Pale Moon Version 34.3.1 Released with Security Updates

  Pale Moon has been updated to version 34.3.1.  This is a security and bugfix update.

Changes/Fixes:

• Pale Moon will now exclude local resources from <base> CSP checks, aligning it with the rest of CSP handling.
• Fixed an issue where the devtools JSON viewer would, in some cases, make erroneous requests to remote servers.
• Updated libpng to 1.6.58+apng.
• Updated NSS to 3.90.12 (UXP), addressing multiple security issues.
• Fixed several intermittent and rare crashes.
• Security issues addressed: CVE-2026-12318 (CWE-125), CVE-2026-12322, CVE-2026-12292 (DiD), and multiple other issues that did not have a CVE designation at the time of patching.

Notes:

*DiD: This means that a fix is "Defense-in-Depth": It is a fix that does not apply to a (potentially) actively exploitable vulnerability in Pale Moon, but prevents future vulnerabilities caused by the same code, e.g. when surrounding code changes, exposing the problem, or when new attack vectors are discovered.

Pale Moon includes both 32- and 64-bit versions for Windows: Pale Moon for Windows downloads.

Update: To get the update now, select "Help" from the Pale Moon menu at the upper left of the browser window.  Select About Pale Moon > Check for Updates.

Release Notes
Release Cycle

Remember - "A day without laughter is a day wasted."

Pale Moon Version 34.3.0.1 Released with Fixes

 Pale Moon has been updated to version 34.3.0.1.  This is a small update to address 2 important usability/stability issues.

Changes/fixes:

• Fixed intermittent JavaScript engine crashes due to the newly-implemented FinalizationRegistry code.
• Fixed a webaudio channel mixing regression resulting in broken audio.

Pale Moon includes both 32- and 64-bit versions for Windows: Pale Moon for Windows downloads.

Update: To get the update now, select "Help" from the Pale Moon menu at the upper left of the browser window.  Select About Pale Moon > Check for Updates.

Release Notes
Release Cycle

Remember - "A day without laughter is a day wasted."
May the wind sing to you and the sun rise in your heart...

Pale Moon Version 34.3.0 Released with Security Updates

  Pale Moon has been updated to version 34.3.0.  This is a major development, bugfix and security release.

The update includes a long list of both New Features as well as Changes/fixes.  In addition, 18 potential vulnerabilities were found applicable and fixed.  Another 18 issues had *DiD code changes applied, and 4 were already mitigated before being reported. Of the reported security bugs, 150 were not applicable to Pale Moon code (with a good portion once again pertaining to e10s/multi-process browser architectures).

Notes:

*DiD: This means that a fix is "Defense-in-Depth": It is a fix that does not apply to a (potentially) actively exploitable vulnerability in Pale Moon, but prevents future vulnerabilities caused by the same code, e.g. when surrounding code changes, exposing the problem, or when new attack vectors are discovered.

Pale Moon includes both 32- and 64-bit versions for Windows: Pale Moon for Windows downloads.

Update: To get the update now, select "Help" from the Pale Moon menu at the upper left of the browser window.  Select About Pale Moon > Check for Updates.

Release Notes
Release Cycle

Remember - "A day without laughter is a day wasted."

Pale Moon Version 34.2.2 Released with Security Updates

  Pale Moon has been updated to version 34.2.2.  This is a stability and security update. 

Changes/fixes:

• Fixed a regression in 34.2.1 that would cause crashes to desktop when using certain extensions or visiting certain websites.
• Fixed potential security issues with audio channel mixing, MP3 decoding (DiD), international text display, DOM workers (DiD), reading of files (DiD), and the ANGLE graphics library.

Notes:

*DiD: This means that a fix is "Defense-in-Depth": It is a fix that does not apply to a (potentially) actively exploitable vulnerability in Pale Moon, but prevents future vulnerabilities caused by the same code, e.g. when surrounding code changes, exposing the problem, or when new attack vectors are discovered.

Pale Moon includes both 32- and 64-bit versions for Windows: Pale Moon for Windows downloads.

Update: To get the update now, select "Help" from the Pale Moon menu at the upper left of the browser window.  Select About Pale Moon > Check for Updates.

Release Notes
Release Cycle

Remember - "A day without laughter is a day wasted."

Pale Moon Version 34.2.1 Released with Security Updates

  Pale Moon has been updated to version 34.2.1.  This is a bugfix and security update. 

A large audit of security issues was performed. Many security issues were addressed, including potential crash scenarios and code correctness issues.

As a summary: 50 potential vulnerabilities were found applicable and fixed, 20 issues had DiD* code changes applied, and 4 were already mitigated before being reported.

Of the reported vulnerabilities, 270 were not applicable to Pale Moon code (with the vast majority pertaining to e10s/multi-process browser architecture) and 6 low-impact ones were marked for further investigation at a later time.

Notes:

For FreeBSD users: the binaries from this version forward require FreeBSD v14 or later.

*DiD: This means that a fix is "Defense-in-Depth": It is a fix that does not apply to a (potentially) actively exploitable vulnerability in Pale Moon, but prevents future vulnerabilities caused by the same code, e.g. when surrounding code changes, exposing the problem, or when new attack vectors are discovered.

Pale Moon includes both 32- and 64-bit versions for Windows: Pale Moon for Windows downloads.

Update: To get the update now, select "Help" from the Pale Moon menu at the upper left of the browser window.  Select About Pale Moon > Check for Updates.

Release Notes
Release Cycle

Remember - "A day without laughter is a day wasted."

Pale Moon Version 34.2.0 Released with Security Updates

  Pale Moon has been updated to version 34.2.0. This is a development, bugfix and security update.

The update includes new features and numerous changes/fixes. The update also addresses security issues: CVE-2026-4707 (DiD), CVE-2026-4690 (DiD), CVE-2026-4727 (DiD), and others without a CVE designation. A note that Mozilla-relevant security issues CVE-2025-59375 and CVE-2026-4726 had already been addressed in the browser before this release.

*DiD: This means that a fix is "Defense-in-Depth": It is a fix that does not apply to a (potentially) actively exploitable vulnerability in Pale Moon, but prevents future vulnerabilities caused by the same code, e.g. when surrounding code changes, exposing the problem, or when new attack vectors are discovered.

Note: This release as well as the preceding release is having a problem loading the Yahoo.com home page (forum discussion).

Pale Moon includes both 32- and 64-bit versions for Windows: Pale Moon for Windows downloads.

Update: To get the update now, select "Help" from the Pale Moon menu at the upper left of the browser window.  Select About Pale Moon > Check for Updates.

Note: This release as well as the preceding release is having a problem loading the Yahoo.com home page (forum discussion). 

Release Notes
Release Cycle

Remember - "A day without laughter is a day wasted."

Pale Moon Version 34.1.0 Released with Security Updates

  Pale Moon has been updated to version 34.1.0.  This is an important update landing technological enhancements previously intended to be in the v34.0 milestone.  

The update also addresses security issues:  CVE-2026-2806 (DiD), CVE-2026-2758, CVE-2026-2804, CVE-2026-2787 (DiD), CVE-2026-2757, CVE-2026-2773, CVE-2026-2779 (DiD), CVE-2026-2775, and several others that do not have a CVE designation.

*DiD: This means that a fix is "Defense-in-Depth": It is a fix that does not apply to a (potentially) actively exploitable vulnerability in Pale Moon, but prevents future vulnerabilities caused by the same code, e.g. when surrounding code changes, exposing the problem, or when new attack vectors are discovered.

Pale Moon includes both 32- and 64-bit versions for Windows: Pale Moon for Windows downloads.

Update: To get the update now, select "Help" from the Pale Moon menu at the upper left of the browser window.  Select About Pale Moon > Check for Updates.

Release Notes
Release Cycle

Remember - "A day without laughter is a day wasted."

Pale Moon Version 34.0.1 Released with Fixes

 Pale Moon has been updated to version 34.0.1.  This is a minor release to address some critical issues in the new milestone.

Changes/fixes:

• Backed out the expat library update for causing memory inflation and browser hang issues on XUL/XML and SVG files with particularly large attributes.
• Backed out the change of the Javascript PRNG for causing intermittent issues and crashes on 32-bit platforms.

Both of these issues are being investigated and can hopefully re-land with the next development release.

Pale Moon includes both 32- and 64-bit versions for Windows: Pale Moon for Windows downloads.

Update: To get the update now, select "Help" from the Pale Moon menu at the upper left of the browser window.  Select About Pale Moon > Check for Updates.

Release Notes
Release Cycle

Remember - "A day without laughter is a day wasted."
May the wind sing to you and the sun rise in your heart...

Pale Moon Version 34.0.0 Released with Security Updates

   Pale Moon has been updated to version 34.0.0.  This is a milestone update.  There are many changes in this update, the most important of which are below.

New features:

• Our default theme on Windows received a refresh and update. It should integrate better with Windows 11 now, and be more responsive to dark accent colors, among other things.
• Implemented WeakRef. See implementation notes.
• Implemented URL.canParse().
• Implemented the inset-block and inset-inline CSS shorthands.
• Added a preference (privacy.forgetaboutsite.clearPasswords) to control clearing of passwords when using "forget about this site" in the permissions manager, and disabled clearing of passwords by default, since it was considered unexpected behavior by the community.
• Changed our JavaScript PRNG to Xoroshiro128++ to make it more robust while keeping high performance.

Important updates and fixes:

• Re-landed CSS Cascade Layers support after the previous back-out.
• Re-landed CSS color-mix support after the previous back-out. RGB and HSL color spaces only, like previous.
• Implemented viewport overflow propagation logic. See implementation notes.
• Unprefixed CSS -moz-appearance; Pale Moon now accepts the unprefixed CSS appearance keyword. For compatibility, -moz-appearance and -webkit-appearance (if enabled) have been retained, although the long-term plan is to eventually remove the -moz prefixed one, so if you are an extension or theme developer, please consider switching your CSS to use appearance without a prefix.
• Fixed an intermittent but fairly prominent crash-to-desktop due to JavaScript garbage collection on certain modern sites.
• Fixed a crash on sites with certain types of CSP handling.
• Fixed a crash in WASM.
• Updated NSS to 3.90.9 (custom) to pick up several security and stability fixes.
• Updated ICU to v78.1. This is a major uplift for our internationalization subsystem, allowing further future developments for the Internationalization API.
• Updated Emoji support to Unicode 17.
• Updated our expat parser code to a more recent version (2.7.3), fixing various issues.
• Improved handling and rendering of emoji clusters.

Other changes:

• Added support for building on Sparc64 hardware.
• Added support for building for NetBSD on Alpha.
• Added basic support for building on Mac PowerPC (still a work in progress).
• Added basic support for building on LoongArch64 hardware (龍芯 CPUs).
• Added support for running on FreeBSD 15.
• Removed automatic coloring of auto-filled login fields as it would interfere with various browser and system color schemes.
  If preferred, this can be reinstated by users with a userContent.css document or e.g. the Stylem extension by leveraging the :autofill CSS pseudo-class.
• Restored support for in-process NPAPI plugins, allowing plugin use on systems where out-of-process is undesirable.
• Improved JavaScript IonMonkey stability on ARM and Mac SoC hardware.
• Linux GTK builds now always build with gio, and gconf support has been removed.
• Security issues addressed: CVE-2025-13015, CVE-2026-0879 (DiD), CVE-2026-0880 (DiD), CVE-2026-0889 (DiD), CVE-2026-0883, CVE-2026-0886 (DiD), and several others without a CVE designation.

*DiD: This means that a fix is "Defense-in-Depth": It is a fix that does not apply to a (potentially) actively exploitable vulnerability in Pale Moon, but prevents future vulnerabilities caused by the same code, e.g. when surrounding code changes, exposing the problem, or when new attack vectors are discovered.

Pale Moon includes both 32- and 64-bit versions for Windows: Pale Moon for Windows downloads.

Update: To get the update now, select "Help" from the Pale Moon menu at the upper left of the browser window.  Select About Pale Moon > Check for Updates.

Release Notes
Release Cycle

Remember - "A day without laughter is a day wasted."

Pale Moon Version 33.9.1 Released with Security Update

 Pale Moon has been updated to version 33.9.1.  This is a bugfix and security update.

Changes/fixes:

• Temporarily backed out the implementation of CSS Cascade Layers for causing layout issues on websites. This will re-land when fixed.
• Temporarily backed out the implementation of CSS color-mix for causing crashes. This will re-land when fixed.
• Per request from our user base, the blank page with the Pale Moon logo (default for new tabs) will now have an appropriate title (for e.g. identification in tab and window title).
• Further improved the "copy as cURL" devtools function. (CVE-2025-11713)

Implementation Notes:  

• There was one reported security issue (CVE-2025-11712) that was investigated but rejected, as adoption of the mitigation for a non-critical sec issue that requires very specific environments to be exploited (with considerable blame for the webmaster) would, in fact, require us to go against some very clear specifications in the HTML standard. Mozilla adopted this primarily for behavioral parity with Chrome. Security impact in the real world was considered to be negligible, and this would have negatively impacted some NPAPI functionality as well.
• The vast majority of this release cycle's Mozilla security issues centered around vulnerabilities due to its multi-process nature and inter-process communication, which are (of course) not applicable to Pale Moon (or any other UXP browser). Multi-process remains mainstream browsers' Achilles' heel, security wise, even years after moving to that application model. It's ironic that the supposed "big security advantages" of multi-process have been more than undermined by the technology itself.

Pale Moon includes both 32- and 64-bit versions for Windows: Pale Moon for Windows downloads.

Update: To get the update now, select "Help" from the Pale Moon menu at the upper left of the browser window.  Select About Pale Moon > Check for Updates.

Release Notes
Release Cycle

Remember - "A day without laughter is a day wasted."
May the wind sing to you and the sun rise in your heart...

Pale Moon Version 33.9.0.1 Released

 Pale Moon has been updated to version 33.9.0.1.  This is a minor but critical update to address important usability and stability issues.

Mac and FreeBSD builds are not ready yet but will be updated as well as soon as the maintainer has those platforms ready for release.

Release Notes

Pale Moon Version 33.9.0 Released with Security Updates

 Pale Moon has been updated to version 33.9.0.  This is a major development, bugfix and security release, The update is focusing primarily on improving web compatibility.

New Features:

• Implemented the CSS4 revert keyword.
• Implemented the clip keyword for overflow. See implementation notes.
  
• Implemented axis-shorthand parsing of overflow. This should fix some issues with areas being unscrollable on the web.
  
• Implemented CSS color-mix (RGB and HSL color spaces only).
• Implemented CSS @supports(selector(<complex selector>)) syntax.
• Implemented CSS Cascade Layers @layer support.
  
• Implemented support for CSS clip-path:<geometry-box> without actually supplying a clip path to use. See implementation notes.
• Implemented overflow-inline and overflow-block CSS properties.
• Implemented the :autofill CSS pseudo-class. Auto-filled fields will now also be styled by default to indicate autofilling/password manager recall has occurred.
  
• Implemented the :focus-visible CSS pseudo-class.
  
• Implemented the prefers-reduced-motion CSS media query. See implementation notes.
• Implemented a minimal version of the visualViewport web API. See implementation notes.

Changes/fixes:

• Un-prefixed CSS -moz-user-select and aligned with the user-select CSS4 spec.
• Un-prefixed CSS -moz-read-only and -moz-read-write pseudo-classes.
  
• Improved the handling of X-Content-Type-Options: nosniff to align more with the spec and expected behavior on the web.
• Added support for FFmpeg 7.0/libavcodec 61.
• Fixed a bug where sub-properties of CSS border-image would not update when the value they inherit from changes.
• Fixed a bug where scrollbar-width was incorrectly treated as an inherited property.
• Fixed an issue where screen/pixel color depth could potentially be mis-reported on Linux.
• Fixed a potential issue with fontconfig on Linux. We now explicitly initialize fontconfig on startup.
• Fixed various issues with vpx on PowerPC architectures.
• Fixed issues when building ffvpx on architectures without assembly support.
• Fixed a memory safety issue in two-position gradient color-stops code.
  
• Changed the way @import rules are processed. They will now be processed in the order of appearance in the importing stylesheet.
• Changed how TypedArray constructors handle initialization values, aligning with the ECMAScript spec. See implementation notes.
  
• Changed how Cache-control HTTP headers are parsed if multiple headers are present in a response.
• Made additional improvements to "Copy as cURL" devtools command.
  
• Security issues addressed: CVE-2025-10536 and CVE-2025-10533 DiD.

Implementation notes:

• The clip keyword allows you to specify overflow behavior that acts like a "passe-partout". This means any overflow will be hidden and content unscrollable.
  Important note: we have strictly followed the standard specification here which may result in issues on some websites if they do not explicitly specify overflow behavior in both axes when using clip as a keyword. clip, per the specification, results in unscrollable hidden content. If the other axis is unset, it will result in visible overflow that is also unscrollable (no scrollbar or mousewheel scrolling). Other browsers may default to scrollable visible overflow, instead. If you are a webmaster, please double-check if you are specifying overflow correctly when you are using clip. Because some of clip's behavior may be unintuitive at first glance, it serves well to always be explicit in both directions what kind of overflow behavior is desired.
• Pale Moon now supports specifying a CSS clip-path with just a geometry box (e.g. border-box) without defining a path. This should fix some websites displaying fully blank pages due to webmasters relying on implied "border-following" clipping when specifying a clip-path this way. Previously, this would result in everything being clipped (which used to be the explicit behaviour when no path definition was provided).
  
• The CSS media query prefers-reduced-motion can be used by webmasters to provide alternative styling of web pages when users indicate that they prefer web pages with less visual motion (e.g. for accessibility considerations for people with vestibular motion disorders). Pale Moon users can indicate this preference with a new option in the browser (Preferences -> Advanced -> tab "General" -> "Prefer reduced visual motion" under Accessibility). Please note that this option doesn't change how the browser itself handles e.g. animations or CSS; it is up to the webmaster to make use of this CSS feature to cater to visitors with this preference indicator.
  
• We now support a minimal implementation of the visualViewport web API. This API provides webmasters with indicators how much of the visible web pages should be considered "fully visible" to users. This API is primarily designed to cater to mobile traffic where browsers may be impaired by e.g. a camera notch in the screen. Since this isn't a concern on desktop, we always return a fixed (0,0) value for origin and offset. For other parts of the API, we give back the width/height of the root scrollframe of web content, while for scale we pass forward our dpp resolution (usually 1.0).
• TypedArray constructors can be passed initialization values to indicate the initial size of the array to create. According to the specced behavior, we should accept most values (anything accepted by ToIndex), even those that make no sense (e.g. a string or undefined). This has now been changed to align with that spec and we no longer throw an error in those cases, and simply return a 0-length typed array instead.

Pale Moon includes both 32- and 64-bit versions for Windows: Pale Moon for Windows downloads.

Update: To get the update now, select "Help" from the Pale Moon menu at the upper left of the browser window.  Select About Pale Moon > Check for Updates.

Release Notes
Release Cycle

Remember - "A day without laughter is a day wasted."
May the wind sing to you and the sun rise in your heart...

Pale Moon Version 33.8.2 Released with Security Updates

 Pale Moon has been updated to version 33.8.2.  This is a minor development, security and bugfix update.

Changes/fixes:

• Changed the way the address bar focus is handled when navigating to a fragment (#hash or anchor) within an existing URL. It will now re-focus the page the same way a normal address navigation would (resetting the "editing" state, unless the user is actively typing).
• Implemented support for the :focus-visible CSS pseudo-class.
• Fixed a potential race condition in font tables. DiD
• Fixed potential issues with pthread allocations. DiD
• Fixed an issue in NSS related to the PKCS12 decoder.
• Security issues addressed: CVE-2025-9181 and several others that do not have a CVE number.

Notes:  *DiD This means that a fix is "Defense-in-Depth": It is a fix that does not apply to a (potentially) actively exploitable vulnerability in Pale Moon, but prevents future vulnerabilities caused by the same code, e.g. when surrounding code changes, exposing the problem, or when new attack vectors are discovered.

Pale Moon includes both 32- and 64-bit versions for Windows: Pale Moon for Windows downloads.

Update: To get the update now, select "Help" from the Pale Moon menu at the upper left of the browser window.  Select About Pale Moon > Check for Updates.

Release Notes
Release Cycle

Remember - "A day without laughter is a day wasted."
May the wind sing to you and the sun rise in your heart...

Pale Moon Version33.8.1.2 Released

 Pale Moon has been updated to version 33.8.1.2.  

This is a bugfix update addressing issues with NPAPI plugins not working in v33.8.1.1.

Pale Moon includes both 32- and 64-bit versions for Windows: Pale Moon for Windows downloads.

Update: To get the update now, select "Help" from the Pale Moon menu at the upper left of the browser window.  Select About Pale Moon > Check for Updates.

Release Notes
Release Cycle

Remember - "A day without laughter is a day wasted."
May the wind sing to you and the sun rise in your heart...

Pale Moon Version 33.8.1.1 Released

  Pale Moon has been updated to version 33.8.1.1.  This is an important bugfix update.  Mac and FreeBSD will be updated shortly.

Changes/fixes:

• Fixed a browser crash in the new code introduced in 33.8.1 around <object> restrictions.
• Fixed a regression in the styling of the address bar drop-down making links unreadable when highlighted.

Pale Moon includes both 32- and 64-bit versions for Windows: Pale Moon for Windows downloads.

Update: To get the update now, select "Help" from the Pale Moon menu at the upper left of the browser window.  Select About Pale Moon > Check for Updates.

Release Notes
Release Cycle

Remember - "A day without laughter is a day wasted."
May the wind sing to you and the sun rise in your heart...

Pale Moon Version 33.8.1 Released with Security Updates

 Pale Moon has been updated to version 33.8.1.  This is a bugfix and security update.

Changes/fixes:

• Pale Moon no longer accepts nameless cookies. See implementation notes.
• Improved the "copy as curl" command in devtools further, partially rolling back the DiD changes in previous versions since we aren't offering cross-platform commands and it caused potential issues with overzealous escaping.
• Fixed a potential use-after-free scenario in the CSS parser.
• Fixed uninitialized use of fontconfig scenarios for Linux/GTK.
• Adjusted CSP URI reporting to more closely match the current spec and common browser behavior.
• Fixed a potential crash in font handling.
• Adjusted the size of WASM compiled table size limits to match V8/Gecko.
• Increased restrictions on the types of data loads <object> elements are allowed to trigger, to match the fetch spec more closely.
• Fixed build issues for PPC architectures.
• Security issues addressed: CVE-2025-8031, CVE-2025-8028 (DiD), CVE-2025-8037 (and related), CVE-2025-8029, and several others that do not have a CVE number.
  
  

Implementation notes:

• From this version forward we no longer accept nameless cookies. If a cookie has no name and starts with an equal sign, it is outright rejected. If a cookie consists only of a string with no equal sign, it is interpreted as a valueless cookie with the name set to the string. This departs from our inherited Mozilla behavior where this was previously treated as a nameless cookie with the string as the value.
  
  RFC 6265 forbids cookies without an equal sign (§5.2 step 2), but browsers accept them anyway for web compatibility reasons (poor web design). Moreover, §5.2 step 5 explicitly forbids nameless cookies.
  
  Valueless names also make more sense in web context: Set-cookie: itself supports secure and httponly as valueless attributes, and HTML supports valueless attributes as well.
  
  Our new behavior therefore makes more logical sense, is closer to the spec and general principles, aligns with webkit/Safari and solves a whole class of potential sec bugs like CVE-2025-8037. Apologies if this causes web compat issues, but it's the same thing to do when encountering non-compliant cookies.

Pale Moon includes both 32- and 64-bit versions for Windows: Pale Moon for Windows downloads.

Update: To get the update now, select "Help" from the Pale Moon menu at the upper left of the browser window.  Select About Pale Moon > Check for Updates.

Release Notes
Release Cycle

Remember - "A day without laughter is a day wasted."
May the wind sing to you and the sun rise in your heart...