Firefox 135.0.1~tux4 prevents exploitation of a security vulnerability - TUXEDO Computers

We released Firefox version 135.0.1~tux4 on February 24, 2025. The reason was a critical security vulnerability in Cisco’s video codec OpenH264, which has been available as an extension in Firefox since 2014 as an alternative to the proprietary H264 codec. The vulnerability allows malware to be distributed through manipulated videos. In this version, we have disabled the extension until the issue is resolved.

Ubuntu

If you are using Firefox from Ubuntu and the plugin is not yet deactivated, you can disable it under Add-ons and Themes » Plugins by clicking the three dots on the right and temporarily selecting Never activate.

Work without distractions

Additionally, in Firefox 135.0.1~tux4, we made several other adjustments, including delivering the browser with fewer visual distractions. From now on, the new tab page will no longer display sponsored links and recent activity. If you would like to see these items again, use the cogwheel at the bottom right.

Pocket, a Mozilla service for saving content to read later, is now disabled, and the Save to Pocket button in the top right of the toolbar has been removed.

To reactivate Pocket, enter about:config in the address bar, confirm the security query and enter extensions.pocket.enabled in the search line and change the entry from false to true using the switch in the line on the far right.

Reduce Tracking

In the settings under Privacy & Security » Website Privacy Preferences, the option Tell websites not to sell or share my data has been enabled. This new feature replaces the Do Not Track option, which aimed to protect users from online tracking since 2011 but was largely ignored by the advertising industry. The new feature, Global Privacy Control, is legally enforceable in some jurisdictions, with hopes of expanding its enforceability further in the future.

As an additional security measure, we disabled scripting in Firefox’s PDF viewer by setting pdfjs.enableScripting to false. Users who need this function can enter about:config in the address bar, search for the previously mentioned key and change it back to true.