Mozilla on Tuesday released Firefox 91, a version of the web browser that brings enhanced cookie clearing, HTTPS by default in private browsing mode, and patches for several high-severity vulnerabilities.
Once the user updates Firefox to version 91, the browser will automatically use an HTTPS connection when the Private Browsing feature is used. If the website does not support HTTPS, Firefox will establish a connection using the HTTP protocol.
“Note that this new HTTPS by Default policy in Firefox Private Browsing Windows is not directly applied to the loading of in-page components like images, styles, or scripts in the website you are visiting; it only ensures that the page itself is loaded securely if possible. However, loading a page over HTTPS will, in the majority of cases, also cause those in-page components to load over HTTPS,” Mozilla noted in a blog post.
Mozilla plans on expanding HTTPS by default to other parts of the browser as well in the coming months.
The organization also announced on Tuesday that Firefox 91 brings a significant privacy enhancement related to how cookies are handled, enabling users to easily delete all cookies and supercookies stored locally by websites and trackers.
“When you decide to tell Firefox to forget about a website, Firefox will automatically throw away all cookies, supercookies and other data stored in that website’s ‘cookie jar’,” Mozilla explained. “This ‘Enhanced Cookie Clearing’ makes it easy to delete all traces of a website in your browser without the possibility of sneaky third-party cookies sticking around.”
The Enhanced Cookie Clearing feature will be used automatically when users clear data for specific websites, if they have Strict Tracking Protection enabled. The new feature leverages the Total Cookie Protection mechanism unveiled earlier this year.
Mozilla has published a blog post explaining why clearing these types of cookies can be challenging, and how it solves those challenges.
The organization also published a security advisory to inform users about the vulnerabilities that have been patched with the release of Firefox 91.
All of the vulnerabilities fixed in the latest version of the browser are related to memory corruption and their exploitation can lead to a crash and possibly arbitrary code execution. All except one of the flaws have been assigned a severity rating of “high.”
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has advised users and administrators to review the advisory and update the browser.
Related: Firefox 88 Combats Cross-Site Tracking to Improve User Privacy
Related: Mozilla Launches Privacy-Focused Browsing Data Sharing Platform
Related: Firefox 87 Adds Stronger User Privacy Protections
Eduard Kovacs (@EduardKovacs) is a contributing editor at SecurityWeek. He worked as a high school IT teacher for two years before starting a career in journalism as Softpedia’s security news reporter. Eduard holds a bachelor’s degree in industrial informatics and a master’s degree in computer techniques applied in electrical engineering.
More from Eduard Kovacs
- In Other News: AI Regulation, Layoffs, US Aerospace Attacks, Post-Quantum Encryption
- Evidence Suggests Ransomware Group Knew About MOVEit Zero-Day Since 2021
- Vulnerabilities in Honda eCommerce Platform Exposed Customer, Dealer Data
- Barracuda Urges Customers to Replace Hacked Email Security Appliances
- Google Patches Third Chrome Zero-Day of 2023
- ChatGPT Hallucinations Can Be Exploited to Distribute Malicious Code Packages
- AntChain, Intel Create New Privacy-Preserving Computing Platform for AI Training
- Several Major Organizations Confirm Being Impacted by MOVEit Attack
Latest News
- In Other News: AI Regulation, Layoffs, US Aerospace Attacks, Post-Quantum Encryption
- Blackpoint Raises $190 Million to Help MSPs Combat Cyber Threats
- Google Introduces SAIF, a Framework for Secure AI Development and Use
- ‘Asylum Ambuscade’ Group Hit Thousands in Cybercrime, Espionage Campaigns
- Evidence Suggests Ransomware Group Knew About MOVEit Zero-Day Since 2021
- SaaS Ransomware Attack Hit Sharepoint Online Without Using a Compromised Endpoint
- Google Cloud Now Offering $1 Million Cryptomining Protection
- Democrats and Republicans Are Skeptical of US Spying Practices, an AP-NORC Poll Finds
