Firefox 109 released with Manifest V3 support, Firefox View improvements, and more

The Mozilla team has released the Firefox 109 web browser, along with a long-term branch update to version 102.7.0. Firefox 110 enters Beta, and is scheduled for release on February 14. Firefox 109 is notable for supporting the third version of the Chrome add-on manifest, a refined look of the Firefox View page, and more. Also, it drops Colorways from themes.

What's new in Firefox 109

Manifest V3

Firefox 109 supports the third version of the Chrome manifest. It defines the capabilities and resources available to extensions written using the WebExtensions API.

Support for the second version of the manifest will be maintained for the foreseeable future. Since the third version of the manifest has been the subject of criticism and will break ad blocker extensions, Mozilla has decided to keep the classic behavior of the webRequest API. So old and new add-ons will work in Firefox, as technically Manifests V2 and V3 coexist in the browser.

Also, Manifest V3 changes the granular permission request mode. In Chrome, an add-on cannot be instantly activated for all open tabs.

But in Firefox, the decision on granting add-on permission is left to the user. You can manually specify which add-ons can have data access on a particular site.

To manage permissions , you can use the "Extensions" toolbar button. The button panel will display the user’s installed and enabled extensions and their current permission state. In addition to managing host permissions, the panel also allows the user to manage, remove, or report the extension. Extensions with browser actions will behave similarly in the toolbar as in the panel.

Firefox View

The Firefox View page has an optimized look of empty sections dedicated to recently closed tabs and tabs open on other devices. Also, it now has new buttons in the list of recently closed tabs to remove individual links from the list.

Other changes

• Added the ability to display the entered search query in the address bar, instead of showing the URL of the search engine. The feature is currently disabled by default. You can activate it by setting browser.urlbar.showSearchTerms.featureGate to true in about:config. See this post for more details: Firefox can now show search terms instead of URL.
  
• The date selection dialog for the <input> field with the "date" and "datetime" types now supports keyboard activation/focus. This made it compatible with screen readers. Also, you can now use keyboard shortcuts to navigate the calendar.
• The built-in Colorways add-on experiment is now over. Previously saved color themes can be accessed from the "Add-ons and themes" page.
• Added a "Pin to toolbar" option to the context menu of add-ons.
• Provided the ability to use Firefox as a document viewer, selected in the system through the "Open With" context menu.
• Added information about screen refresh rate to the about:support page .

Improvements in Firefox for Android

• When viewing a full-screen video, the address bar won't appear on scrolling.
• Added a button to undo the change after deleting a pinned site.
• Firefox will update the list of available search engines after you change its language.
• Fixed a crash that occurred when you copy some large data to the clipboard or or paste it to the address bar.
• Improved rendering performance of canvas elements.
• Resolves an issue with video calls that can only use the H.264 codec.

Fixes

In addition to new features and bug fixes, Firefox 109 fixes 21 vulnerabilities. 15 vulnerabilities have high impact, of which 13 vulnerabilities (CVE-2023-23605 and CVE-2023-23606) are related to memory management. The latter includes buffer overflows and access to already freed memory areas.

These issues can potentially allow an attacker to execute a malicious code from specially formed webpages.

Vulnerability CVE-2023-23597 is caused by a logical error in the code for creating new child processes and allows you to start a new process in the context of file:// to read the contents of arbitrary files.

A bug in handling drag&drop actions in GTK binding caused the vulnerability CVE-2023-23598. It allows reading the contents of arbitrary files via the DataTransfer.setData call.