Pale Moon

BrowsersWindowsLinux

An independent Goanna-based browser continuing the classic customizable interface.

Latest 35.0.2_Release · · Windows · Linuxby Moonchild ProductionsWebsiteRSS

Release activity

Release activity — 13 releases across 13 days since Jan 21, 2026. Each cell is one day; darker means more releases that day. Nothing is recorded before Jan 21, 2026. Older weeks are hidden at this screen width.
JulAugSepOct
SundayNo releases on Jun 28, 2026No releases on Jul 5, 2026No releases on Jul 12, 2026No releases on Jul 19, 2026No releases on Jul 26, 2026No releases on Aug 2, 2026No releases on Aug 9, 2026No releases on Aug 16, 2026No releases on Aug 23, 2026No releases on Aug 30, 2026No releases on Sep 6, 2026No releases on Sep 13, 2026No releases on Sep 20, 2026No releases on Sep 27, 2026No releases on Oct 4, 2026No releases on Oct 11, 2026
MondayNo releases on Jun 29, 2026No releases on Jul 6, 2026No releases on Jul 13, 2026No releases on Jul 20, 2026No releases on Jul 27, 2026No releases on Aug 3, 2026No releases on Aug 10, 2026No releases on Aug 17, 2026No releases on Aug 24, 2026No releases on Aug 31, 2026No releases on Sep 7, 20261 release on Sep 14, 2026No releases on Sep 21, 2026No releases on Sep 28, 2026No releases on Oct 5, 2026No releases on Oct 12, 2026
TuesdayNo releases on Jun 30, 2026No releases on Jul 7, 2026No releases on Jul 14, 2026No releases on Jul 21, 2026No releases on Jul 28, 20261 release on Aug 4, 2026No releases on Aug 11, 2026No releases on Aug 18, 2026No releases on Aug 25, 2026No releases on Sep 1, 2026No releases on Sep 8, 2026No releases on Sep 15, 20261 release on Sep 22, 2026No releases on Sep 29, 20261 release on Oct 6, 2026
WednesdayNo releases on Jul 1, 2026No releases on Jul 8, 2026No releases on Jul 15, 2026No releases on Jul 22, 2026No releases on Jul 29, 2026No releases on Aug 5, 20261 release on Aug 12, 2026No releases on Aug 19, 2026No releases on Aug 26, 2026No releases on Sep 2, 2026No releases on Sep 9, 2026No releases on Sep 16, 2026No releases on Sep 23, 2026No releases on Sep 30, 2026No releases on Oct 7, 2026
ThursdayNo releases on Jul 2, 2026No releases on Jul 9, 2026No releases on Jul 16, 2026No releases on Jul 23, 2026No releases on Jul 30, 2026No releases on Aug 6, 2026No releases on Aug 13, 2026No releases on Aug 20, 2026No releases on Aug 27, 2026No releases on Sep 3, 2026No releases on Sep 10, 2026No releases on Sep 17, 2026No releases on Sep 24, 2026No releases on Oct 1, 2026No releases on Oct 8, 2026
FridayNo releases on Jul 3, 2026No releases on Jul 10, 2026No releases on Jul 17, 2026No releases on Jul 24, 2026No releases on Jul 31, 2026No releases on Aug 7, 2026No releases on Aug 14, 2026No releases on Aug 21, 2026No releases on Aug 28, 2026No releases on Sep 4, 2026No releases on Sep 11, 2026No releases on Sep 18, 2026No releases on Sep 25, 2026No releases on Oct 2, 2026No releases on Oct 9, 2026
SaturdayNo releases on Jul 4, 2026No releases on Jul 11, 2026No releases on Jul 18, 2026No releases on Jul 25, 2026No releases on Aug 1, 2026No releases on Aug 8, 2026No releases on Aug 15, 2026No releases on Aug 22, 2026No releases on Aug 29, 2026No releases on Sep 5, 2026No releases on Sep 12, 2026No releases on Sep 19, 2026No releases on Sep 26, 2026No releases on Oct 3, 2026No releases on Oct 10, 2026

13 releases since Jan 21, 2026

Changelog

What changed from 34 to 35
35.0.2_ReleaseLatest

Pale Moon 35.0.2

Added 1
  • Added a preference for handling of improper form element placement in HTML
Changed 1
  • Disabled the new `:has()` CSS implementation by default for performance reasons
Fixed 3
  • Fixed several application crashes
  • Backported an upstream libvpx VP8 decoder fix
  • Fixed an issue in the `BigInt` implementation for specific JavaScript calls failing
Security 2
  • Fixed a potentially exploitable memory leak
  • Security issues addressed: CVE-2026-100822, CVE-2026-100783, CVE-2026-100773 (DiD), CVE-2026-96869 (DiD) and CVE-2026-100791

From Pale Moon

This is a performance, bugfix and security release.

Changes/fixes:

  • Disabled the new :has() CSS implementation by default for performance reasons. See implementation notes.
  • Added a preference for handling of improper form element placement in HTML. See implementation notes.
  • Fixed several application crashes.
  • Backported an upstream libvpx VP8 decoder fix.
  • Fixed an issue in the BigInt implementation for specific JavaScript calls failing.
  • Fixed a potentially exploitable memory leak.
  • Security issues addressed: CVE-2026-100822, CVE-2026-100783, CVE-2026-100773 (DiD), CVE-2026-96869 (DiD) and CVE-2026-100791.

Implementation notes:

  • The implementation for the CSS :has() pseudo element selector was disabled by default for causing additional severe performance issues on websites. This reduces web compatibility for some sites, but the feature turned out to have too much of a performance-impacting issue to leave it enabled by default. This should improve performance of the browser across the board while we investigate the root cause of this performance impact in our development going forward. Expect this feature to be enabled again later on after we have addressed the performance issues. If you don't mind the performance impact or have fast hardware, you can enable the feature with the preference layout.css.has-pseudo.enabled (set it to true) for broader website compatibility at the cost of processing.
  • In v35, we tightened our handling of form elements in HTML documents for security reasons, to adhere more strictly to the HTML standard regarding forms in tables. A detailed explanation can be found in this forum topic, including how to fix it in the documents or potential workarounds. You can control this with the preference html5.forms.standards_compliant. By default this is set to true to adhere to the spec, but you can (temporarily) disable this with false (with a page reload) to allow more lax parsing of forms similar to pre-v35 versions of Pale Moon.
View originalPermalink
How 35.0.2_Release went
35.0.1_Release

Pale Moon 35.0.1

Changed 1
  • Made checking for structural errors in XML-based files more strict
Fixed 5
  • Fixed a major performance bug with the new :has() implementation
  • Fixed potential undefined behavior in float to int32 conversions
  • Fixed a crash in the WeakRef implementation
  • Fixed a potential issue in UI tooltips
  • Fixed a regression in XSLT transformations that would result in incorrect output
Security 1
  • Security issues addressed: CVE-2026-92016, CVE-2026-92044, CVE-2026-92049, CVE-2026-92030 and CVE-2026-92012
View originalRead the notes
How 35.0.1_Release went
35.0.0_Release

Pale Moon 35.0.0

Added 6
  • Implement compatibility shims and polyfills by default including Document.elementFromPoint(s) with non-finite args, GetAnimations API, image.decode(), Intl.DisplayNames API, Intl.ListFormat API, Intl.RelativeTimeFormat API, Intl.Segmenter API, pipethrough(), pipeto(), TextDecoderStream, TextEncoderStream, and TransformStream methods
  • Implement the CSS revert-layer keyword
  • Implement CSSStyleSheet replaceSync
  • Implement the CSS :has() pseudo class
  • Implement support for adoptedStyleSheets
  • Add GTK2 dependency toggle on Linux/FreeBSD to build NPAPI support without GTK2
Changed 9
  • Update Firefox compatibility mode version to 140 by default
  • Update uppercase version of ß (eszett/scharfes S) to always mirror the lowercase writing method
  • Add more updates for LoongArch64 including full JIT and Mac/PPC support
  • Modernize std::*<T>::value/::type to their _v and _t suffix forms
  • Update CSS aspect-ratio to be more spec-compliant
  • Update flex container buttons to report a definite size
Fixed 3
  • Fix JavaScript garbage collection and DOM cycle collection to better release resources on heavy modern websites
  • Fix an issue with possible hangs in recursive restyling calls
  • Improve typing performance on some complex pages on Linux
Removed 3
  • Remove the ghostbuster workaround for lingering window objects
  • Remove old and obsolete code related to ancient or completely unsupported compile targets
  • Remove the unused network tickler module
Security 1
  • Address security issues CVE-2026-74982, CVE-2026-74969, CVE-2026-74977, CVE-2026-74945, CVE-2026-74964, CVE-2026-74971, CVE-2026-74943, and several others
View originalRead the notes
How 35.0.0_Release went
34.3.2.1_Release

Pale Moon 34.3.2.1 (Linux)

Linux-only point release to address issues with the GTK file dialog.

View originalRead the notes
How 34.3.2.1_Release went
34.3.2_Release

Pale Moon 34.3.2

Added 1
  • Implement the URL.Parse() convenience function
Changed 2
  • Image elements in forms are no longer associated if they are not in the same subtree
  • Update NSS to 3.90.13.0 (UXP) addressing all applicable security issues from NSS upstream
Fixed 2
  • Fix several issues with loading and parsing content-supplied fonts
  • Fix a potential issue in CSS rounded corners with dotted styling
Security 5
  • Add multiple bounds checks on internal browser functions to avoid potential out-of-bounds accesses, underflows and overflows
  • Set a bottom limit on the frequency for audio samples to avoid potential bugs surrounding audio loading, processing and playback, rejecting audio formats with a sample rate below 8kHz
  • Make image animation checks more strict to avoid potential issues if decoding would be slow
  • Make video region checks more strict to avoid issues with malformed video files
  • Address CVE-2026-16353, CVE-2026-16408, CVE-2026-16389 and other security issues
View originalRead the notes
How 34.3.2_Release went
34.3.1_Release

Pale Moon 34.3.1

Changed 3
  • Pale Moon will now exclude local resources from <base> CSP checks, aligning it with the rest of CSP handling
  • Updated libpng to 1.6.58+apng
  • Updated NSS to 3.90.12 (UXP)
Fixed 2
  • Fixed an issue where the devtools JSON viewer would, in some cases, make erroneous requests to remote servers
  • Fixed several intermittent and rare crashes
Security 1
  • Addressed CVE-2026-12318 (CWE-125), CVE-2026-12322, CVE-2026-12292 (DiD), and multiple other security issues
View originalRead the notes
How 34.3.1_Release went
34.3.0.1_Release

Pale Moon 34.3.0.1

Fixed 2
  • Intermittent JavaScript engine crashes due to the newly-implemented FinalizationRegistry code
  • Webaudio channel mixing regression resulting in broken audio
View originalRead the notes
How 34.3.0.1_Release went
34.3.0_Release

Pale Moon 34.3.0

Added 19
  • Added powerPreference to canvas WebGL context for web compatibility
  • Implemented support for the lch color space in CSS
  • Added a base implementation for CSS stylesheet constructors
  • Added a base implementation for CSS aspect-ratio sizing
  • Added support for CSS min(), max() and clamp() functions
  • Added support for CSS logical border radius properties
Changed 10
  • Switched build system to Python 3
  • Linux: Removed dbus-glib dependency
  • Linux: Added EGL as a preferred OpenGL provider with GLX fallback
  • Improved JS performance by porting various enhancements from Mozilla
  • Further improved compatibility with building for Loongson architectures
  • Further improved hardware accelerated decoding of WMF videos
Fixed 7
  • Fixed various application crashes
  • Fixed ARM assembler issues in the Goanna back-end
  • Fixed some build issues on NetBSD
  • Fixed a pertinent crash due to font handling on OS X 10.7 through 10.11
  • Fixed build compatibility with 32-bit MacOS and Mac on PowerPC hardware
  • Fixed a devtools crash on Big Endian machines
  • Fixed an issue causing rendering artifacts on excessively large border-radius values
Removed 1
  • Removed the CloudFlare workaround introduced in 34.2.0 as it should no longer be necessary with general image size handling improvements
Security 4
  • Fixed a stack corruption issue in nsLocaleService that could lead to crashes
  • Implemented some ANGLE upstream fixes
  • Updated NSS to 3.90.11 (UXP), picking up a number of upstream security fixes
  • Performed a large security audit of 190 security-sensitive reported bugs, finding and fixing 18 potential vulnerabilities applicable to the codebase
View originalRead the notes
How 34.3.0_Release went
34.2.2_Release

Pale Moon 34.2.2

Fixed 1
  • Regression in 34.2.1 that would cause crashes to desktop when using certain extensions or visiting certain websites
Security 1
  • Potential security issues with audio channel mixing, MP3 decoding, international text display, DOM workers, reading of files, and the ANGLE graphics library
View originalRead the notes
How 34.2.2_Release went
34.2.1_Release

Pale Moon 34.2.1

Changed 3
  • Updated cookie magic prefix handling, adding __Http- and __Host-Http- magic prefixes and aligning implementation with RFC 6265bis
  • Updated Brotli library to 1.2.0+ with additional fixes
  • Updated NSS to 3.90.10.0 (UXP) with additional mitigations
Fixed 1
  • Fixed a regression leading to cursive languages (where multiple characters combine) not being rendered correctly (e.g. Arabic)
Security 2
  • Addressed 50 potential vulnerabilities found applicable and fixed through security audit
  • Applied DiD code changes to address 20 security issues
View originalRead the notes
How 34.2.1_Release went
34.2.0_Release

Pale Moon 34.2.0

Added 10
  • Implemented ES2018 Proxy ownKeys duplicate-key invariant
  • Implemented ES2022 Error.cause property
  • Implemented support for oklab and oklch color spaces in CSS
  • Implemented ES2024 object.GroupBy
  • Implemented ES2023 Change Array by Copy proposal including toSpliced(), with(), and TypedArray versions of toReversed(), toSorted() and with()
  • Implemented AudioNode constructors
Changed 6
  • Updated expat parser library to 2.7.4
  • Updated url.CanParse() to allow custom schemes
  • Updated document.currentScript to align with the currently used spec
  • Future-proofed whitespace handling in ParseDate in light of Unicode variable whitespace use
  • Improved support for the mimalloc memory allocator
  • Improved support for LoongArch CPUs
Fixed 6
  • Fixed a crash related to WeakRef use
  • Fixed stack exhaustion crashes as a result of top-level await in modules
  • Fixed a crash due to infinite recursion
  • Fixed a crash on MacOS due to WebGL attribute arrays
  • Fixed a crash related to pointer @media queries in CSS
  • Fixed a crash related to the spellchecker when handling input fields in Shadow DOM
Removed 2
  • Removed irrelevant plugin preferences when plugin support is not built into the browser
  • Removed leftover code for unsupported Itanium, 32-bit Sparc and other old architectures
Security 1
  • Addressed security issues CVE-2026-4707, CVE-2026-4690, CVE-2026-4727, and others without CVE designation
View originalRead the notes
How 34.2.0_Release went
34.1.0_Release

Pale Moon 34.1.0

Added 8
  • Re-landed Xoroshiro128++ JavaScript PRNG for improved robustness and high performance
  • Implemented JavaScript SubmitEvent support for HTML forms
  • Implemented JavaScript requestSubmit() for HTML forms
  • Implemented JavaScript toSorted()
  • Implemented JavaScript toReversed()
  • Implemented top-level await support for JavaScript modules
  • Implemented pointer and hover CSS media queries
  • Enabled hardware-accelerated decoding for VP9 videos where possible
Changed 6
  • Re-landed expat library update with fixes for large attribute parsing
  • Updated JPEG-XL library to 0.11.2 for security and performance fixes
  • Updated libtheora to 1.2.0
  • Updated libvpx to 1.16.0 with various fixes for MacOS and PowerPC compatibility
  • Allow unencrypted websocket connections to localhost addresses even when the calling document was served encrypted
  • Enabled PerformanceObservers by default
Fixed 6
  • Fixed an issue in Cascade Layers implementation causing problems with UI elements and extensions
  • Fixed ICU library issue returning unexpected Unicode spaces in date strings
  • Fixed ICU library plural forms for Shuar, Welsh and several Slavic languages
  • Fixed ICU library letter dots in Lithuanian
  • Fixed ICU library word-wrapping in Tibetan
  • Fixed intermittent browser crash related to removing cached image data and improved image data cache handling
View originalRead the notes
How 34.1.0_Release went
34.0.1_Release

Pale Moon 34.0.1

Fixed 2
  • Backed out the expat library update that caused memory inflation and browser hang issues on XUL/XML and SVG files with particularly large attributes
  • Backed out the change of the Javascript PRNG that caused intermittent issues and crashes on 32-bit platforms
View originalRead the notes
How 34.0.1_Release went

More in Browsers

View all
Brave

Chromium-based browser with ad and tracker blocking built in.

Brave Software
qutebrowser

A keyboard-driven, vim-like browser.

qutebrowser
Min

A fast, minimal browser.

Min
Waterfox

A privacy-focused browser built on Firefox.

Waterfox
Floorp

A highly customizable Firefox-based browser.

Ablaze
Firefox

The independent browser, backed by a non-profit.

Mozilla

Discussion