6.6.9

Security

• Fixed multiple security vulnerabilities as described in Mozilla Foundation Security Advisory 2026-15.
• Fixed 3 CVEs in the JPEG-XL image decoder.

Bug Fixes

• Certificate reliability improvements: Fixed an issue that could cause "Unknown Issuer" certificate errors on certain sites, most commonly on Linux. Waterfox now refreshes intermediate certificate data as needed to keep HTTPS sites loading securely. No browsing data is collected but Waterfox may contact Mozilla's certificate update endpoints to fetch missing intermediate certificates and revocation data.

Stability

• Printer driver isolation (Windows): Printer drivers are now loaded in a separate process, preventing buggy drivers from crashing Waterfox. This uses Windows' application-level printer driver isolation to keep third-party driver issues from bringing down the browser.

Performance

• Small performance improvement in JPEG-XL image decoding (improved LUT loading and added RGB offset dithering).

Experimental

• Ogg Theora support can be re-enabled by setting media.theora.enabled to true in about:config.

Caution

Enabling Ogg Theora support may have security implications, re-enable at your own risk.

Contributors

Thanks to @goodusername123 for their contributions to the JPEG-XL improvements, printer driver isolation and Ogg Theora backport in this release.

6.6.8

This release adds manual tab unloading (useful for freeing memory without closing tabs) and improves how unloaded tabs are represented, fixes a few import/UI issues, and includes platform specific improvements for macOS and Windows.

General

• When importing data from another browser, empty profiles no longer appear in the selection list.
• Added an Unload Tab option to the tab context menu to free memory without closing the tab.
• Unloaded tabs now show a wireframe preview (after the tab has been active at least once).
• Fixed an issue where the Show duplicate tab menu item option did nothing on the Settings page.
• Updated search engine aliases so they no longer take over single-character shortcuts, allowing you to assign them as you wish:
  • Google: @g → @go
  • Bing: @b → @bi
  • Ecosia: @e → @ec
  • Mojeek: @m → @mo
  • Qwant: @q → @qw
  • Waterfox Private Search: @w → @wps
• JPEG XL images should look better (thanks to @goodusername123):
  • The decoder now uses a higher quality blue noise dithering pattern to cut down on visible banding, and its upscaling step clamps overshoot to avoid haloing when enlarging images.
  • Color handling is more reliable; improved ICC/CMYK processing means images with embedded color profiles should match their intended colors more consistently.
  • General JPEG XL stability/performance tweaks from the upstream library: tighter buffering and math paths that should make decoding a bit smoother and less crash-prone.
• Security fixes for MFSA 2026-03

macOS

• Waterfox on macOS now supports Web Authentication (passkeys) for compatible sites.
• With the future release of macOS 26.3 and later, Waterfox will work with the iCloud Passwords extension.

ℹ️ Info
Users on macOS 14 → macOS 15.3 are already able to use the iCloud Passwords extension, but starting with macOS 15.4 Apple introduced a whitelist of supported browsers. Waterfox was added to this list in December 2025 and will be available with the next macOS release.

Windows

• Windows builds now come bundled with the required Visual Studio redistributable files, meaning Waterfox will run on a fresh Windows install even if no other programs have been installed yet.
• Removed the survey checkbox from the uninstaller.

6.6.7

This is a small release with a Windows import fix, a Linux HDR playback fix, and an important Flathub verification milestone for our Flatpak users.

Windows

Firefox import fix

• Fixed an issue that prevented importing Firefox data on Windows. Even if you have already setup Waterfox, you can still import your data via Settings (about:preferences) → General → Import browser data.

ℹ Info

Passwords import is not currently supported at the moment due to the different cryptography used in newer Firefox versions.

Linux

HDR playback on YouTube

• Fixed an issue on Linux where HDR would be broken on YouTube videos, thanks to @goodusername123 for finding the relevant bugs and patches.

Verified on Flathub

I have now verified Waterfox on Flathub, so you can trust the provenance of it.

Shout out to @pascalrrr, who has been diligently maintaining the Flatpak for quite a few years now.

6.6.6

A (not so) devilish release 👹

📝 Note

A few privacy‑sensitive behaviours from upstream Firefox code were not fully disabled in earlier Waterfox builds as we intended. In particular:

• Region detection could still make a one‑time geo‑IP request to Mozilla’s privacy‑preserving backend to infer your country on first run.
• Some local ML/AI plumbing was still technically available and, in edge cases, could surface onboarding UI (e.g. AI link previews) even though the actual AI features and settings stayed disabled.

A thanks to the community for surfacing them so we could tighten things up.

This release makes those behaviours explicit and turns them off by default.

Various fixes

• Private Tab will now use your default selected private search.
  • The context menu search while in private tab will also open a new private tab instead of normal tab.
• Fixed an issue where the Bookmarks widget in the status bar would not open submenus, so now all bookmark folders now work correctly when the button is pinned to the status bar.
• Fixed a minor issue where the “Status Bar” entry in the Toolbars menu would output internal errors to the browser console.
• Cookie banner handling no longer logs spurious errors when browsing localhost, IP addresses, or other internal hosts; in those cases Waterfox now silently falls back to the global setting.
• Security fixes in MFSA-2025-94

Region & Geo Detection

What was happening

Firefox’s Region subsystem could still make a one‑time request to Mozilla’s privacy‑preserving geo‑IP service to infer your country on first run. That inferred “home region” is used by multiple subsystems (search, DoH rollout, feature gating, telemetry). The backend is designed to be privacy‑sensitive and only runs once, but it was still an unnecessary external connection we’d rather avoid.

What we’ve changed

• Disabled network‑based region lookup
  • The URL used for region detection (browser.region.network.url) is now empty and locked.
  • Wi‑Fi–based region hints (browser.region.network.scan) was already disabled but is now locked as well.
• Fixed, non‑dynamic “home region”
  • browser.search.region is now set to a fixed value (US) and locked.
  • This prevents any background attempts to “correct” or update your region based on IP.

Why this matters

No calls are made to Mozilla’s region/geo‑IP services for normal browsing and features that still look at region see a stable, non‑changing value instead of one inferred from your network.

AI & Machine Learning

What was happening

None of the Firefox AI features or settings (AI link previews, chat integrations, etc.) were enabled in Waterfox, and no AI processing was happening in the background. However, some of the underlying onboarding and Labs migration code for AI link previews would still run and surface onboarding pop‑ups or UI.

The underlying local ML runtime (used for various experimental features in upstream Firefox) was still present and technically enabled at the pref level, even though nothing was using it. Built‑in chatbot integration points were already off in Waterfox, but we’ve clarified and hardened the settings.

What we’ve changed

• Core ML engine explicitly disabled

  • The main ML engine toggle browser.ml.enable now defaults to false.
  • Any feature that tries to create a local ML engine will now cleanly fail up front instead of starting an inference process.

• AI link previews fully shut off

  • browser.ml.linkPreview.enabled is now false by default (and locked).
  • Legacy Firefox Labs state for link previews (browser.ml.linkPreview.labs) is forced to “not enrolled” and locked.
  • The opt‑in flag for AI key points (browser.ml.linkPreview.optin) is locked to false.
  • This prevents:
    • The feature from ever turning itself back on due to leftover Labs state.
    • Onboarding cards or AI link preview pop‑ups from appearing unexpectedly.

• Chat sidebar integrations remain disabled

  • browser.ml.chat.enabled stays false, keeping built‑in chatbot UI off by default.

Why this matters

Local ML/AI code paths are no longer reachable unless you deliberately override multiple locked prefs. Users migrating profiles from Firefox (including Labs experiments) won’t see old experimental AI features unexpectedly re‑appear in Waterfox.

Experiments, Studies & “Labs”

What was happening

Waterfox already disabled Mozilla’s remote experimentation system (Normandy/Nimbus), but some features ran separately from this system (link previews).

What we’ve changed

• For link previews specifically, we now:
  • Lock Labs and opt‑in prefs as described above.

Why this matters

Tours/onboarding for disabled features makes no sense and appears confusing.

🚀 Tip

Translations remain available

• Full‑page and selection translations continue to work as before.
• These use a separate engine and are not affected by disabling the generic ML runtime.

If you notice anything that still looks like geo detection, experimentation, or AI features sneaking in where they shouldn’t, please keep telling us as it helps us correct course faster!

6.6.5.1

A quick change to default search and an important bug fix.

Changes

ℹ️ Note
If you’ve already modified your default search, this change will not affect you.

• Due to popular demand, Startpage is now the default search again. Sorry for the flip-flopping! You can still use Ecosia and support both Waterfox and tree planting.

Fixed

• Tree Vertical Tabs would continue running in the background even when disabled in Settings. This is now fixed, so turning off Tree Vertical Tabs actually unloads the extension and can reduce memory usage.
• Tree Vertical Tabs options were incorrectly shown at the bottom of Preferences/Settings → General on first load. They now only appear under the dedicated “Tree Vertical Tabs” category.

6.6.5

This update adds Ukrainian as a UI language, a new quality-of-life feature and the latest security fixes.

New

• Added Ukrainian locale
• (Thanks @evilUrge) Added the ability to copy current tab url to your clipboard with:
  • macOS: Command + Shift + U
  • Windows/Linux: Ctrl + Shift + U

Fixed

• All security advisories part of MFSA2025-89.

6.6.4

This patch release restores correct app identification on Linux, fixes search provider issues, adjusts tab grouping defaults, and makes Ecosia the default search engine again and also included Waterfox Private Search.

🌳 Ecosia partnership

I'm also happy to announce a renewed partnership with Ecosia, the search engine that uses its profits to fund climate-positive projects. Keeping Ecosia as your default helps create tangible impact while you browse.

• Real-world impact: Ecosia invests the majority of its profits into tree planting, biodiversity, and broader climate solutions, with transparent monthly reports.
• More privacy by default: Ecosia does not build cross-platform personal profiles for ad targeting. Personalization features and cookies are opt-in and require your consent.
• Greener infrastructure: Ecosia runs on renewable energy and is steward-owned to protect its mission for the long term.
• Quality results you expect: Ecosia is rolling out Google-powered results and ads for a growing number of users by default; otherwise results come via Microsoft Bing. You can choose Microsoft Bing instead within Ecosia’s settings.
• Consent and cookies: In the EU, UK, and certain US states, Google will not set additional cookies without your consent. Elsewhere, additional cookies may apply depending on your Google account and settings. Learn more in Ecosia’s privacy policy.

Prefer another provider? You can switch your default search engine in Waterfox any time via Settings → Search.

Waterfox Private Search is now also included in Waterfox; it's a subscription based service that offers you an ad-free search experience which directly helps fund Waterfox's development and keeps the privacy ethos and mission at its heart.

Fixed

• Mojeek searches now work out of the box (fixed a typo where the query parameter was p instead of q).
• When Google Search is set as default, autocomplete should now work.

Changed

• Linux: Restored the canonical app name and window class to waterfox, as it was in previous Waterfox versions (was waterfox-default).
• Tab grouping is disabled by default due to an issue where closing/reopening Waterfox could merge all groups into a single group at random.

6.6.3

This update focuses on polish and fixes, with special attention to a long‑standing theming issue and several quality‑of‑life improvements for tab grouping.

Fixes and improvements

Theming

• Resolved a long‑standing issue where Waterfox's styles could “leak” into the web page area. Customisations now apply only to the browser interface, not to website content.
• Improved handling of theme colouring to prevent contrast issues.
• Active tab context line has been enabled by default, after many requests.

Tab groups

• Smoother startup: automatic grouping now waits until your previous session has fully restored. It only applies to tabs you open after everything is loaded.
• Your existing tab order and groups are preserved at startup; nothing gets rearranged automatically.
• If you collapse your only tab group, you’ll still have a single ungrouped tab available. That tab won’t be pulled back into a group unless you choose to do so.

Compatibility

• Updated emoji support to Emoji 16.0.1 on platforms that don’t provide these characters natively, improving how newer emojis appear.

6.6.2

feat: use libz-rs-sys instead of zlib

6.6.1

:::tip[Just Updated?]
If you just got automatically updated to this version of Waterfox, you will have missed the full list of changes introduced in Waterfox 6.6.0

→ Read them here
:::

:::note
Unfortunately the way search engines are stored in Waterfox changed between 6.5 → 6.6 which will have resulted in your search engline list getting reset. Apologies for the inconvenience but this was a change that happened upstream and out of our control.
:::

Fixes

WebGPU

• Removed code that prevented WebGPU from running on release channel builds

Misc

• Re-implemented support for Unity global menu on Linux, with thanks to the Arch Linux maintainers
• Fixed an issue where the Install update option in about:addons did not appear after a manual update check when automatic updates were disabled
• Fixed an issue where the Restart command was not working on Linux and Windows (macOS unaffected)
• Fixed an issue where the Restart command was misaligned on Linux and Windows when icons in menus were disabled
• Disabled Captive Portal detection, let the operating system handle it instead, one less network request to Mozilla

Waterfox string updates

• Reordered and grouped entries in language files for improved readability and maintainability; no functional changes intended
• Restored two Tree Vertical Tabs strings inadvertently dropped during the reorg:
  • tree-auto-collapse-expand-subtree-on-attach (.label, .accesskey)
  • tree-auto-collapse-expand-subtree-on-select (.label, .accesskey)

Private Tabs improvements

• New preference to control button visibility

  • browser.privateTab.showNewTabButton
    • Controls the New Private Tab button next to the New Tab button
    • Applies instantly in both horizontal and vertical tab layouts
    • Is now false by default, toggle to true to enable

• Privacy enhancements for Private Tabs

  • Search suggestions are disabled in the address bar for Private container tabs
    • Neither remote engine suggestions nor local form history suggestions will appear
  • Search terms from Private container tabs are no longer saved
    • Form history entries are not written
    • Input/adaptive history is not written
  • The address bar view is cleared when switching into a Private container tab to avoid showing stale entries