (ESR) & I must upgrade in order to access accnts online. Don't know what to do.

Chase website now requires Mozilla Firefox update 128 or higher to access accounts. My version says my version (115.30) is latest update. Do I need to find a different browser or is there a solution? I am using Windows 7 Pro desktop. Thank you.

Is this 115.32 still in effect for my macOS 10.13 ? Or is it xld as it would be in Feb 2026?

Did or does Firefox 115.32 afford my apple macOS 10.13 enough security until I purchase a new computed.. How much more time do I have.

I was on the ESR channel and after the recent updates to 142.01 or 141 the ESR is missing from the about Firefox. I had got the tab groups option a few updates back and liked it. This latest update changed how a tab group collapses, instead of showing only the tab group name and collapsing all the tabs it leaves one open wasting space when I have several other tabs open. At least I don't see any sign of the annoying AI junk getting in the way yet. I thought you had a choice to stay on the ESR channel according to this link and others. https://support.mozilla.org/en-US/kb/firefox-support-windows-10-end-support I'll probably be forced to update to Windows 11 to do my taxes next year but I thought at least I could stay on the ESR channel to avoid new features getting in the way.

Please forgive me if this already exists here (I suspect it does). Search tools did not yield what I was looking for.

TOPIC: Extended Support for Firefox 115 ESR

First, let me extend a hearty thank you to everyone on the Mozilla team and in the community that is continuing work on 115 ESR. This is helping a number of people that cannot upgrade for various reasons.

115 ESR is the last hope for many who are stuck on macOS 10.12-10.14 or Windows 7-8.1. While these systems are considered *very* out-of-date (users who are still on them are often chastised) they have a place. macOS for example, completely removed any and all support for 32-bit software as of macOS 10.15 ("Catalina"). I have encountered people with needs for 32-bit to run older apps and so they often keep a system running 10.14 ("Mojave").

Now, can old 32-bit configurations be kept around and isolated offline? Yes. But for some out there who cannot afford to upgrade, or cannot be with out specific 32-bit software, they would be forced offline completely (assuming they follow best security practices, which many do not). I have personally deployed 115 ESR on a number of systems to help people in this situation.

For the time being, ESR 115 is permitting these users to stay online with some degree of security, at least where web browsing is concerned.

QUESTION: Besides active user count, what other factors are keeping 115 ESR in active security-only support mode?

So, as has been announced, FireFox 115 ESR will get updates until septempber 2025. This deadline has been extended multiple times. What factors are being taken in consideration when deciding whether to extend support again? With server 2008 updates you can get windows 7 up to date until 2026, sort of. Ending support in september would still be sad, because people too stubborn or not willing to upgrade probably still wont when support of firefox ends. I am a firefox on windows 7 user myself too, and it would be sad if they dropped support. Ill have to use a backported fork by the community

So thats my question, what factors matter in terms of extending 115 esr support again?

Chase stopped letting me sign into my account. They assert my laptop IOS browser is not supported. Chase wants me to download Firefox 128, but my “About Firefox” says my browser is up to date @ 115.30Oesr. I am afraid to download the version Chase is offering/demanding. So can you tell me if this is a legitimate app and why doesn’t Firefox offer it to me? My IOS is version 10.14.6

I use a 2009 Mac Mini running OS 10.11.6 dedicated for streaming. I was prompted to update Firefox to ESR which I did, replacing the older version of Firefox. The new version will not open.

It was the only browser I had. Can I undo the installation? Or download 78.15.0 somehow to restore the functionality of this Mac?

You say to go to the download page and my version of Windows will be detected & you'll give me the correct version. However, IE 8 in Windows 7 won't go to your download page. So, I need to download from another computer and copy the file to the Windows 7 computer. This doesn't work when you detect that the computer doing the download is a newer computer. How do I tell your system to give me the Windows 7 installer?

Hi Mozilla Team / Community,

We understand that Firefox 115 ESR will receive security updates until at least version 115.27.0esr in August 2025.

We currently have a number of devices still running Windows 7 for legacy application reasons and rely on Firefox 115 ESR as it's the last version to support that OS.

We need to plan ahead, so could you please confirm:

Will Mozilla continue to support Windows 7 with Firefox 115 ESR updates until August 2025?

Or is support for Windows 7 ending sooner, even if 115 ESR itself continues?

After the last update Firefox ESR 115.23.0 the menu on the website: https://connect.garmin.com/modern/home is not displayed correctly. Can you fix this?