Basilisk: baixar versions anteriors

UXP Changes:
- Implemented the URL.Parse() convenience function.
- Added multiple bounds checks on internal browser functions to avoid potential out-of-bounds accesses, underflows and overflows. (DiD)
- Fixed several issues with loading and parsing content-supplied fonts.
- Set a bottom limit on the frequency for audio samples to avoid a whole class of potential bugs surrounding audio loading, processing and playback.
Audio formats with a sample rate below 8kHz (the commonly accepted lowest sample rate of "telephone"/"walkie-talkie" quality) are now rejected.
- Fixed a potential issue in CSS rounded corners with dotted styling.
- Image elements in forms are no longer associated if they are not in the same subtree.
- Made image animation checks more strict to avoid potential issues if decoding would be slow.
- Video region checks are now more strict to avoid issues with malformed video files.
- Implemented the CSS revert-layer keyword.
- Implemented CSSStyleSheet replaceSync.
- Implemented the CSS :has() pseudo class.
- Implemented support for adoptedStyleSheets.
- Firefox compatibility mode had its version updated to 140 by default. Of course this can still easily be overridden (globally or per-site) where necessary.
- JavaScript garbage collection and DOM cycle collection have been given a number of important fixes to better deal with heavy modern websites that would not properly release their resources. The "ghostbuster" workaround for lingering window objects has been removed in tandem as it is no longer necessary.
- Removed old and obsolete code from the platform related to ancient or completely unsupported compile targets.
- The uppercase version of ß (eszett/scharfes S) will now always mirror the lowercase writing method. See implementation notes.
- Added more updates for LoongArch64 (including full JIT) and Mac/PPC support.
- Linux/FreeBSD: Added a GTK2 dependency toggle to build NPAPI support without GTK2. This allows Basilisk to build plugin support on systems with no GTK2 packages.
- Removed the unused "network tickler" module, an inherited component that could ping wireless networks on a regular interval.
- Modernized std::*<T>::value/::type to their _v and _t suffix forms, respectively, aligning with more modern C++ language standards and compiler behavior.
- Updated CSS aspect-ratio to be more spec-compliant.
- Updated flex container buttons to report a definite size (avoiding 0-sized elements on some websites).
- Restored the ability to compile Basilisk on MIPS targets.
- Fixed an issue with possible hangs in recursive restyling calls (causing a recursive reflow storm), avoiding potentially long browser hangs/lockups.
- Updated several parts of the ICU code for better internationalization support.
- Linux: Improved typing performance on some complex pages.
- Partial support for ARM64/aarch64 JIT. ARM64 builds will run substantially as of this release.
- Fixed potential undefined behavior in float to int32 conversions.
- Made checking for structural errors in XML-based files more strict.
- Fixed a crash in the WeakRef implementation.
- Fixed a potential issue in UI tooltips (DiD).
- Fixed a regression in XSLT transformations that would result in incorrect output.
- Updated the internal json viewer for better handling of resources.
- Updated NSS to 3.90.14.0 (UXP) addressing all applicable security issues from NSS upstream.
- Another large security audit of over 200 sec bugs in Mozilla land has been performed, with the vast majority not being applicable to our code base (primarily e10s/IPC bugs).
- Security issues addressed: CVE-2026-16353, CVE-2026-16408, CVE-2026-16389 CVE-2026-74982, CVE-2026-74969 (DiD), CVE-2026-74977 (DiD), CVE-2026-74945, CVE-2026-74964, CVE-2026-74971, CVE-2026-74943, CVE-2026-92016 (DiD), CVE-2026-92044, CVE-2026-92049, CVE-2026-92030, CVE-2026-92012, and many others that do not have a CVE designation.

Basilisk Changes:
- Added Intl.RelativeTimeFormat polyfill
- Introduced MIPS64EL Linux 

UXP Changes:
- Fixed a webaudio channel mixing regression resulting in broken audio.
- Added powerPreference to canvas WebGL context for web compatibility.
- Implemented support for the lch color space in CSS.
- Added a base implementation for CSS stylesheet constructors.
- Added a base implementation for CSS aspect-ratio sizing.
- Added support for CSS min(), max() and clamp() functions.
- Added support for CSS logical border radius properties.
- Added support for ranges in CSS media queries.
- Added support for CSS shadow parts.
- Added support for degenerate CSS values infinity, -infinity and NaN.
- Implemented full LoongArch64 Baseline/Ion/WASM JIT compiler support.
- Added AV1 decoding with Dav1d for more performant AV1 video.
Note: AV1 is now enabled by default on non-x86 Basilisk builds.
- Added ES2024 Arraybuffer transfer APIs (resize, transfer, transferToFixedLength, detached, maxByteLength and resizable).
- Added support for growable/resizable SharedArrayBuffers and DataViews.
- Added ES2024 grouping builtins (map .groupBy).
- Added ES2024 resolver builtins (.withResolvers()).
- Added ES2024 String well-formed functions (.isWellFormed() and .toWellFormed()).
- Added support for symbols as weak collection keys.
- Added support for Atomics.waitAsync.
- Added support for FinalizationRegistry (part of the WeakRef spec).
- Switched our build system to Python 3. See implementation notes.
- Linux: removed dbus-glib dependency.
- Linux: Added EGL as a preferred OpenGL provider with GLX fallback; GLX remains the configured default as there are still some unresolved issues with EGL.
- Improved JS performance by porting across various enhancements from Mozilla.
- Fixed various application crashes.
- Further improved compatibility with building for Loongson architectures.
- Further improved hardware accelerated decoding of WMF videos.
- Fixed ARM assembler issues in the Goanna back-end.
- Improved parallel JS parsing tasks.
- Improved CSS handling of calc() for web compatibility, allowing it in many more places (e.g. color() and z-index).
For compatibility and performance reasons, we still strongly recommend that you use CSS variables to make calculations where possible.
- Ported several smaller performance improvements from the Dactyloidae project.
- Aligned CSS border width calculations with mainstream, for web compatibility. Please note that this may impact some themes that might rely on fractional border rounding (instead of truncation).
- Removed the CloudFlare workaround as it should no longer be necessary with general image size handling improvements. The preference will no longer do anything.
- White-listed driver vendors for VMWare, VirtualBox, VirtIO and Parallels to allow hardware accelleration as much as possible in VM environments.
- Changed the implementation of WeakRef support to be always enabled in its full implementation (this was already enabled in Basilisk by default).
- Fixed some build issues on NetBSD.
- Mac: Fixed a pertinent crash due to font handling on OS X 10.7 through 10.11.
- Mac: Fixed build compatibility with 32-bit MacOS and Mac on PowerPC hardware.
- Fixed a devtools crash on Big Endian machines.
- Fixed an issue causing rendering artifacts on excessively large border-radius values (e.g. Tailwind CSS).
- Fixed a stack corruption issue in nsLocaleService that could lead to crashes.
- Implemented some ANGLE upstream fixes.
- Fixed a regression that would cause crashes to desktop when using certain extensions or visiting certain websites.
- Updated NSS to 3.90.11 (UXP), picking up a number of upstream security fixes.
- Fixed potential security issues with audio channel mixing, MP3 decoding (DiD), international text display, DOM workers (DiD), reading of files (DiD), and the ANGLE graphics library.
- Another large security audit was performed of 190 security-sensitive reported bugs. Many security issues were addressed, including potential crash scenarios and code correctness issues.
As a summary: 18

UXP Changes:
- Implemented ES2018 Proxy ownKeys duplicate-key invariant.
- Implemented ES2022 Error.cause property.
- Implemented support for oklab and oklch color spaces in CSS.
- Implemented ES2024 object.GroupBy.
- Implemented the remainder of the ES2023 Change Array by Copy proposal (toSpliced(), with(), and TypedArray versions of toReversed(), toSorted() and with()).
- Implemented AudioNode constructors.
- Implemented support for nested CSS grammar.
- Implemented the window.MathMLElement global.
- Fixed a crash related to WeakRef use.
- Fixed stack exhaustion crashes as a result of top-level await in modules.
- Updated our expat parser library to 2.7.4, fixing various issues.
- Updated url.CanParse() to allow custom schemes.
- Updated document.currentScript to align with the currently used spec.
- Fixed a crash due to infinite recursion.
- Fixed a crash on MacOS due to WebGL attribute arrays.
- Fixed a crash related to pointer @media queries in CSS.
- Fixed a crash related to the spellchecker when handling input fields in Shadow DOM.
- Future-proofed whitespace handling in ParseDate in light of Unicode variable whitespace use.
- Removed irrelevant plugin preferences when plugin support isn't built into the browser (non-standard builds/forks).
- Improved support for the mimalloc memory allocator.
- Improved support for LoongArch CPUs.
- Added special handling for certain MacOS system fonts.
- Removed leftover code for unsupported Itanium, 32-bit Sparc and other old architectures.
- Added a workaround for CloudFlare image resizing, since it requires more opaque URL handling to function.
This workaround is controlled with the new preference network.url.cloudflare_image_resizing.enabled (default true). See implementation notes.
- Security issues addressed: CVE-2026-4707 (DiD), CVE-2026-4690 (DiD), CVE-2026-4727 (DiD), and others without a CVE designation.
A note that Mozilla-relevant security issues CVE-2025-59375 and CVE-2026-4726 had already been addressed in the browser before this release.

Basilisk Changes:
- LoongArch64 builds are now built on OpenEuler 24.03 LTS SP3.
- LoongArch64 builds are now shipped with autoupdate support.

Included Polyfills:
- This release includes the following polyfills:
- image.decode
- Intl.DisplayNames
- Intl.Segmenter
- en-US only Intl.ListFormat
- Microsoft-specific (Outlook, Azure, etc) webauthn shim
- TestDecoderStream
- TextEncoderStream
- ReadableStream pipeTo
- ReadableStream pipeThrough
- FinalizationRegistry

UXP Implementation Notes:
- CloudFlare offers an image resizing service to its clients, which takes a complex string in the URL to control the resizing process. The workaround implemented in this version will treat anything after /cdn-cgi/image/ as opaque path data (on all websites, considering the wide-spread nature of CloudFlare as a CDN, on many top-level domains). Without this workaround, image resizing like this does not work and results in HTTP 403 (forbidden) errors.
This workaround does break with our normal way of parsing URLs, so if it causes trouble with sites with this particular path prefix, try changing the preference (to false, to disable this workaround) and see if it helps, and let us know (on the forum or repo).

UXP Changes:
- Re-landed Xoroshiro128++ JavaScript PRNG to make it more robust while keeping high performance.
This was previously backed out due to intermittent issues and crashes.
- Implemented JavaScript SubmitEvent support for HTML forms.
- Implemented JavaScript requestSubmit() for HTML forms.
- Implemented JavaScript toSorted().
- Implemented JavaScript toReversed().
- Implemented top-level await support for JavaScript modules. See implementation notes.
- Implemented pointer and hover CSS media queries.
- Enabled hardware-accelerated decoding for VP9 videos (where possible).
- Re-landed our expat library update, with fixes for large attribute parsing.
- Updated the JPEG-XL library to 0.11.2 to pick up security and performance fixes, and applied a spot-fix for big-endian hardware.
- Updated libtheora to 1.2.0.
- Updated libvpx to 1.16.0 with various fixes to retain compatibility with older MacOS and PowerPC platforms.
- Basilisk, from this version forward, allows unencrypted websocket connections to localhost addresses even when the calling document was served encrypted.
- Fixed an issue in the new Cascade Layers implementation causing problems with UI elements and extensions.
- Fixed several issues with the new ICU library implementation in UXP:
- Fixed an issue where it was returning unexpected Unicode spaces in date strings instead of standard space characters, causing problems with web scripting.
- Fixed an issue with plural forms for Shuar, Welsh and several Slavic languages.
- Fixed an issue with letter dots in Lithuanian.
- Fixed an issue with word-wrapping in Tibetan.
- Fixed an intermittent browser crash related to removing cached image data, and improved image data cache handling as a whole.
- Further improved compatibility with Mac on PowerPC hardware.
- Restored support for building on 32-bit MacOS 10.6.
- Applied miscellaneous fixes for building on MacOS 10.5 (Leopard) and 10.6 (Snow Leopard).
- Fixed run-time issues on FreeBSD 15.*.
- Fixed an issue with applying image filters on big-endian hardware.
- Fixed an issue preventing bundled fonts from working properly on targets other than Windows or Linux-GTK.
- Fixed crashes on long browsing sessions on sites making heavy use of WeakRef.
- Built on UXP commit: a268e57967
- Security issues addressed: CVE-2026-2806 (DiD), CVE-2026-2758, CVE-2026-2804, CVE-2026-2787 (DiD), CVE-2026-2757, CVE-2026-2773, CVE-2026-2779 (DiD), CVE-2026-2775, and several others that do not have a CVE designation.

Basilisk Changes:
- LoongArch64 builds are now built on Loongnix Server 23.
- Introduced Mac OS X 10.5 PowerPC builds.
- We no longer differentiate between beta/alpha/etc. for builds. All builds are welcome here <3

Included Polyfills:
- This release includes the following polyfills:
- image.decode
- Intl.DisplayNames
- Intl.Segmenter
- en-US only Intl.ListFormat
- Microsoft-specific (Outlook, Azure, etc) webauthn shim
- TextEncoderStream
- ReadableStream pipeTo
- ReadableStream pipeThrough
- FinalizationRegistry

Basilisk Update Notes:
- Added logging to the console when polyfills are loaded.
- Improved spec compliance in ReadableStream polyfill.
- Enabled getAnimations by default.

UXP Implementation Notes:
- Top-level await for JavaScript modules has been implemented. This allows the use of the await keyword at the top level without a wrapper to force pseudo-synchronous processing in async modules. This completes the last landmark issue of our ES2022 compatibility. Most notably, the lack of this would result in websites using certain frameworks to render completely blank.

UXP Changes:
- Allow themes to detect Windows 11 usage.
- Implemented WeakRef.
- Implemented URL.canParse().
- Implemented the inset-block and inset-inline CSS shorthands.
- Added a preference (privacy.forgetaboutsite.clearPasswords) to control clearing of passwords when using "forget about this site" in the permissions manager, and disabled clearing of passwords by default, since it was considered unexpected behavior by the community.
- Re-landed CSS Cascade Layers support after the previous back-out.
- Re-landed CSS color-mix support after the previous back-out. RGB and HSL color spaces only, like previous.
- Implemented viewport overflow propagation logic. See implementation notes.
- Unprefixed CSS -moz-appearance; Basilisk now accepts the unprefixed CSS appearance keyword. For compatibility, -moz-appearance and -webkit-appearance (if enabled) have been retained.
- Fixed an intermittent but fairly prominent crash-to-desktop due to JavaScript garbage collection on certain modern sites.
- Fixed a crash on sites with certain types of CSP handling.
- Fixed a crash in WASM.
- Updated NSS to 3.90.9 (custom).
- Updated ICU to v78.1.
- Added support for building on Sparc64 hardware.
- Added support for building for NetBSD on DEC Alpha.
- Added basic support for building on Mac PowerPC (still a work in progress).
- Added basic support for building on LoongArch64 hardware (龍芯 CPUs).
- Added support for running on FreeBSD 15.
- Removed automatic coloring of auto-filled login fields.
- Restored support for in-process NPAPI plugins.
- Improved JavaScript IonMonkey stability on ARM and Mac SoC hardware.
- Built on UXP commit: f272382a9c
- Security issues addressed: CVE-2025-13015, CVE-2026-0879 (DiD), CVE-2026-0880 (DiD), CVE-2026-0889 (DiD), CVE-2026-0883, CVE-2026-0886 (DiD), and several others without a CVE designation.

Basilisk Changes:
- Change dom.always_stop_slow_scripts pref to true by default
- Implement internal polyfill loader based on Greasemonkey to help with compatibility when UXP does not support specific JS features.
- Update PDF.js to v3.11.174.
- Restore official branding files back to Basilisk repo.
- Make List All Tabs button removable and always visible.
- Implement Firefox's "Container Tabs" functionality.
- Introduced LoongArch64 builds. These are built on Slackwareloong64.

Included Polyfills:
- This release includes the following polyfills:
- image.decode
- Intl.DisplayNames
- TextEncoderStream
- ReadableStream pipeTo
- ReadableStream pipeThrough
- FinalizationRegistry

Basilisk Update Notes:
- There may be situations in which the "restore session" functionality does not correctly assign restored tabs to the container in which they were used. If this happens to you please report the exact steps to reproduce.
- PDF.js v3.11.174 was chosen because it is the last version not to use JS Modules.
- PDF.js has the following changes applied:
- Fix for CVE-2024-4367 (isEvalSupported set to false by default).
- Disabled XFA by default.
- Disabled execution of arbitrary JavaScript in all PDF files by default. I was just as horrified as you are to learn that this exists and is an actual spec.
- CSS and JS fixes as needed to make it render and work correctly in UXP-based browsers.
- Releases on all platforms other than Windows are now built with Clang + Thin LTO for improved performance.

UXP Implementation Notes:
- The WeakRef spec only allows code to hint/coerce and does not guarantee if or when dereferencing happens.
- A number of sites have started using overflow-x: clip without overflow-y on full-document elements. While this makes little sense, our strict implementation previously resulted in unscrollable pages. There is special viewport overflow propagation logic in the relevant drafts which we have now implemented to avoid this behavior.

This Basilisk release integrates all Pale Moon changes from 33.8.1 through 33.9.1, introducing major web platform improvements, enhanced standards compliance, Linux stability fixes, and multiple security patches.
- Implemented CSS4 revert keyword and the clip keyword for overflow.
- Implemented CSS axis-shorthand parsing of overflow, resolving unscrollable areas on some websites.
- Implemented color-mix() (RGB and HSL color spaces).
- Implemented @supports(selector(<complex selector>)) and CSS Cascade Layers via @layer.
- Implemented clip-path:<geometry-box> usage without explicit paths.
- Implemented overflow-inline and overflow-block properties.
- Implemented :autofill and :focus-visible CSS pseudo-classes.
- Implemented the prefers-reduced-motion media query.
- Implemented a minimal visualViewport API.
- Un-prefixed user-select, :read-only, and :read-write to align with the current CSS4 specification.
- Improved parsing of X-Content-Type-Options: nosniff and corrected regressions from earlier updates.
- Changed @import processing to follow order of appearance in stylesheets.
- Aligned TypedArray constructors with the ECMAScript spec (invalid or undefined initializers now return empty arrays).
- Improved multi-header Cache-Control parsing.
- Address bar focus state now correctly resets when navigating to #fragment anchors.
- Cookies without valid names are now rejected per RFC 6265; nameless cookies (beginning with =) are no longer accepted.
- Added FFmpeg 7.0 / libavcodec 61 support for improved multimedia compatibility.
- Fixed border-image sub-property update bug.
- Fixed scrollbar-width inheritance handling.
- Explicitly initialized fontconfig on Linux startup to fix missing font issues.
- Fixed color-depth reporting inconsistencies on Linux.
- Fixed VPX and ffvpx build issues on PowerPC and non-assembly architectures.
- Fixed a memory safety issue in gradient color-stop handling.
- Improved DevTools “Copy as cURL” reliability.
- Adjusted CSP URI reporting and data-load restrictions for <object> elements to better follow modern web standards.
- Fixed WebAssembly table size limit handling to align with other engines.
- Fixed crashes and regressions introduced in prior <object> restriction code.
- Fixed address bar dropdown highlight styling regression.
- Numerous Defense-in-Depth and memory safety improvements across components.
- Built on UXP commit: 545d52572d
- Security issues addressed: CVE-2025-10536, CVE-2025-10533 (DiD), CVE-2025-9181, CVE-2025-8031, CVE-2025-8028 (DiD), CVE-2025-8037, CVE-2025-8029, and additional non-CVE fixes.
Implementation notes
- overflow: clip now fully conforms to the CSS specification. Clipped overflow is hidden and unscrollable. If only one axis is specified, the other remains visible but cannot be scrolled.
- clip-path:<geometry-box> can now be used without a path definition, resolving prior cases where blank content appeared.
- visualViewport is minimally implemented for desktop environments: fixed (0,0) origin, root scrollframe dimensions, and scale factor = 1.0.
- TypedArrays with invalid or undefined initializers no longer throw; they return a zero-length array instead.
- Cookies: nameless cookies (starting with =) are now rejected outright. Cookies without an equals sign are interpreted as valueless named cookies, improving RFC compliance and preventing malformed cookie injection.

This is a major development, bugfix and security release.
- Basilisk now includes all non-ubiquitous image and media types in the navigation Accept: header, as discussed in the relevant whatwg fetch spec issue.
- Implemented .toJSON() for DOMRect, DOMPoint and DOMMatrix.
- Added a base implementation of the SVGGeometryElement API. This is currently limited to .pathLength, getTotalLength() and getPointAtLength(distance)for SVG paths.
- Added a base-64/character validity grammar check for CSP nonces.
- Enabled JPEG-XL support unconditionally.
- Improved desktop ARM media capabilities.
- Improved our handling of CSP checks (multiple improvements surrounding loading principal checks).
- Added several Mac-specific file types to be treated as executables.
- Updated the emoji font to Unicode 16.0.0.
- Updated SQLite library to 3.50.1.
- Updated NSS to 3.90.7.1 to fix some issues with some sites due to prior root certificate updates.
- Updated code dealing with internal URL rewrites for Youtube.
- Changed the Firefox compatibility mode version to 128.
- Changed how .click() on <A> elements is handled. See implementation notes.
- Changed DOMMatrix's rotate() and rotateSelf() functions to accept 3D rotation instead of 2D, per spec.
- Changed CSS parameter animation to round values instead of truncating them, per spec.
This affects all integer properties (e.g. z-order) and font-stretching.
- Changed HTML element attribute parsing to additionally escape < and > characters, per spec.
- Fixed a regression in XUL <tree> elements where column selection would omit the first-defined column.
- Fixed a minor issue in DOMSVGPoint finity checks.
- Fixed some minor platform issues and updated Mac SDK checks.
- Fixed an issue when device contrast values would be unset in Mac or Windows+DirectWrite.
- Fixed an issue in the "Copy as curl" feature which could potentially mangle URLs.
- Fixed an issue with FontFaceSet loading.
- Removed support for very old libavcodec versions (before v58).
- Removed the CSP referrer directive as it's no longer in the spec.
- Removed preloading of a number of media libraries on Windows. See implementation notes.
- Removed the allowance of <A> in image maps. Only <area> is now supported.
- Removed several obsolete and unused preferences from about:config.
- Removed obsolete NPN preferences and calls. NPN has long since been replaced by ALPN.
- Removed obsolete SVGZoomEvent interface and handlers.
- Built on UXP commit: e52eaa961c
- Security issues addressed: CVE-2025-6429, CVE-2025-6424 (DiD) and CVE-2025-6426.
Implementation notes
- Normally, when a script issues a simulated click on an element, that click is issued on the document the element is in. Unfortunately there has been a perceived bug in mainstream browsers where this didn't happen on anchors (<A>, hyperlinks) and the browser would navigate even if that anchor was not actually in a web page document (i.e. just created as a reference in scripting). This was eventually made an accepted behaviour in the specification as an exception, describing this bug as expected behavior. Basilisk has now changed how it handles .click() events on anchors to follow this behavior. This primarily impacts some select "download button" behavior on the web where this behavior quirk for anchors is relied on.
- Previously, Basilisk would preload a number of media .dll files into the browser, causing resource use even if there was no media to be decoded or played back in the browsing session yet. This was primarily done in inherited Mozilla code for EME to work. Since we don't support in-browser DRM, this preloading is wholly unnecessary and has been removed.

This is a bugfix and security release.
- Fixed an issue where the Basilisk preferences would fail to open if the browser is compiled with --disable-webrtc.
- Fixed a crash dealing with BigInt in Javascript compilation.
- Updated NSS to 3.90.7 to pick up a security fix.
- Updated devtools to escape some more characters in "Copy as cURL" on POSIX operating systems. DiD
- Addressed PWN2OWN-2025-1 (out of bounds read or write in promise) DiD
- Addressed PWN2OWN-2025-2 (out of bounds read or write when using the ExtractLinearSum optimization) DiD
- Fixed potential unexpected behavior in embedded protobuf code. DiD
- Fixed an issue with potentially uninitialized contrast values when enhanced device contrast values can not be read from the OS. DiD
- Fixed potential sanitization issues with devtools' "Copy as curl" feature. DiD
- Built on UXP commit: 15335ce39d

This is a development, bugfix, stability, and security release.
- Implemented CSS two-location color stop logic. This allows for two-location color stops (`color x% y%`) in gradients, which is shorthand for `color x%, color y%` where both colors are equal.
- Our minimum GCC version requirement to build is now 9.1.
- Improved channel handling when CSP blocks network redirects.
- Implemented several fixes for CORS preflight requests.
- Added explicit whitelisting from CSP content loading of javascript: scheme URLs.
- Updated the ffvpx library to 6.0.1, this time preventing video color range regressions. An update to 6.0 was previously backed out in 33.5.0.
- Updated the JPEG-XL library to 0.11.1 to pick up several fixes and improve decoding compatibility of jxl files.
- Updated the SQLite library to 3.49.1.
- Fixed a spec compliance issue with DOMRect and DOMQuad returning 0 if NaN was present. We now return NaN in that case, per spec.
- Fixed a spec compliance issue with NTLM authentication. We now compute Channel Binding Hashes using the certificate signature's hash algorithm, per spec.
Note that particularly weak algorithms are not used and SHA256 will be used as a minimum, instead, in those cases.
- Fixed a buildability issue on Mac with XCode 16.3.
- Added some additional safety checking to SharedArrayBuffers.
- Added some additional safety checking to XSLT compilation and transformation.
- Windows only: Added a preference widget.windows.follow_shortcuts_on_file_open to control how Windows File Open dialogs handle shortcut links. See implementation notes.
- Simplified some WASM code generation in the Ion JIT compiler.
- Fixed a crash in loading external resource maps.
- Disabled potentially unsafe attempts at recovering JIT operations.
- Fixed some minor linking issues in about:rights.
- Updated the embedded emoji font to fix incorrect display of some of the wheelchair emoji.
- Built on UXP commit: d892468fd0
- Security issues addressed: CVE-2025-1934 (DiD), CVE-2025-3028 (DiD), and and CVE-2025-3033 (see implementation notes)..
Implementation notes
- Windows only: This version introduces a new (numeric) preference to control how the "Open File" dialogs handle shortcut links in the file system.
A low-severity security issue (CVE-2025-3033) was found that in some specific circumstances could allow a malicious actor to convince a user to upload an unintended file from their file system with a specially-crafted shortcut file. To mitigate this, a special flag can be passed to File Open dialogs which prevent the dialogs from parsing shortcut links and navigating to target files and folders based on the shortcut file contents. This can be controlled with the newly-added preference. Since this flag, when set, also prevents users from navigating "through" shortcuts to folders (from e.g. the desktop) and would instead open/attach/upload the shortcut file itself, this would be disruptive to many users' workflows. Considering the major usability drawback and the low-severity nature of the security issue (which would require considerable social engineering to pull off), Basilisk, at least for the time being or until a better solution is found, will continue allowing the following of shortcuts and navigating through them to target folders and files in File Open dialogs. If you are overly cautious, you may want to set this preference to the value 0 which always prevents shortcut parsing and following. For everyone else, just a warning to please stay safe and never follow strange sequences of instructions from strangers that you don't exactly know what they do (and never take their explanations at face value).

This is a development, bugfix and security release.
- Changed the way cookies are handled internally to fix an issue with cookie database corruption as a result of updates to domain suffixes.
- Fixed an issue with Alternative-Services protocol negotiation.
- Fixed a potential crash scenario with Structured Clone operations. DiD
- Fixed a potential issue with line breaking if out of memory.
- Fixed a rare crash with opportunistic encryption.
- Minor code cleanup.
- Implemented a content sniffer for ADTS and raw AAC audio.
- Implemented AbortSignal.abort() and stub AbortSignal.timeout().
- Unprefixed the :modal CSS pseudo-class and exposed it to content.
- Improved efficiency and performance of the Cycle Collector.
- Added a check for explicit expectance of a percentage value in CSS HSL for the S and L components.
- Updated the cookie storage database to no longer use BaseDomain. See implementation notes.
- Updated CSS grid handling to no longer apply auto min-sizing when flex max-sizing (browser parity).
- Updated the root certificates in the internal trust store.
- Updated the Public Suffix List (eTLD) in the browser.
- Removed no longer specced URL Constructor(DOMString url, URL base).
- Changed the default Firefox Compatibility user-agent version to 115.0.
- Fixed an issue where cloned <audio> or <video> elements would not respect the original element's muted state.
- Fixed a number of bugs and spec compliance issues in WebCrypto.
- Fixed installer application naming issue causing failure to detect running application.
- Fix an issue which was causing the search box on the new tab page to not work at all.
- Fixed a crash when Interval handlers are present in scripts that are automatically terminated due to excessive runtime.
- Fixed a crash in JS Structured Cloning when the input would be bogus (CloudFlare-triggered crash).
- Fixed a crash in the XSLT stylesheet importing code.
- Disabled CSP reporting temporarily to work around memory issues caused by CloudFlare's scripting. While CSP reporting is important to inform webmasters of issues with their content security policies, not having the browser eat up all memory is more critical. We do intend to re-enable this when the issue is resolved on CloudFlare's side.
- Improved CSS grid performance to avoid exponential calculations and reflows caused by CloudFlare's scripting. This wasn't a bug, per se, but could easily lock up with bad scripting if called recursively.
- Added a few other small fixes that are tangentially related to the code changes made.
- Updated NSS to 3.90.6 (custom) to pick up several security fixes.
- Built on UXP commit: 7f2561312a
- Security issues addressed: CVE-2025-0239, CVE-2025-0238, and CVE-2025-1009.
Implementation notes
- When updating the browser to this version, a one-way upgrade of the cookie database in your browser profile is performed on first start. The new cookie database is not backwards compatible, meaning you cannot use the browser profiles that have been upgraded by this version or later with any prior versions of the browser without data loss.
This is generally the case as most upgrades of user data storage are one-way, but having all your cookies cleared unintentionally is something most people prefer to avoid, hence this warning and a general reminder of profile migrations to newer versions that may happen with any (non-minor) browser upgrade.
Other notes
- Unfortunately CloudFlare has deployed scripts since the last Basilisk release that deliberately cause issues on independent browsers. If you are interested in learning more, check out the Pale Moon Forum thread where users are discussing this issue. Please consider reporting any and all occurrences of failing or looping CloudFlare checks on websites to CloudFlare as well as the owners of affected websites (you may have to temporarily use a Chromium-based browser to do this).