Firefox 154 Update: Local Network Security & ESR Fixes

Firefox 154 is rolling out with a security-first update that expands protections for local-network connections, adds macOS profile backups, and introduces smarter tab grouping. Alongside the new features, Mozilla also fixed a large set of vulnerabilities and released updated ESR builds for organizations that prefer longer support windows.

Key takeaways

Firefox 154 adds a new permission requirement before websites can open WebSocket connections to devices on the local network.
macOS users get profile backup support, continuing work that previously arrived for Windows and Linux.
Smart Window can now detect related tabs and propose groupings with suggested names.
Website data deletion is refined: users can prevent specific sites from clearing cookies and other data on browser exit.
Firefox 154 closes 58 security issues, including 20 rated as high risk.
Mozilla also released ESR updates: 140.14 (31 fixed issues) and 115.39 (13 fixed issues).

Stronger local-network safeguards

With Firefox 154, websites must obtain permission before establishing a WebSocket connection to a device inside a local network. Mozilla’s goal is to extend protections that were already in place against unwanted access to local resources so they also apply to this additional connection type.

Mozilla is also extending profile protections. After the earlier availability of profile security features for Windows and Linux in Firefox 151, the same capability is now available on macOS. Users can back up their profiles and, due to cross-platform compatibility, move them between supported systems.

Tab and address bar conveniences

Firefox’s Smart Window gains a new behavior: it can identify tabs that belong together and suggest corresponding tab groups, including a proposed group name.

The address bar also gets a new quick action labeled “Manage with AI,” which opens directly to Firefox’s AI settings.

Expanded delete controls and reload behavior

When users delete website data, Firefox will now separate exceptions more clearly within its privacy rules. This means users can block deletion of cookies and other data for specific sites when closing the browser. Mozilla says related settings for tracking protection and other cookie restrictions won’t be affected by this change.

Mozilla also adjusted how Firefox handles a full reload. If the user clicks the Refresh button while holding the Shift key, Firefox will now additionally delete and update cached Favicons for the page in question.

Translation, speech detection, and UI options

Firefox’s “translate full page” improvement now includes content displayed inside iframes, not just the main page body.

For translation prompts, Firefox also performs language recognition when loading a page, aiming to better determine when a translation offer should appear.

On Windows PCs, users can choose an alternative app icon in Firefox settings. At launch, this option is not available for MSIX installations, and it isn’t offered on macOS or Linux yet, though Mozilla indicates support is planned for other variants.

Bug fixes across Windows and macOS

Mozilla reports multiple fixes in the Firefox 154 cycle. On Windows, the update addresses an issue where the taskbar could be hidden correctly at first, then reappear only after restarting Firefox with certain steps involving minimizing and restoring the browser window. It also fixes cases where the taskbar could appear over a Picture-in-Picture window running in fullscreen mode.

On macOS, a problem where closing a browser window could leave behind an invisible window that still captured mouse clicks in the area the window previously occupied is also resolved.

Other fixes include improved scaling in the print preview for PDFs when the “fit to page width” option is used. Highlighting for text selected inside a PDF is also corrected so it matches the highlight behavior used on regular websites, and the highlight color respects operating system settings including high-contrast mode.

Navigation within videos is sped up across all operating systems. Mozilla also changes Firefox View behavior: it disappears from the toolbar for both new and existing profiles when the feature hasn’t been used recently.

Security update: 58 vulnerabilities fixed

Beyond feature changes, Firefox 154 includes security fixes for 58 vulnerabilities, with 20 carrying a high severity rating.

Among the most serious issues, Mozilla highlights a problem in the Remote Settings Client that it describes as a possible escape from the sandbox. Another critical issue involves Canvas/WebG site isolation. Several additional high-rated vulnerabilities can enable privilege escalation in areas including DOM Networking and DOM Navigation.

Mozilla provides full details in its Security Notes.

ESR updates released alongside Firefox 154

Mozilla has also published ESR versions with extended support. Today’s releases are Firefox 140.14 and Firefox 115.39, which typically don’t include new features and instead focus on security corrections.

In these ESR builds, Mozilla reports that 31 vulnerabilities are fixed in ESR 140.14 and 13 are fixed in ESR 115.39, with the specific issues listed in the Security Notes.

Availability

Firefox 154 and the ESR builds (140.14.0 ESR and 115.39.0 ESR) are available now for download. Updates can be applied directly through Firefox’s in-browser update feature, and most users should receive a notification when the new version is ready.