Firefox 148 adds AI kill switch, fixes 50+ security flaws
With the new Firefox 148 browser update for Windows, macOS, and Linux, Mozilla is introducing a number of new features and improvements. For example, the backup feature is now available to more users, and you can disable all AI features with a single click. The developers have also fixed a large number of security vulnerabilities.
Mozilla plans to release Firefox 149 in four weeks on March 24th.
Table of Contents
What’s new in Firefox 148?
Probably the most important new feature is the AI Settings section of the browser settings. Here, you can disable all “AI”-based functions, then manually re-enable the ones you do want. For example, you might want to keep the translation function, which works locally and not in the cloud. You can also select which AI chatbot you want to use in the dedicated sidebar (unless you, of course, disable everything).
Windows 10 users who have Firefox set to delete browser data upon exit can now also use the data backup feature. Data that’s set to be deleted won’t be backed up. This feature is under Synchronization settings.
Security fixes in Firefox 148
Mozilla lists over 50 vulnerabilities that have been fixed in its 2026-13 Security Advisory for Firefox 148.
Mozilla classifies more than half of the externally reported security vulnerabilities as high risk. Five of these relate to ways of breaking out of the browser sandbox, and eight use-after-free vulnerabilities have been plugged in the JavaScript components. Many of the vulnerabilities could be exploited to inject and execute code on a system. None of these security vulnerability are knowingly being attacked in the wild.
The last three entries in the Security Advisory list an unspecified number of internally discovered vulnerabilities, which are summarized under CVE numbers CVE-2026-2807, CVE-2026-2792, and CVE-2026-2793. These problematic memory access errors are also considered high risk, and some of them even affect Firefox ESR and Thunderbird.
Firefox ESR and Thunderbird
In addition to Firefox 148, Mozilla has also released Firefox ESR versions 140.8.0 and 115.33.0, although the latter is only available for Windows 7/8.1 and macOS 10.12 to 10.14.
In the ESR versions, Mozilla has fixed the aforementioned vulnerabilities that are present in the partly-well-established code of these older browser generations. In Firefox ESR 140.8, there are 37 fixed vulnerabilities; in Firefox ESR 115.33, there are 21. Note that Firefox ESR 115.33 is the last release of its branch, to be discontinued this month.
Thunderbird 148.0 and 140.8.0esr have also been released. In these versions, the developers have also fixed dozens of security vulnerabilities inherited from Firefox.
