# Pale Moon changelog

> An independent Goanna-based browser continuing the classic customizable interface.

- Vendor: Moonchild Productions
- Category: Browsers
- Platforms: Windows, Linux
- Official site: https://www.palemoon.org
- Tracked by: What's New (https://whatsnew.fyi/product/pale-moon)
- Harvested from: Releases (repo.palemoon.org/MoonchildProductions/Pale-Moon)
- Entries below: 10 (newest first)

What's New is an index, not a publisher: every entry below links to the vendor's own release notes, which are the authoritative source. Entries are labelled where they are hand-curated sample data, pre-releases, or drawn from a secondary source such as a developer blog.

Reuse: the summaries, labels and curation here are © What's New. Quote freely with attribution and a link back; wholesale republication of the corpus is not permitted — terms: https://whatsnew.fyi/terms. The vendors' own release notes remain their publishers'.

## Releases

### 34.3.2.1_Release — Pale Moon 34.3.2.1 (Linux)

- Date: 2026-08-12
- Version: 34.3.2.1_Release
- Original notes: https://repo.palemoon.org/MoonchildProductions/Pale-Moon/releases/tag/34.3.2.1_Release
- Permalink: https://whatsnew.fyi/product/pale-moon/releases/34.3.2.1-release
- Labels: Platforms: Windows, Linux

Linux-only point release to address issues with the GTK file dialog.

### 34.3.2_Release — Pale Moon 34.3.2

- Date: 2026-08-04
- Version: 34.3.2_Release
- Original notes: https://repo.palemoon.org/MoonchildProductions/Pale-Moon/releases/tag/34.3.2_Release
- Permalink: https://whatsnew.fyi/product/pale-moon/releases/34.3.2-release
- Labels: Platforms: Windows, Linux

- **added** — Implement the URL.Parse() convenience function
- **security** — Add multiple bounds checks on internal browser functions to avoid potential out-of-bounds accesses, underflows and overflows
- **fixed** — Fix several issues with loading and parsing content-supplied fonts
- **security** — Set a bottom limit on the frequency for audio samples to avoid potential bugs surrounding audio loading, processing and playback, rejecting audio formats with a sample rate below 8kHz
- **fixed** — Fix a potential issue in CSS rounded corners with dotted styling
- **changed** — Image elements in forms are no longer associated if they are not in the same subtree
- **security** — Make image animation checks more strict to avoid potential issues if decoding would be slow
- **security** — Make video region checks more strict to avoid issues with malformed video files
- **changed** — Update NSS to 3.90.13.0 (UXP) addressing all applicable security issues from NSS upstream
- **security** — Address CVE-2026-16353, CVE-2026-16408, CVE-2026-16389 and other security issues

This is a security and minor web compat release.

**Changes/fixes:**

- Implemented the URL.Parse() convenience function.
- Added multiple bounds checks on internal browser functions to avoid potential out-of-bounds accesses, underflows and overflows. (DiD)
- Fixed several issues with loading and parsing content-supplied fonts.
- Set a bottom limit on the frequency for audio samples to avoid a whole class of potential bugs surrounding audio loading, processing and playback.
  Audio formats with a sample rate below 8kHz (the commonly accepted lowest sample rate of "telephone"/"walkie-talkie" quality) are now rejected.
- Fixed a potential issue in CSS rounded corners with dotted styling.
- Image elements in forms are no longer associated if they are not in the same subtree.
- Made image animation checks more strict to avoid potential issues if decoding would be slow.
- Video region checks are now more strict to avoid issues with malformed video files.
- Updated NSS to 3.90.13.0 (UXP) addressing all applicable security issues from NSS upstream.
- Another large security audit of over 200 sec bugs in Mozilla land has been performed, with the vast majority not being applicable to our code base (primarily e10s/IPC bugs).
- Security issues addressed: CVE-2026-16353, CVE-2026-16408, CVE-2026-16389 and many others that do not have a CVE designation.

### 34.3.1_Release — Pale Moon 34.3.1

- Date: 2026-06-23
- Version: 34.3.1_Release
- Original notes: https://repo.palemoon.org/MoonchildProductions/Pale-Moon/releases/tag/34.3.1_Release
- Permalink: https://whatsnew.fyi/product/pale-moon/releases/34.3.1-release
- Labels: Platforms: Windows, Linux

- **changed** — Pale Moon will now exclude local resources from <base> CSP checks, aligning it with the rest of CSP handling
- **fixed** — Fixed an issue where the devtools JSON viewer would, in some cases, make erroneous requests to remote servers
- **changed** — Updated libpng to 1.6.58+apng
- **changed** — Updated NSS to 3.90.12 (UXP)
- **fixed** — Fixed several intermittent and rare crashes
- **security** — Addressed CVE-2026-12318 (CWE-125), CVE-2026-12322, CVE-2026-12292 (DiD), and multiple other security issues

This a security and bugfix release.

**Changes/fixes:**

- Pale Moon will now exclude local resources from <base> CSP checks, aligning it with the rest of CSP handling.
- Fixed an issue where the devtools JSON viewer would, in some cases, make erroneous requests to remote servers.
- Updated libpng to 1.6.58+apng.
- Updated NSS to 3.90.12 (UXP), addressing multiple security issues.
- Fixed several intermittent and rare crashes.
- Security issues addressed: CVE-2026-12318 (CWE-125), CVE-2026-12322, CVE-2026-12292 (DiD), and multiple other issues that did not have a CVE designation at the time of patching.

### 34.3.0.1_Release — Pale Moon 34.3.0.1

- Date: 2026-06-09
- Version: 34.3.0.1_Release
- Original notes: https://repo.palemoon.org/MoonchildProductions/Pale-Moon/releases/tag/34.3.0.1_Release
- Permalink: https://whatsnew.fyi/product/pale-moon/releases/34.3.0.1-release
- Labels: Platforms: Windows, Linux

- **fixed** — Intermittent JavaScript engine crashes due to the newly-implemented FinalizationRegistry code
- **fixed** — Webaudio channel mixing regression resulting in broken audio

This is a small update to address 2 important usability/stability issues.

**Changes/fixes:**

- Fixed intermittent JavaScript engine crashes due to the newly-implemented `FinalizationRegistry` code.
- Fixed a webaudio channel mixing regression resulting in broken audio.

### 34.3.0_Release — Pale Moon 34.3.0

- Date: 2026-06-02
- Version: 34.3.0_Release
- Original notes: https://repo.palemoon.org/MoonchildProductions/Pale-Moon/releases/tag/34.3.0_Release
- Permalink: https://whatsnew.fyi/product/pale-moon/releases/34.3.0-release
- Labels: Platforms: Windows, Linux

- **added** — Added powerPreference to canvas WebGL context for web compatibility
- **added** — Implemented support for the lch color space in CSS
- **added** — Added a base implementation for CSS stylesheet constructors
- **added** — Added a base implementation for CSS aspect-ratio sizing
- **added** — Added support for CSS min(), max() and clamp() functions
- **added** — Added support for CSS logical border radius properties
- **added** — Added support for ranges in CSS media queries
- **added** — Added support for CSS shadow parts
- **added** — Added support for degenerate CSS values infinity, -infinity and NaN
- **added** — Implemented full LoongArch64 Baseline/Ion/WASM JIT compiler support
- **added** — Added AV1 decoding with Dav1d for more performant AV1 video playback on 64-bit builds
- **added** — Added ES2024 Arraybuffer transfer APIs (resize, transfer, transferToFixedLength, detached, maxByteLength and resizable)
- **added** — Added support for growable/resizable SharedArrayBuffers and DataViews
- **added** — Added ES2024 grouping builtins (map .groupBy)
- **added** — Added ES2024 resolver builtins (.withResolvers())
- **added** — Added ES2024 String well-formed functions (.isWellFormed() and .toWellFormed())
- **added** — Added support for symbols as weak collection keys
- **added** — Added support for Atomics.waitAsync
- **added** — Added support for FinalizationRegistry (part of the WeakRef spec)
- **changed** — Switched build system to Python 3
- **changed** — Linux: Removed dbus-glib dependency
- **changed** — Linux: Added EGL as a preferred OpenGL provider with GLX fallback
- **changed** — Improved JS performance by porting various enhancements from Mozilla
- **changed** — Further improved compatibility with building for Loongson architectures
- **changed** — Further improved hardware accelerated decoding of WMF videos
- **changed** — Improved parallel JS parsing tasks
- **changed** — Improved CSS handling of calc() for web compatibility, allowing it in many more places
- **changed** — Aligned CSS border width calculations with mainstream for web compatibility
- **changed** — Changed the implementation of WeakRef support to be always enabled in its full implementation
- **fixed** — Fixed various application crashes
- **fixed** — Fixed ARM assembler issues in the Goanna back-end
- **fixed** — Fixed some build issues on NetBSD
- **fixed** — Fixed a pertinent crash due to font handling on OS X 10.7 through 10.11
- **fixed** — Fixed build compatibility with 32-bit MacOS and Mac on PowerPC hardware
- **fixed** — Fixed a devtools crash on Big Endian machines
- **fixed** — Fixed an issue causing rendering artifacts on excessively large border-radius values
- **removed** — Removed the CloudFlare workaround introduced in 34.2.0 as it should no longer be necessary with general image size handling improvements
- **security** — Fixed a stack corruption issue in nsLocaleService that could lead to crashes
- **security** — Implemented some ANGLE upstream fixes
- **security** — Updated NSS to 3.90.11 (UXP), picking up a number of upstream security fixes
- **security** — Performed a large security audit of 190 security-sensitive reported bugs, finding and fixing 18 potential vulnerabilities applicable to the codebase

This is a major development, bugfix and security release.
Special thanks to all the contributors (you know who you are!) for major work done on the platform internals this cycle, making Pale Moon better than ever :)

**New features:**

- Added powerPreference to canvas WebGL context for web compatibility.
- Implemented support for the `lch` color space in CSS.
- Added a base implementation for CSS stylesheet constructors.
- Added a base implementation for CSS `aspect-ratio` sizing.
- Added support for CSS `min()`, `max()` and `clamp()` functions.
- Added support for CSS logical border radius properties.
- Added support for ranges in CSS media queries.
- Added support for CSS shadow parts.
- Added support for degenerate CSS values `infinity`, `-infinity` and `NaN`.
- Implemented full LoongArch64 Baseline/Ion/WASM JIT compiler support.
- Added AV1 decoding with Dav1d for more performant AV1 video playback on 64-bit builds. See implementation notes.
      Note: AV1 is now enabled by default on Dav1d-supported configurations.
- Added ES2024 Arraybuffer transfer APIs (`resize`, `transfer`, `transferToFixedLength`, `detached`, `maxByteLength` and `resizable`).
- Added support for growable/resizable SharedArrayBuffers and DataViews.
- Added ES2024 grouping builtins (map `.groupBy`).
- Added ES2024 resolver builtins (`.withResolvers()`).
- Added ES2024 String well-formed functions (`.isWellFormed()` and `.toWellFormed()`).
- Added support for symbols as weak collection keys.
- Added support for `Atomics.waitAsync`.
- Added support for `FinalizationRegistry` (part of the `WeakRef` spec).

**Changes/fixes:**

- Switched our build system to Python 3. See implementation notes.
- Linux: removed `dbus-glib` dependency.
- Linux: Added EGL as a preferred OpenGL provider with GLX fallback; GLX remains the configured default as there are still some unresolved issues with EGL.
- Improved JS performance by porting across various enhancements from Mozilla.
- Fixed various application crashes.
- Further improved compatibility with building for Loongson architectures.
- Further improved hardware accelerated decoding of WMF videos.
- Fixed ARM assembler issues in the Goanna back-end.
- Improved parallel JS parsing tasks.
- Improved CSS handling of `calc()` for web compatibility, allowing it in many more places (e.g. `color()` and `z-index`).
      For compatibility and performance reasons, we still strongly recommend that you use CSS variables to make calculations where possible.
- Ported several smaller performance improvements from the Dactyloidae project.
- Aligned CSS border width calculations with mainstream, for web compatibility. Please note that this may impact some themes that might rely on fractional border rounding (instead of truncation).
- Removed the CloudFlare workaround introduced in 34.2.0 as it should no longer be necessary with general image size handling improvements. The preference will no longer do anything.
- White-listed driver vendors for VMWare, VirtualBox, VirtIO and Parallels to allow hardware accelleration as much as possible in VM environments.
- Changed the implementation of `WeakRef` support to be always enabled in its full implementation.
- Fixed some build issues on NetBSD.
- Mac: Fixed a pertinent crash due to font handling on OS X 10.7 through 10.11.
- Mac: Fixed build compatibility with 32-bit MacOS and Mac on PowerPC hardware.
- Fixed a devtools crash on Big Endian machines.
- Fixed an issue causing rendering artifacts on excessively large `border-radius` values (e.g. Tailwind CSS).

**Security fixes:**

- Fixed a stack corruption issue in nsLocaleService that could lead to crashes.
- Implemented some ANGLE upstream fixes.
- Updated NSS to 3.90.11 (UXP), picking up a number of upstream security fixes.
- Another large security audit was performed of 190 security-sensitive reported bugs. Many security issues were addressed, including potential crash scenarios a

_[Truncated at 4000 characters — full notes: https://repo.palemoon.org/MoonchildProductions/Pale-Moon/releases/tag/34.3.0_Release]_

### 34.2.2_Release — Pale Moon 34.2.2

- Date: 2026-04-30
- Version: 34.2.2_Release
- Original notes: https://repo.palemoon.org/MoonchildProductions/Pale-Moon/releases/tag/34.2.2_Release
- Permalink: https://whatsnew.fyi/product/pale-moon/releases/34.2.2-release
- Labels: Platforms: Windows, Linux

- **fixed** — Regression in 34.2.1 that would cause crashes to desktop when using certain extensions or visiting certain websites
- **security** — Potential security issues with audio channel mixing, MP3 decoding, international text display, DOM workers, reading of files, and the ANGLE graphics library

This is a stability and security release.

**Changes/fixes:**

- Fixed a regression in 34.2.1 that would cause crashes to desktop when using certain extensions or visiting certain websites.
- Fixed potential security issues with audio channel mixing, MP3 decoding (DiD), international text display, DOM workers (DiD), reading of files (DiD), and the ANGLE graphics library.

### 34.2.1_Release — Pale Moon 34.2.1

- Date: 2026-04-28
- Version: 34.2.1_Release
- Original notes: https://repo.palemoon.org/MoonchildProductions/Pale-Moon/releases/tag/34.2.1_Release
- Permalink: https://whatsnew.fyi/product/pale-moon/releases/34.2.1-release
- Labels: Platforms: Windows, Linux

- **fixed** — Fixed a regression leading to cursive languages (where multiple characters combine) not being rendered correctly (e.g. Arabic)
- **changed** — Updated cookie magic prefix handling, adding __Http- and __Host-Http- magic prefixes and aligning implementation with RFC 6265bis
- **changed** — Updated Brotli library to 1.2.0+ with additional fixes
- **changed** — Updated NSS to 3.90.10.0 (UXP) with additional mitigations
- **security** — Addressed 50 potential vulnerabilities found applicable and fixed through security audit
- **security** — Applied DiD code changes to address 20 security issues

This is a bugfix and security release.
Note for FreeBSD users: our binaries from this version forward require FreeBSD v14 or later.

**Changes/fixes:**

- Fixed a regression leading to cursive languages (where multiple characters combine) not being rendered correctly (e.g. Arabic).
- Updated our cookie magic prefix handling, adding __Http- and __Host-Http- magic prefixes and aligning our implementation with RFC 6265bis.
- Updated our Brotli library to 1.2.0+ (1.2.0 with additional fixes).
- Updated NSS to 3.90.10.0 (UXP). For clarity, the version now carries the (UXP) label to distinguish this fork (which has additional mitigations) from the 3.90 branch of NSS maintained by Mozilla.
- A large audit of security issues was performed. Many security issues were addressed, including potential crash scenarios and code correctness issues.
    As a summary: 50 potential vulnerabilities were found applicable and fixed, 20 issues had DiD code changes applied, and 4 were already mitigated by us before being reported.
    Of the reported vulnerabilities, 270 were not applicable to our code (with the vast majority pertaining to e10s/multi-process browser architecture) and 6 low-impact ones were marked for further investigation at a later time.

### 34.2.0_Release — Pale Moon 34.2.0

- Date: 2026-04-06
- Version: 34.2.0_Release
- Original notes: https://repo.palemoon.org/MoonchildProductions/Pale-Moon/releases/tag/34.2.0_Release
- Permalink: https://whatsnew.fyi/product/pale-moon/releases/34.2.0-release
- Labels: Platforms: Windows, Linux

- **added** — Implemented ES2018 Proxy ownKeys duplicate-key invariant
- **added** — Implemented ES2022 Error.cause property
- **added** — Implemented support for oklab and oklch color spaces in CSS
- **added** — Implemented ES2024 object.GroupBy
- **added** — Implemented ES2023 Change Array by Copy proposal including toSpliced(), with(), and TypedArray versions of toReversed(), toSorted() and with()
- **added** — Implemented AudioNode constructors
- **added** — Implemented support for nested CSS grammar
- **added** — Implemented the window.MathMLElement global
- **fixed** — Fixed a crash related to WeakRef use
- **fixed** — Fixed stack exhaustion crashes as a result of top-level await in modules
- **changed** — Updated expat parser library to 2.7.4
- **changed** — Updated url.CanParse() to allow custom schemes
- **changed** — Updated document.currentScript to align with the currently used spec
- **fixed** — Fixed a crash due to infinite recursion
- **fixed** — Fixed a crash on MacOS due to WebGL attribute arrays
- **fixed** — Fixed a crash related to pointer @media queries in CSS
- **fixed** — Fixed a crash related to the spellchecker when handling input fields in Shadow DOM
- **changed** — Future-proofed whitespace handling in ParseDate in light of Unicode variable whitespace use
- **removed** — Removed irrelevant plugin preferences when plugin support is not built into the browser
- **changed** — Improved support for the mimalloc memory allocator
- **changed** — Improved support for LoongArch CPUs
- **added** — Added special handling for certain MacOS system fonts
- **removed** — Removed leftover code for unsupported Itanium, 32-bit Sparc and other old architectures
- **added** — Added a workaround for CloudFlare image resizing controlled by the preference network.url.cloudflare_image_resizing.enabled (default true)
- **security** — Addressed security issues CVE-2026-4707, CVE-2026-4690, CVE-2026-4727, and others without CVE designation

This is a development, bugfix and security update.

**New features:**

- Implemented ES2018 Proxy `ownKeys` duplicate-key invariant.
- Implemented ES2022 `Error.cause` property.
- Implemented support for `oklab` and `oklch` color spaces in CSS.
- Implemented ES2024 `object.GroupBy`.
- Implemented the remainder of the ES2023 Change Array by Copy proposal (`toSpliced()`, `with()`, and `TypedArray` versions of `toReversed()`, `toSorted()` and `with()`).
- Implemented `AudioNode` constructors.
- Implemented support for nested CSS grammar.
- Implemented the `window.MathMLElement` global.

**Changes/fixes:**

- Fixed a crash related to `WeakRef` use.
- Fixed stack exhaustion crashes as a result of top-level `await` in modules.
- Updated our expat parser library to 2.7.4, fixing various issues.
- Updated `url.CanParse()` to allow custom schemes.
- Updated `document.currentScript` to align with the currently used spec.
- Fixed a crash due to infinite recursion.
- Fixed a crash on MacOS due to WebGL attribute arrays.
- Fixed a crash related to `pointer` @media queries in CSS.
- Fixed a crash related to the spellchecker when handling input fields in Shadow DOM.
- Future-proofed whitespace handling in `ParseDate` in light of Unicode variable whitespace use.
- Removed irrelevant plugin preferences when plugin support isn't built into the browser (non-standard builds/forks).
- Improved support for the mimalloc memory allocator.
- Improved support for LoongArch CPUs.
- Added special handling for certain MacOS system fonts.
- Removed leftover code for unsupported Itanium, 32-bit Sparc and other old architectures.
- Added a workaround for CloudFlare image resizing, since it requires more opaque URL handling to function.
  This workaround is controlled with the new preference `network.url.cloudflare_image_resizing.enabled` (default true). See implementation notes.
- Security issues addressed: CVE-2026-4707 (DiD), CVE-2026-4690 (DiD), CVE-2026-4727 (DiD), and others without a CVE designation.
    A note that Mozilla-relevant security issues CVE-2025-59375 and CVE-2026-4726 had already been addressed in the browser before this release.

**Implementation notes:**

- CloudFlare offers an image resizing service to its clients, which takes a complex string in the URL to control the resizing process. The workaround implemented in this version will treat anything after `/cdn-cgi/image/` as opaque path data (on all websites, considering the wide-spread nature of CloudFlare as a CDN, on many top-level domains). Without this workaround, image resizing like this does not work and results in HTTP 403 (forbidden) errors.
    This workaround does break with our normal way of parsing URLs, so if it causes trouble with sites with this particular path prefix, try changing the preference (to false, to disable this workaround) and see if it helps, and let us know (on the forum or repo).

### 34.1.0_Release — Pale Moon 34.1.0

- Date: 2026-03-03
- Version: 34.1.0_Release
- Original notes: https://repo.palemoon.org/MoonchildProductions/Pale-Moon/releases/tag/34.1.0_Release
- Permalink: https://whatsnew.fyi/product/pale-moon/releases/34.1.0-release
- Labels: Platforms: Windows, Linux

- **added** — Re-landed Xoroshiro128++ JavaScript PRNG for improved robustness and high performance
- **added** — Implemented JavaScript SubmitEvent support for HTML forms
- **added** — Implemented JavaScript requestSubmit() for HTML forms
- **added** — Implemented JavaScript toSorted()
- **added** — Implemented JavaScript toReversed()
- **added** — Implemented top-level await support for JavaScript modules
- **added** — Implemented pointer and hover CSS media queries
- **added** — Enabled hardware-accelerated decoding for VP9 videos where possible
- **changed** — Re-landed expat library update with fixes for large attribute parsing
- **changed** — Updated JPEG-XL library to 0.11.2 for security and performance fixes
- **changed** — Updated libtheora to 1.2.0
- **changed** — Updated libvpx to 1.16.0 with various fixes for MacOS and PowerPC compatibility
- **changed** — Allow unencrypted websocket connections to localhost addresses even when the calling document was served encrypted
- **changed** — Enabled PerformanceObservers by default
- **fixed** — Fixed an issue in Cascade Layers implementation causing problems with UI elements and extensions
- **fixed** — Fixed ICU library issue returning unexpected Unicode spaces in date strings
- **fixed** — Fixed ICU library plural forms for Shuar, Welsh and several Slavic languages
- **fixed** — Fixed ICU library letter dots in Lithuanian
- **fixed** — Fixed ICU library word-wrapping in Tibetan
- **fixed** — Fixed intermittent browser crash related to removing cached image data and improved image data cache handling

This is an important update landing technological enhancements previously intended to be in the v34.0 milestone.

**New features:**

- Re-landed Xoroshiro128++ JavaScript PRNG to make it more robust while keeping high performance.
    This was previously backed out due to intermittent issues and crashes.
- Implemented JavaScript `SubmitEvent` support for HTML forms.
- Implemented JavaScript `requestSubmit()` for HTML forms.
- Implemented JavaScript `toSorted()`.
- Implemented JavaScript `toReversed()`.
- Implemented top-level `await` support for JavaScript modules. See implementation notes.
- Implemented `pointer` and `hover` CSS media queries.
- Enabled hardware-accelerated decoding for VP9 videos (where possible).

**Changes/fixes:**

- Re-landed our expat library update, with fixes for large attribute parsing.
- Updated the JPEG-XL library to 0.11.2 to pick up security and performance fixes, and applied a spot-fix for big-endian hardware.
- Updated libtheora to 1.2.0.
- Updated libvpx to 1.16.0 with various fixes to retain compatibility with older MacOS and PowerPC platforms.
- Pale Moon, from this version forward, allows unencrypted websocket connections to localhost addresses even when the calling document was served encrypted.
- Fixed an issue in the new Cascade Layers implementation causing problems with UI elements and extensions.
- Fixed several issues with the new ICU library implementation in UXP:
    - Fixed an issue where it was returning unexpected Unicode spaces in date strings instead of standard space characters, causing problems with web scripting.
    - Fixed an issue with plural forms for Shuar, Welsh and several Slavic languages.
    - Fixed an issue with letter dots in Lithuanian.
    - Fixed an issue with word-wrapping in Tibetan.
- Fixed an intermittent browser crash related to removing cached image data, and improved image data cache handling as a whole.
- Further improved compatibility with Mac on PowerPC hardware.
- Restored support for building on 32-bit MacOS 10.6.
- Applied miscellaneous fixes for building on MacOS 10.5 (Leopard) and 10.6 (Snow Leopard).
- Fixed run-time issues on FreeBSD 15.*.
- Fixed an issue with applying image filters on big-endian hardware.
- Fixed an issue preventing bundled fonts from working properly on targets other than Windows or Linux-GTK.
- Enabled `PerformanceObservers` by default. See implementation notes.
- Security issues addressed: CVE-2026-2806 (DiD), CVE-2026-2758, CVE-2026-2804, CVE-2026-2787 (DiD), CVE-2026-2757, CVE-2026-2773, CVE-2026-2779 (DiD), CVE-2026-2775, and several others that do not have a CVE designation.

**Implementation notes:**

- Top-level `await` for JavaScript modules has been implemented. This allows the use of the `await` keyword at the top level without a wrapper to force pseudo-synchronous processing in async modules. This completes the last landmark issue of our ES2022 compatibility. Most notably, the lack of this would result in websites using certain frameworks to render completely blank. Many thanks to the maintainer of Basilisk for getting this implementation done for UXP.
- `PerformanceObservers` is a web-development focused API that allows detailed timings to be recorded from web pages. While intended for debugging performance bottlenecks and similar by web developers, more and more websites have been using them in production sites (primarily for analytics but in more than a few instances also for base functionality of the websites). Pale Moon has had the option to enable them on a case-by-case basis (in Preferences -> Privacy, the "Tracking" tab) where needed, but was kept disabled by default due to the obvious privacy impact of having this API available to all sites. Unfortunately, this has become such a web compatibility issue by now that we've had to enable them by default.

### 34.0.1_Release — Pale Moon 34.0.1

- Date: 2026-01-21
- Version: 34.0.1_Release
- Original notes: https://repo.palemoon.org/MoonchildProductions/Pale-Moon/releases/tag/34.0.1_Release
- Permalink: https://whatsnew.fyi/product/pale-moon/releases/34.0.1-release
- Labels: Platforms: Windows, Linux

- **fixed** — Backed out the expat library update that caused memory inflation and browser hang issues on XUL/XML and SVG files with particularly large attributes
- **fixed** — Backed out the change of the Javascript PRNG that caused intermittent issues and crashes on 32-bit platforms

This is a minor release to address some critical issues in the new milestone.

**Changes/fixes:**

- Backed out the expat library update for causing memory inflation and browser hang issues on XUL/XML and SVG files with particularly large attributes.
- Backed out the change of the Javascript PRNG for causing intermittent issues and crashes on 32-bit platforms.

Both of these issues are being investigated and can hopefully re-land with the next development release.