All versions since Firefox 152
Firefox 152
These changes apply to Firefox 152 unless explicitly stated. Firefox ESR 140.12.0 shipped the same day, but most of these changes were not backported to it.
Changes
DefaultSerialGuardSetting: Web Serial support is now disabled by default when Firefox is managed by enterprise policies.ExtensionSettings: Force-installed extensions are now always updated automatically, regardless of theupdates_disabledsetting. (bug 2037243)FirefoxHome: Allow configuration of the Weather experience. Also in Firefox ESR 140.12.0.ManagedBookmarks: Allow specifying favicons directly for managed bookmarks.- Chatbot content is now available to extensions from content scripts. (bug 1980404)
- Firefox now accepts TURN server responses whose
XOR-MAPPED-ADDRESSdoes not match the ICE check, improving compatibility with some TURN server implementations. (bug 2034159)
Fixes
DisableBuiltinPDFViewer: Setting the policy tofalseoverrode the PDF handling configured inhandlers.json. Also in Firefox ESR 140.12.0. (bug 1983032)DisableFirefoxAccounts: The policy also disabled Backup and other unrelated settings after the Settings redesign. (bug 2023825)DisableProfileImport: The Import Bookmarks button on the Bookmarks Toolbar bypassed the policy. (bug 1828282)DisableProfileImport: The import option inabout:loginswas not covered by the policy. (bug 1830463)
Firefox 153
These changes apply to Firefox 153 and Firefox ESR 153 unless explicitly stated. Firefox ESR 153 is the new ESR - enterprise changes are no longer backported to Firefox ESR 140. Policies listed under Firefox ESR 153.0.0 became available to ESR admins for the first time in this release.
New in Firefox 153
DisableRemoteSettingsAndAcceptSecurityConsequences: Disable Remote Settings updates and accept the resulting security consequences. Only use this policy when the consequences are fully understood.
Changes
Containers: Updated for the new container color palette. Existing color names are migrated to the new names automatically.Cookies:BehaviorandBehaviorPrivateBrowsingacceptpartition-foreign, the new name for thereject-tracker-and-partition-foreigncookie behavior. Configurations using the old name continue to work.ExtensionSettings: Control extension host permissions usingruntime_allowed_hostsandruntime_blocked_hosts, and control which permissions extensions may request usingallowed_permissions.- Users can no longer change the host permissions of Manifest V3 extensions installed using
force_installed. ExtensionSettings:force_installedandnormal_installedextensions can be installed directly from addons.mozilla.org wheninstall_urlis omitted.Homepage: Added aNewTabOnRestoreoption to open the default start page orabout:newtabafter restoring a previous session.ManagedBookmarks: Bookmarklets usingjavascript:URLs are now supported.- Automatically discovered printers are now listed after manually configured printers in the print destination list. (bug 1996569)
- Firefox installed from a macOS
.pkgpackage can now update without prompting for administrator credentials. (bug 1812480)
Fixes
- AutoConfig can once again set the
browser.startup.homepagepreference to adata:URL, fixing a regression introduced in Firefox 152. (bug 2047962) DisableSecurityBypass: The Allow download button was still shown whenSafeBrowsingwas set tofalse. (bug 1894373)ExtensionSettings: Extensions that were no longer permitted byallowed_typeswere not removed or blocked when the setting changed. (bug 2008100)ExtensionSettings: Individual Windows registryREG_SZvalues overrode the JSON policy configuration when both were present. (bug 2048696)FirefoxHome: The policy was not reflected correctly in the redesigned Settings. (bug 2048048)PasswordManagerEnabled: The policy did not disable the Passwords sidebar panel. (bug 2041232)PopupBlocking: The policy did not lock all of the pop-up permission controls. (bug 1888477)SanitizeOnShutdown: The policy now correctly locks the History settings when configured. (bug 1888451)- The Bookmarks and History sidebars could not be opened while the sidebar was hidden and
PasswordManagerEnabledwas set tofalse. This regressed in Firefox 153.0 and was fixed in a later Firefox 153 release. (bug 2056857)
New in Firefox ESR 153.0.0
AIControls: Configure AI controls.BrowserDataBackup: Disable backup or restore of profile data.DefaultSerialGuardSetting: Control use of the Web Serial API.DisableRemoteImprovements: Prevent Firefox from applying performance, stability, and feature changes between updates.DisableRemoteSettingsAndAcceptSecurityConsequences: Disable Remote Settings updates and accept the resulting security consequences.IPProtectionAvailable: Prevent the built-in VPN from being available to users.LocalNetworkAccess: Configure local network access security features.RelaunchRequired: Require Firefox to be relaunched within a given period and notify the user of the upcoming relaunch.SitePolicies: Fine-grained control over policies for specific sites.VisualSearchEnabled: Enable or disable visual search.XSLTEnabled: Enable or disable support for the XSLTProcessor JavaScript API and the XSLT processing instruction.
Firefox 154
These changes apply to Firefox 154 and Firefox ESR 153.1.0 unless explicitly stated. Firefox ESR 153 is the current ESR.
Firefox moves from a four-week to a two-week release cycle beginning with Firefox 155. Bug fixes, updates and features reach users more quickly once they are ready to ship.
New in Firefox 154
CNSA2KeyAgreementEnabled: Enable the CNSA 2.0 ML-KEM-1024 key agreement for TLS. Does not apply to the ESR. (bug 2052296)DefaultBrowserSettingEnabled: Prevent users from changing the default browser. (bug 2051921)
Changes
SanitizeOnShutdown: Added anExceptionsoption to configure sites whose data should not be cleared on shutdown. Firefox 154 only. (bug 2049937)
Fixes
SearchEngines:PreventInstallsdid not prevent users from manually adding search engines in Settings or from the context menu. (bug 2052965)- The
-widthand-heightcommand-line options did not correctly set the Firefox window size. Firefox 154 only. (bug 1635927) - Extended Protection (channel and service binding) for Windows SSPI authentication worked when using SPNEGO but not when using Kerberos directly. (bug 1179722)
Firefox 155
These changes apply to Firefox 155 and Firefox ESR 153.2.0 unless explicitly stated. Firefox ESR 153 is the current ESR.
New in Firefox 155
DisableLaunchOnLogin: This policy prevents Firefox from launching automatically when the user logs in (Windows only in 155). Does not apply to the ESR. (bug 2001734)
Changes
SitePolicies: Added anHttpsOnlyoption to prevent specific sites from being loaded over HTTP. Firefox 155 only. (bug 2045980)- Captive portal and network connectivity checks now use
firefox-portal-detection.cominstead ofdetectportal.firefox.com. Network allowlists and proxy rules naming the old domain need updating. Firefox 155 only. (bug 2049252, bug 1898891)
Fixes
ExtensionSettings: In Firefox 154 and Firefox ESR 153.1.0, configurations that quoted booleans ("true") would break and an invalid entry discarded the whole policy. The validator is relaxed to accept quoted booleans again, and invalid entries are now individually skipped. (bug 2065965)SearchEngines: Contextual search prompted users to install a search engine whenPreventInstallswastrue. Firefox 155 only. (bug 2055614)- Locking legacy preferences such as
pref.general.disable_button.default_browserdidn't disable the corresponding controls in Firefox Settings, following the Settings rewrite. (bug 2056928, bug 2055887) - Firefox reported that it could pin itself to the taskbar when Windows Group Policy blocked pinning. Firefox 155 only. (bug 2059920)
Known issues
- Some sites may load slowly or fail to load on networks that block UDP.
This can affect corporate networks where a proxy or firewall blocks QUIC as part of TLS inspection.
To work around it, set
network.http.happy_eyeballs_enabledtofalsewith thePreferencespolicy. A fix is planned for the next dot release. Does not apply to the ESR. (bug 2063452)
Firefox 156
These changes apply to Firefox 156 and Firefox ESR 153.3.0 unless explicitly stated. Firefox ESR 153 is the current ESR.
Changes
FirefoxHome: Added aWidgetsoption to turn the new tab widgets on or off withEnabled, and to block individual widgets by ID withBlocked. (bug 1980406)SitePolicies: Added aDisableServiceWorkersoption to stop specific sites from registering or using service workers. Firefox 156 only. (bug 2045811)DisableLaunchOnLogin: Now applies on macOS as well as Windows, following the macOS launch on login implementation. Does not apply to the ESR. (bug 2053447)
Fixes
DefaultBrowserSettingEnabled: Firefox startup and in-product set-as-default actions did not honor the default browser policies. (bug 2065138)Cookies: Page Info did not consistently disable cookie permission controls that were set by policy, for both a locked cookie behavior and theBlocklist. (bug 2061452)DisablePrivateBrowsing: The "New Private Window" item was still shown in the menubar File menu. (bug 2063975)InstallAddonsPermission: The "Discover extensions" button in the extensions panel was not hidden when installs were blocked. Firefox 156 only. (bug 2041238)FirefoxHome: Controls in the new tab customize panel are now disabled when the corresponding preference is locked. Firefox 156 only. (bug 1983258)
Firefox 157
These changes apply to Firefox 157 and Firefox ESR 153.4.0 unless explicitly stated. Firefox ESR 153 is the current ESR.
Changes
AIControls: Added aSpeechRecognitionoption to make on-device speech recognition available or block it, withLockedto prevent users from changing it. Firefox 157 only. (bug 1940906)about:policiesnow shows an error for a policy that only partially applied, naming the entry that failed, instead of listing it as active. (bug 2067123)
Fixes
Homepage: In Firefox 154 and Firefox ESR 153.1.0, settingURLto several homepages separated by|stopped working after policy validation changes. The pipe separator is accepted again, and the extra URLs are treated asAdditional. (bug 2067248)Handlers: An invalidmimeTypesentry caused every later entry, including theextensionsandschemesblocks, to be discarded. Invalid entries are now skipped individually. (bug 2067099)
Notes
- Firefox ESR 140 goes out of support with this release. Firefox ESR 140.17.0 is its final build.
Firefox 158 Latest
Upcoming, not yet released.
These changes apply to Firefox 158 and Firefox ESR 153.5.0 unless explicitly stated. Firefox ESR 153 is the current ESR.
New in Firefox 158
ClearOnShutdown: Clear browsing data when the browser closes. SupersedesSanitizeOnShutdown, which is ignored when both are set. (bug 2040977)
New in Firefox ESR 153.5.0
ClearOnShutdown: Clear browsing data when the browser closes. SupersedesSanitizeOnShutdown, which is ignored when both are set. (bug 2040977)
Changes
SitePolicies: Added aContaineroption to load matching sites in a dedicated container, withephemeralto clear its data after the last tab closes and at shutdown. Firefox 158 only. (bug 2045801, bug 2045798)ContentAnalysis: AddedInterceptionPoints.ClipboardCopyto send data copied from web content to the DLP agent. Off by default, so existing deployments are unaffected. Firefox 158 only. (bug 2067877)ExtensionSettings: An entry withupdate_urlbut noinstall_urlnow installs the add-on from the update manifest, so self-hosted add-ons no longer need aninstall_url. Firefox 158 only. (bug 2061439)DisableDeveloperTools: Now also disables Marionette and the Remote Agent, so browser automation tools that rely on them no longer work while the policy is set.Extensions: Add-ons listed inUninstallare now removed at every startup, not only when the policy changes.- The illustration on network error pages can be hidden by setting
browser.netError.illustration.enabledtofalse. Administrators may want to set this using thePreferencespolicy. Firefox 158 only. (bug 2061552)
Fixes
- Policy URL fields rejected some valid URLs, such as internationalized domain names, non-ASCII paths and URLs containing spaces. (bug 2067819)
SanitizeOnShutdown: When the policy turned clearing on, Manage Exceptions and the category settings in Firefox Settings were disabled too, even for categories the policy left unset. Firefox 158 only. (bug 2065295)DisableFirefoxAccounts: The toolbar could report a signed-in account when accounts were disabled. Firefox 158 only. (bug 2066062)- The Labs quick action in the address bar was still shown when Firefox Labs was turned off with
UserMessaging, and Manage AI was still shown whenbrowser.preferences.aiControlswasfalse. Firefox 158 only. (bug 2070378) WebsiteFilter: Blocking is now applied more consistently to redirected and embedded content.- Site lists in policies such as
PermissionsandPopupBlockingnow also apply when a host is written with a trailing dot, such asexample.com.. - A policy set to
nullcould stop other policies from applying. - The
toolkit.policies.perUserDirpreference is now only adhered to in automated testing.
Notes
- Firefox ESR 140 is no longer supported. Firefox ESR 140.17.0, released with Firefox 157, was its final build.