Changed
- JPEG XL image loading now uses multiple processor cores automatically.
- The About Waterfox window now shows the browser engine version alongside the Waterfox version.
- Updated translations for Spanish (Spain), Brazilian Portuguese, Simplified Chinese, German, Irish and Ukrainian.
Brotli moves to Rust for better memory safety
Waterfox now uses a Rust implementation of Brotli compression and decompression, replacing the previous C implementation.
This was a deliberate security decision. Recent memory corruption vulnerabilities, including CVE-2026-111497 in Brotli, show the risks in this kind of code. In affected software, a specially crafted compressed response could corrupt memory and potentially allow an attacker to run their own code.
Rust’s memory safety checks help prevent common errors, such as writing outside an allocated block of memory. We made this switch to reduce the risk of similar vulnerabilities in Waterfox. The replacement handles compressed web content, web fonts and other uses of Brotli throughout the browser.
Fixed
- Security fixes described in Mozilla Foundation Security Advisory 2026-120.
- Fixed update prompts and release note links sometimes showing the wrong information when an update was already downloaded and waiting for a restart.
- Fixed cases where Waterfox continued to report an outdated update status after clearing an old or unusable update.
- Tab previews now skip unusable images, including when a page changes while its preview is being prepared.
- Fixed incorrect transparency in some JPEG XL images.
- Fixed a crash that could occur when opening JPEG XL images with certain unusual colour profiles.