Pale Moon

v35.0.2 (2026-10-06)
This is a performance, bugfix and security release.
Disabled the new :has() CSS implementation by
default for performance reasons. See implementation notes.
Added a preference for handling of improper form element
placement in HTML. See implementation notes.
Fixed several application crashes.
Backported an upstream libvpx VP8 decoder fix.
Fixed an issue in the BigInt implementation for specific
JavaScript calls failing.
Fixed a potentially exploitable memory leak.
Security issues addressed: CVE-2026-100822,
CVE-2026-100783, CVE-2026-100773 (DiD),
CVE-2026-96869 (DiD) and
CVE-2026-100791.
The implementation for the CSS :has() pseudo
element selector was disabled by default for causing additional severe
performance issues on websites. This reduces web compatibility for some
sites, but the feature turned out to have too much of a
(省略されました)

v34.3.0.1 (2026-06-10)
This is a small update to address 2 important usability/stability
issues.
Changes/fixes:
Fixed intermittent JavaScript engine crashes due to the
newly-implemented FinalizationRegistry code.
Fixed a webaudio channel mixing regression resulting in
broken audio.

v34.3.0 (2026-06-02)
This is a major development, bugfix and security release.
Special thanks to all the contributors (you know who you are!) for
major work done on the platform internals this cycle, making Pale Moon
better than ever :)
New features:
Added powerPreference to canvas WebGL context
for web compatibility.
Implemented support for the lch color space
in CSS.
Added a base implementation for CSS stylesheet constructors.
Added a base implementation for CSS aspect-ratio
sizing.
Added support for CSS min(), max()
and clamp() functions.
Added support for CSS logical border radius properties.
Added support for ranges in CSS media queries.
Added support for CSS shadow parts.
Added support for degenerate CSS values infinity,
(省略されました)

v34.2.2 (2026-05-01)
This is a stability and security release.
Changes/fixes:
Fixed a regression in 34.2.1 that would cause crashes to
desktop when using certain extensions or visiting certain websites.
Fixed potential security issues with audio channel mixing,
MP3 decoding (DiD),
international text display, DOM workers (DiD), reading of files (DiD), and the ANGLE graphics
library.

v34.2.1 (2026-04-28)
This is a bugfix and security release.
Note for FreeBSD users: our binaries from this version forward require
FreeBSD v14 or later.
Changes/fixes:
Fixed a regression leading to cursive languages (where
multiple characters combine) not being rendered correctly (e.g. Arabic).
Updated our cookie magic prefix handling, adding __Http-
and __Host-Http- magic prefixes and aligning our
implementation with RFC 6265bis.
Updated our Brotli library to 1.2.0+ (1.2.0 with additional
fixes).
Updated NSS to 3.90.10.0 (UXP). For clarity, the version
now carries the (UXP) label to distinguish this fork (which has
additional mitigations) from the 3.90 branch of NSS maintained by
Mozilla.
A large audit of security issues was performed. Many
security issues were addressed, including potential crash scenarios and
code correctness issues.
(省略されました)

v34.0.1 (2026-01-22)
This is a minor release to address some critical issues in the new
milestone.
Changes/fixes:
Backed out the expat library update for causing memory
inflation and browser hang issues on XUL/XML and SVG files with
particularly large attributes.
Backed out the change of the Javascript PRNG for causing
intermittent issues and crashes on 32-bit platforms.
Both of these issues are being investigated and can hopefully re-land
with the next development release.

v34.0.0 (2026-01-20)
This is a new milestone release! There are many changes in this
milestone; the most important ones are highlighted here.
New features:
Our default theme on Windows received a refresh and update.
It should integrate better with Windows 11 now, and be more responsive
to dark accent colors, among other things.
Implemented WeakRef. See implementation notes.
Implemented URL.canParse().
Implemented the inset-block and inset-inline
CSS shorthands.
Added a preference (privacy.forgetaboutsite.clearPasswords)
to control clearing of passwords when
using "forget about this site" in the permissions manager, and disabled
clearing of passwords by default, since it was considered unexpected
behavior by the community.
Changed our JavaScript PRNG to Xoroshiro128++ to make it
more robust while keeping high performance.
Important updates and fixes:
(省略されました)

v33.9.1 (2025-10-21)
This is a bugfix and security update.
Changes/fixes:
Temporarily backed out the implementation of CSS Cascade
Layers for causing layout issues on websites. This will re-land when
fixed.
Temporarily backed out the implementation of CSS color-mix
for causing crashes. This will re-land when fixed.
Per request from our user base, the blank page with the
Pale Moon logo (default for new tabs) will now have an appropriate
title (for e.g. identification in tab and window title).
Further improved the "copy as cURL" devtools function. (CVE-2025-11713)
Implementation notes:
There was one reported security issue (CVE-2025-11712) that
was investigated but rejected, as adoption of the mitigation for a
non-critical sec issue that requires very specific environments to be
exploited (with considerable blame for the webmaster) would, in fact,
require us to go against some very clear specifications in the HTML
standard. Mozilla adopted this primarily for behavioral parity with
(省略されました)

v33.9.0.1 (2025-09-24)
This is a small, critical update to address issues with the browser's
stability and usability due to the 33.9.0 changes to X-Content-Type-Options:
nosniff header parsing.
Mac and FreeBSD will follow shortly when the maintainer has been able
to build the update.
This is a major development, bugfix and security release, focusing

v33.9.0 (2025-09-23)
This is a mjor development, bugfix and security release, focusing
primarily on improving web compatibility.
Special thanks to the students from the University of the Philippines
Los Baños for their work on improving CSS in the platform over the
summer!
New features:
Implemented the CSS4 revert keyword.
Implemented the clip keyword for overflow.
See implementation notes.
Implemented axis-shorthand parsing of overflow.
This should fix some issues with areas being unscrollable on the web.
Implemented CSS color-mix (RGB and HSL color
spaces only).
Implemented CSS @supports(selector(<complex
selector>)) syntax.
Implemented CSS Cascade Layers @layer support.
Implemented support for CSS clip-path:<geometry-box>
without actually supplying a clip path to use. See implementation notes.
(省略されました)

v33.8.2 (2025-08-26)
This is a minor development, security and bugfix release.
Changes/fixes:
Changed the way the address bar focus is handled when
navigating to a fragment (#hash or anchor) within an existing URL. It
will now re-focus the page the same way a normal address navigation
would (resetting the "editing" state, unless the user is actively
typing).
Implemented support for the :focus-visible
CSS pseudo-class.
Fixed a potential race condition in font tables. DiD
Fixed potential issues with pthread allocations. DiD
Fixed an issue in NSS related to the PKCS12 decoder.
Security issues addressed: CVE-2025-9181 and several others
that do not have a CVE number.