Pale Moon

Linux-only point release to address issues with the GTK file dialog.

This is a security and minor web compat release.

Changes/fixes:

• Implemented the URL.Parse() convenience function.
• Added multiple bounds checks on internal browser functions to avoid potential out-of-bounds accesses, underflows and overflows. (DiD)
• Fixed several issues with loading and parsing content-supplied fonts.
• Set a bottom limit on the frequency for audio samples to avoid a whole class of potential bugs surrounding audio loading, processing and playback. Audio formats with a sample rate below 8kHz (the commonly accepted lowest sample rate of "telephone"/"walkie-talkie" quality) are now rejected.
• Fixed a potential issue in CSS rounded corners with dotted styling.
• Image elements in forms are no longer associated if they are not in the same subtree.
• Made image animation checks more strict to avoid potential issues if decoding would be slow.
• Video region checks are now more strict to avoid issues with malformed video files.
• Updated NSS to 3.90.13.0 (UXP) addressing all applicable security issues from NSS upstream.
• Another large security audit of over 200 sec bugs in Mozilla land has been performed, with the vast majority not being applicable to our code base (primarily e10s/IPC bugs).
• Security issues addressed: CVE-2026-16353, CVE-2026-16408, CVE-2026-16389 and many others that do not have a CVE designation.

This a security and bugfix release.

Changes/fixes:

• Pale Moon will now exclude local resources from CSP checks, aligning it with the rest of CSP handling.
• Fixed an issue where the devtools JSON viewer would, in some cases, make erroneous requests to remote servers.
• Updated libpng to 1.6.58+apng.
• Updated NSS to 3.90.12 (UXP), addressing multiple security issues.
• Fixed several intermittent and rare crashes.
• Security issues addressed: CVE-2026-12318 (CWE-125), CVE-2026-12322, CVE-2026-12292 (DiD), and multiple other issues that did not have a CVE designation at the time of patching.

This is a small update to address 2 important usability/stability issues.

Changes/fixes:

• Fixed intermittent JavaScript engine crashes due to the newly-implemented FinalizationRegistry code.
• Fixed a webaudio channel mixing regression resulting in broken audio.

This is a major development, bugfix and security release. Special thanks to all the contributors (you know who you are!) for major work done on the platform internals this cycle, making Pale Moon better than ever :)

New features:

• Added powerPreference to canvas WebGL context for web compatibility.
• Implemented support for the lch color space in CSS.
• Added a base implementation for CSS stylesheet constructors.
• Added a base implementation for CSS aspect-ratio sizing.
• Added support for CSS min(), max() and clamp() functions.
• Added support for CSS logical border radius properties.
• Added support for ranges in CSS media queries.
• Added support for CSS shadow parts.
• Added support for degenerate CSS values infinity, -infinity and NaN.
• Implemented full LoongArch64 Baseline/Ion/WASM JIT compiler support.
• Added AV1 decoding with Dav1d for more performant AV1 video playback on 64-bit builds. See implementation notes. Note: AV1 is now enabled by default on Dav1d-supported configurations.
• Added ES2024 Arraybuffer transfer APIs (resize, transfer, transferToFixedLength, detached, maxByteLength and resizable).
• Added support for growable/resizable SharedArrayBuffers and DataViews.
• Added ES2024 grouping builtins (map .groupBy).
• Added ES2024 resolver builtins (.withResolvers()).
• Added ES2024 String well-formed functions (.isWellFormed() and .toWellFormed()).
• Added support for symbols as weak collection keys.
• Added support for Atomics.waitAsync.
• Added support for FinalizationRegistry (part of the WeakRef spec).

Changes/fixes:

• Switched our build system to Python 3. See implementation notes.
• Linux: removed dbus-glib dependency.
• Linux: Added EGL as a preferred OpenGL provider with GLX fallback; GLX remains the configured default as there are still some unresolved issues with EGL.
• Improved JS performance by porting across various enhancements from Mozilla.
• Fixed various application crashes.
• Further improved compatibility with building for Loongson architectures.
• Further improved hardware accelerated decoding of WMF videos.
• Fixed ARM assembler issues in the Goanna back-end.
• Improved parallel JS parsing tasks.
• Improved CSS handling of calc() for web compatibility, allowing it in many more places (e.g. color() and z-index). For compatibility and performance reasons, we still strongly recommend that you use CSS variables to make calculations where possible.
• Ported several smaller performance improvements from the Dactyloidae project.
• Aligned CSS border width calculations with mainstream, for web compatibility. Please note that this may impact some themes that might rely on fractional border rounding (instead of truncation).
• Removed the CloudFlare workaround introduced in 34.2.0 as it should no longer be necessary with general image size handling improvements. The preference will no longer do anything.
• White-listed driver vendors for VMWare, VirtualBox, VirtIO and Parallels to allow hardware accelleration as much as possible in VM environments.
• Changed the implementation of WeakRef support to be always enabled in its full implementation.
• Fixed some build issues on NetBSD.
• Mac: Fixed a pertinent crash due to font handling on OS X 10.7 through 10.11.
• Mac: Fixed build compatibility with 32-bit MacOS and Mac on PowerPC hardware.
• Fixed a devtools crash on Big Endian machines.
• Fixed an issue causing rendering artifacts on excessively large border-radius values (e.g. Tailwind CSS).

Security fixes:

• Fixed a stack corruption issue in nsLocaleService that could lead to crashes.
• Implemented some ANGLE upstream fixes.
• Updated NSS to 3.90.11 (UXP), picking up a number of upstream security fixes.
• Another large security audit was performed of 190 security-sensitive reported bugs. Many security issues were addressed, including potential crash scenarios and code correctness issues. As a summary: 18 potential vulnerabilities were found applicable and fixed, another 18 issues had DiD code changes applied, and 4 were already mitigated by us before being reported. Of the reported security bugs, 150 were not applicable to our code (with a good portion once again pertaining to e10s/multi-process browser architectures).

Implementation notes:

• The Dav1d AV1 video library was added to Pale Moon, which allows for greatly better performance in AV1 video playback, especially at higher resolutions. The codec is still very computationally intensive, so this does rely pretty heavily on having modern, capable hardware. As an additional note, this library requires AVX hardware to properly decode at speed, and is only fully compatible with 64-bit targets. 32-bit builds will continue to use the reference AOM library for AV1 playback. If you build from source, there is a new configure option --enable-libaom to build with the reference library instead of Dav1d.
• If you build from source yourself, you will no longer have to rely on a distribution that offers Python 2.7. Please note there is some variance in Python 3 versions and not every version will work due to feature changes within the Python 3 range. Versions 3.4 through 3.14 should work; YMMV on other versions. Please ask for help on the forum if you can't figure it out.

This is a stability and security release.

Changes/fixes:

• Fixed a regression in 34.2.1 that would cause crashes to desktop when using certain extensions or visiting certain websites.
• Fixed potential security issues with audio channel mixing, MP3 decoding (DiD), international text display, DOM workers (DiD), reading of files (DiD), and the ANGLE graphics library.

This is a bugfix and security release. Note for FreeBSD users: our binaries from this version forward require FreeBSD v14 or later.

Changes/fixes:

• Fixed a regression leading to cursive languages (where multiple characters combine) not being rendered correctly (e.g. Arabic).
• Updated our cookie magic prefix handling, adding __Http- and __Host-Http- magic prefixes and aligning our implementation with RFC 6265bis.
• Updated our Brotli library to 1.2.0+ (1.2.0 with additional fixes).
• Updated NSS to 3.90.10.0 (UXP). For clarity, the version now carries the (UXP) label to distinguish this fork (which has additional mitigations) from the 3.90 branch of NSS maintained by Mozilla.
• A large audit of security issues was performed. Many security issues were addressed, including potential crash scenarios and code correctness issues. As a summary: 50 potential vulnerabilities were found applicable and fixed, 20 issues had DiD code changes applied, and 4 were already mitigated by us before being reported. Of the reported vulnerabilities, 270 were not applicable to our code (with the vast majority pertaining to e10s/multi-process browser architecture) and 6 low-impact ones were marked for further investigation at a later time.

This is a development, bugfix and security update.

New features:

• Implemented ES2018 Proxy ownKeys duplicate-key invariant.
• Implemented ES2022 Error.cause property.
• Implemented support for oklab and oklch color spaces in CSS.
• Implemented ES2024 object.GroupBy.
• Implemented the remainder of the ES2023 Change Array by Copy proposal (toSpliced(), with(), and TypedArray versions of toReversed(), toSorted() and with()).
• Implemented AudioNode constructors.
• Implemented support for nested CSS grammar.
• Implemented the window.MathMLElement global.

Changes/fixes:

• Fixed a crash related to WeakRef use.
• Fixed stack exhaustion crashes as a result of top-level await in modules.
• Updated our expat parser library to 2.7.4, fixing various issues.
• Updated url.CanParse() to allow custom schemes.
• Updated document.currentScript to align with the currently used spec.
• Fixed a crash due to infinite recursion.
• Fixed a crash on MacOS due to WebGL attribute arrays.
• Fixed a crash related to pointer @media queries in CSS.
• Fixed a crash related to the spellchecker when handling input fields in Shadow DOM.
• Future-proofed whitespace handling in ParseDate in light of Unicode variable whitespace use.
• Removed irrelevant plugin preferences when plugin support isn't built into the browser (non-standard builds/forks).
• Improved support for the mimalloc memory allocator.
• Improved support for LoongArch CPUs.
• Added special handling for certain MacOS system fonts.
• Removed leftover code for unsupported Itanium, 32-bit Sparc and other old architectures.
• Added a workaround for CloudFlare image resizing, since it requires more opaque URL handling to function. This workaround is controlled with the new preference network.url.cloudflare_image_resizing.enabled (default true). See implementation notes.
• Security issues addressed: CVE-2026-4707 (DiD), CVE-2026-4690 (DiD), CVE-2026-4727 (DiD), and others without a CVE designation. A note that Mozilla-relevant security issues CVE-2025-59375 and CVE-2026-4726 had already been addressed in the browser before this release.

Implementation notes:

• CloudFlare offers an image resizing service to its clients, which takes a complex string in the URL to control the resizing process. The workaround implemented in this version will treat anything after /cdn-cgi/image/ as opaque path data (on all websites, considering the wide-spread nature of CloudFlare as a CDN, on many top-level domains). Without this workaround, image resizing like this does not work and results in HTTP 403 (forbidden) errors. This workaround does break with our normal way of parsing URLs, so if it causes trouble with sites with this particular path prefix, try changing the preference (to false, to disable this workaround) and see if it helps, and let us know (on the forum or repo).

This is an important update landing technological enhancements previously intended to be in the v34.0 milestone.

New features:

• Re-landed Xoroshiro128++ JavaScript PRNG to make it more robust while keeping high performance. This was previously backed out due to intermittent issues and crashes.
• Implemented JavaScript SubmitEvent support for HTML forms.
• Implemented JavaScript requestSubmit() for HTML forms.
• Implemented JavaScript toSorted().
• Implemented JavaScript toReversed().
• Implemented top-level await support for JavaScript modules. See implementation notes.
• Implemented pointer and hover CSS media queries.
• Enabled hardware-accelerated decoding for VP9 videos (where possible).

Changes/fixes:

• Re-landed our expat library update, with fixes for large attribute parsing.
• Updated the JPEG-XL library to 0.11.2 to pick up security and performance fixes, and applied a spot-fix for big-endian hardware.
• Updated libtheora to 1.2.0.
• Updated libvpx to 1.16.0 with various fixes to retain compatibility with older MacOS and PowerPC platforms.
• Pale Moon, from this version forward, allows unencrypted websocket connections to localhost addresses even when the calling document was served encrypted.
• Fixed an issue in the new Cascade Layers implementation causing problems with UI elements and extensions.
• Fixed several issues with the new ICU library implementation in UXP:
  • Fixed an issue where it was returning unexpected Unicode spaces in date strings instead of standard space characters, causing problems with web scripting.
  • Fixed an issue with plural forms for Shuar, Welsh and several Slavic languages.
  • Fixed an issue with letter dots in Lithuanian.
  • Fixed an issue with word-wrapping in Tibetan.
• Fixed an intermittent browser crash related to removing cached image data, and improved image data cache handling as a whole.
• Further improved compatibility with Mac on PowerPC hardware.
• Restored support for building on 32-bit MacOS 10.6.
• Applied miscellaneous fixes for building on MacOS 10.5 (Leopard) and 10.6 (Snow Leopard).
• Fixed run-time issues on FreeBSD 15.*.
• Fixed an issue with applying image filters on big-endian hardware.
• Fixed an issue preventing bundled fonts from working properly on targets other than Windows or Linux-GTK.
• Enabled PerformanceObservers by default. See implementation notes.
• Security issues addressed: CVE-2026-2806 (DiD), CVE-2026-2758, CVE-2026-2804, CVE-2026-2787 (DiD), CVE-2026-2757, CVE-2026-2773, CVE-2026-2779 (DiD), CVE-2026-2775, and several others that do not have a CVE designation.

Implementation notes:

• Top-level await for JavaScript modules has been implemented. This allows the use of the await keyword at the top level without a wrapper to force pseudo-synchronous processing in async modules. This completes the last landmark issue of our ES2022 compatibility. Most notably, the lack of this would result in websites using certain frameworks to render completely blank. Many thanks to the maintainer of Basilisk for getting this implementation done for UXP.
• PerformanceObservers is a web-development focused API that allows detailed timings to be recorded from web pages. While intended for debugging performance bottlenecks and similar by web developers, more and more websites have been using them in production sites (primarily for analytics but in more than a few instances also for base functionality of the websites). Pale Moon has had the option to enable them on a case-by-case basis (in Preferences -> Privacy, the "Tracking" tab) where needed, but was kept disabled by default due to the obvious privacy impact of having this API available to all sites. Unfortunately, this has become such a web compatibility issue by now that we've had to enable them by default.

This is a minor release to address some critical issues in the new milestone.

Changes/fixes:

• Backed out the expat library update for causing memory inflation and browser hang issues on XUL/XML and SVG files with particularly large attributes.
• Backed out the change of the Javascript PRNG for causing intermittent issues and crashes on 32-bit platforms.

Both of these issues are being investigated and can hopefully re-land with the next development release.