Evidence collection
v140.0-evidences-13869309.json 97ba4a9d
Collected 6 days ago
Release notes
Changes
- Updated to Firefox 140.0.
- Updated to Phoenix 2025.06.24.1 - (See changes from the last IronFox release).
- Fixed an issue that prevented users from installing extensions from
.xpifiles locally (See details). - Other minor tweaks, adjustments, and fixes.
Checksums
fbc077fe21f13573a1b1eed296991f2dd21a5ab1d2d7b58103ed9db5b17451ac IronFox-v140.0-arm64-v8a.apk
cd27928f142ab2fdf2867fb177e7fc8fee55dfb32274dd62a0db897e9288345c IronFox-v140.0-armeabi-v7a.apk
de7e84450053b1058428309085a769345bde9ee8643a92bd5a01391bef827b16 IronFox-v140.0-x86_64.apk
f10ee678b9fe2395c8a950de2143987fae7116ed90a8aa02bbd5e7a42988741f IronFox-v140.0.apksThis release was automatically generated by the CI/CD pipeline (view pipeline) and is guaranteed to be generated from commit 161d4061.
Evidence collection
v139.0.4.1-evidences-13714131.json c16f0090
Collected 2 weeks ago
Release notes
Changes
- Updated to Phoenix 2025.06.12.1 to fix an issue with file uploads experienced by some users (1, 2, 3).
Checksums
42e1ef840716d276f471d8fddcccd475574aa753f8fb4ab609bacdc028becd36 IronFox-v139.0.4.1-arm64-v8a.apk
da14e80f71777d6a39c4707dfc6e1a535930c20e600e60e04554f53236023412 IronFox-v139.0.4.1-armeabi-v7a.apk
51bf0f4def3977230159e666a90320c664fdae711cec81e9cce595b3268a8ddb IronFox-v139.0.4.1-x86_64.apk
48294be84c6aae39711842236d78975eaaed5b43e2bac99ebb4aff0d34167348 IronFox-v139.0.4.1.apksThis release was automatically generated by the CI/CD pipeline (view pipeline) and is guaranteed to be generated from commit 83f2bc30.
Evidence collection
v139.0.4-evidences-13681338.json a3310436
Collected 2 weeks ago
Release notes
Changes
- Updated to Firefox 139.0.4.
- Updated to Phoenix 2025.06.10.1. - (See changes from the last IronFox release)
Checksums
7c40e293d0fd2686add69b70c40e14c3d6a1fb3248ba1210546c5246048a64b0 IronFox-v139.0.4-arm64-v8a.apk
52193902acf9692f95c5b9b10b6b67ad9ae07ac1f6dda2aa375c2b4d5b57dbbc IronFox-v139.0.4-armeabi-v7a.apk
c6b7f368c4581a7206f2ee0cf3b4122eb610901a6673987467fe178ec9fdb35f IronFox-v139.0.4-x86_64.apk
c081944f2be666a86ccac800b6399c437f7200d886dfe58639378d4dd6eac70a IronFox-v139.0.4.apksThis release was automatically generated by the CI/CD pipeline (view pipeline) and is guaranteed to be generated from commit d343daa7.
Evidence collection
v139.0.3-evidences-13633950.json 16cbc8ad
Collected 3 weeks ago
Release notes
Changes
- Updated to Firefox 139.0.3.
- Updated to Phoenix 2025.06.06.1. - (See changes from the last IronFox release)
- Allowed installing add-ons from
addons.mozilla.orgwithout the privilegedmozAddonManagerAPI, via a patch derived from Tor Browser - and disabled themozAddonManagerAPI by default. - Disabled timezone spoofing for Google domains in first party contexts by default to prevent CAPTCHAs. See Notes below for details on how to re-enable this timezone spoofing if preferred.
- Other minor tweaks and adjustments.
Notes
To re-enable timezone spoofing for Google domains in first-party contexts, you should set the value of privacy.fingerprintingProtection.granularOverrides in your about:config to:
[{"firstPartyDomain":"google.ad","overrides":"+JSDateTimeUTC"},{"firstPartyDomain":"google.ae","overrides":"+JSDateTimeUTC"},{"firstPartyDomain":"google.al","overrides":"+JSDateTimeUTC"},{"firstPartyDomain":"google.am","overrides":"+JSDateTimeUTC"},{"firstPartyDomain":"google.as","overrides":"+JSDateTimeUTC"},{"firstPartyDomain":"google.at","overrides":"+JSDateTimeUTC"},{"firstPartyDomain":"google.az","overrides":"+JSDateTimeUTC"},{"firstPartyDomain":"google.ba","overrides":"+JSDateTimeUTC"},{"firstPartyDomain":"google.be","overrides":"+JSDateTimeUTC"},{"firstPartyDomain":"google.bf","overrides":"+JSDateTimeUTC"},{"firstPartyDomain":"google.bg","overrides":"+JSDateTimeUTC"},{"firstPartyDomain":"google.bi","overrides":"+JSDateTimeUTC"},{"firstPartyDomain":"google.bj","overrides":"+JSDateTimeUTC"},{"firstPartyDomain":"google.bs","overrides":"+JSDateTimeUTC"},{"firstPartyDomain":"google.bt","overrides":"+JSDateTimeUTC"},{"firstPartyDomain":"google.by","overrides":"+JSDateTimeUTC"},{"firstPartyDomain":"google.ca","overrides":"+JSDateTimeUTC"},{"firstPartyDomain":"google.cat","overrides":"+JSDateTimeUTC"},{"firstPartyDomain":"google.cd","overrides":"+JSDateTimeUTC"},{"firstPartyDomain":"google.cf","overrides":"+JSDateTimeUTC"},{"firstPartyDomain":"google.cg","overrides":"+JSDateTimeUTC"},{"firstPartyDomain":"google.ch","overrides":"+JSDateTimeUTC"},{"firstPartyDomain":"google.ci","overrides":"+JSDateTimeUTC"},{"firstPartyDomain":"google.cl","overrides":"+JSDateTimeUTC"},{"firstPartyDomain":"google.cm","overrides":"+JSDateTimeUTC"},{"firstPartyDomain":"google.cn","overrides":"+JSDateTimeUTC"},{"firstPartyDomain":"google.co.ao","overrides":"+JSDateTimeUTC"},{"firstPartyDomain":"google.co.bw","overrides":"+JSDateTimeUTC"},{"firstPartyDomain":"google.co.ck","overrides":"+JSDateTimeUTC"},{"firstPartyDomain":"google.co.cr","overrides":"+JSDateTimeUTC"},{"firstPartyDomain":"google.co.id","overrides":"+JSDateTimeUTC"},{"firstPartyDomain":"google.co.il","overrides":"+JSDateTimeUTC"},{"firstPartyDomain":"google.co.in","overrides":"+JSDateTimeUTC"},{"firstPartyDomain":"google.co.jp","overrides":"+JSDateTimeUTC"},{"firstPartyDomain":"google.co.ke","overrides":"+JSDateTimeUTC"},{"firstPartyDomain":"google.co.kr","overrides":"+JSDateTimeUTC"},{"firstPartyDomain":"google.co.ls","overrides":"+JSDateTimeUTC"},{"firstPartyDomain":"google.co.ma","overrides":"+JSDateTimeUTC"},{"firstPartyDomain":"google.co.mz","overrides":"+JSDateTimeUTC"},{"firstPartyDomain":"google.co.nz","overrides":"+JSDateTimeUTC"},{"firstPartyDomain":"google.co.th","overrides":"+JSDateTimeUTC"},{"firstPartyDomain":"google.co.tz","overrides":"+JSDateTimeUTC"},{"firstPartyDomain":"google.co.ug","overrides":"+JSDateTimeUTC"},{"firstPartyDomain":"google.co.uk","overrides":"+JSDateTimeUTC"},{"firstPartyDomain":"google.co.uz","overrides":"+JSDateTimeUTC"},{"firstPartyDomain":"google.co.ve","overrides":"+JSDateTimeUTC"},{"firstPartyDomain":"google.co.vi","overrides":"+JSDateTimeUTC"},{"firstPartyDomain":"google.co.za","overrides":"+JSDateTimeUTC"},{"firstPartyDomain":"google.co.zm","overrides":"+JSDateTimeUTC"},{"firstPartyDomain":"google.co.zw","overrides":"+JSDateTimeUTC"},{"firstPartyDomain":"google.com","overrides":"+JSDateTimeUTC"},{"firstPartyDomain":"google.com.af","overrides":"+JSDateTimeUTC"},{"firstPartyDomain":"google.com.ag","overrides":"+JSDateTimeUTC"},{"firstPartyDomain":"google.com.ar","overrides":"+JSDateTimeUTC"},{"firstPartyDomain":"google.com.au","overrides":"+JSDateTimeUTC"},{"firstPartyDomain":"google.com.bd","overrides":"+JSDateTimeUTC"},{"firstPartyDomain":"google.com.bh","overrides":"+JSDateTimeUTC"},{"firstPartyDomain":"google.com.bn","overrides":"+JSDateTimeUTC"},{"firstPartyDomain":"google.com.bo","overrides":"+JSDateTimeUTC"},{"firstPartyDomain":"google.com.br","overrides":"+JSDateTimeUTC"},{"firstPartyDomain":"google.com.bz","overrides":"+JSDateTimeUTC"},{"firstPartyDomain":"google.com.co","overrides":"+JSDateTimeUTC"},{"firstPartyDomain":"google.com.cu","overrides":"+JSDateTimeUTC"},{"firstPartyDomain":"google.com.cy","overrides":"+JSDateTimeUTC"},{"firstPartyDomain":"google.com.do","overrides":"+JSDateTimeUTC"},{"firstPartyDomain":"google.com.ec","overrides":"+JSDateTimeUTC"},{"firstPartyDomain":"google.com.eg","overrides":"+JSDateTimeUTC"},{"firstPartyDomain":"google.com.et","overrides":"+JSDateTimeUTC"},{"firstPartyDomain":"google.com.fj","overrides":"+JSDateTimeUTC"},{"firstPartyDomain":"google.com.gh","overrides":"+JSDateTimeUTC"},{"firstPartyDomain":"google.com.gi","overrides":"+JSDateTimeUTC"},{"firstPartyDomain":"google.com.gt","overrides":"+JSDateTimeUTC"},{"firstPartyDomain":"google.com.hk","overrides":"+JSDateTimeUTC"},{"firstPartyDomain":"google.com.jm","overrides":"+JSDateTimeUTC"},{"firstPartyDomain":"google.com.kh","overrides":"+JSDateTimeUTC"},{"firstPartyDomain":"google.com.kw","overrides":"+JSDateTimeUTC"},{"firstPartyDomain":"google.com.lb","overrides":"+JSDateTimeUTC"},{"firstPartyDomain":"google.com.ly","overrides":"+JSDateTimeUTC"},{"firstPartyDomain":"google.com.mm","overrides":"+JSDateTimeUTC"},{"firstPartyDomain":"google.com.mt","overrides":"+JSDateTimeUTC"},{"firstPartyDomain":"google.com.mx","overrides":"+JSDateTimeUTC"},{"firstPartyDomain":"google.com.my","overrides":"+JSDateTimeUTC"},{"firstPartyDomain":"google.com.na","overrides":"+JSDateTimeUTC"},{"firstPartyDomain":"google.com.ng","overrides":"+JSDateTimeUTC"},{"firstPartyDomain":"google.com.ni","overrides":"+JSDateTimeUTC"},{"firstPartyDomain":"google.com.np","overrides":"+JSDateTimeUTC"},{"firstPartyDomain":"google.com.om","overrides":"+JSDateTimeUTC"},{"firstPartyDomain":"google.com.pa","overrides":"+JSDateTimeUTC"},{"firstPartyDomain":"google.com.pe","overrides":"+JSDateTimeUTC"},{"firstPartyDomain":"google.com.pg","overrides":"+JSDateTimeUTC"},{"firstPartyDomain":"google.com.ph","overrides":"+JSDateTimeUTC"},{"firstPartyDomain":"google.com.pk","overrides":"+JSDateTimeUTC"},{"firstPartyDomain":"google.com.pr","overrides":"+JSDateTimeUTC"},{"firstPartyDomain":"google.com.py","overrides":"+JSDateTimeUTC"},{"firstPartyDomain":"google.com.qa","overrides":"+JSDateTimeUTC"},{"firstPartyDomain":"google.com.sa","overrides":"+JSDateTimeUTC"},{"firstPartyDomain":"google.com.sb","overrides":"+JSDateTimeUTC"},{"firstPartyDomain":"google.com.sg","overrides":"+JSDateTimeUTC"},{"firstPartyDomain":"google.com.sl","overrides":"+JSDateTimeUTC"},{"firstPartyDomain":"google.com.sv","overrides":"+JSDateTimeUTC"},{"firstPartyDomain":"google.com.tj","overrides":"+JSDateTimeUTC"},{"firstPartyDomain":"google.com.tr","overrides":"+JSDateTimeUTC"},{"firstPartyDomain":"google.com.tw","overrides":"+JSDateTimeUTC"},{"firstPartyDomain":"google.com.ua","overrides":"+JSDateTimeUTC"},{"firstPartyDomain":"google.com.uy","overrides":"+JSDateTimeUTC"},{"firstPartyDomain":"google.com.vc","overrides":"+JSDateTimeUTC"},{"firstPartyDomain":"google.com.vn","overrides":"+JSDateTimeUTC"},{"firstPartyDomain":"google.cv","overrides":"+JSDateTimeUTC"},{"firstPartyDomain":"google.cz","overrides":"+JSDateTimeUTC"},{"firstPartyDomain":"google.de","overrides":"+JSDateTimeUTC"},{"firstPartyDomain":"google.dj","overrides":"+JSDateTimeUTC"},{"firstPartyDomain":"google.dk","overrides":"+JSDateTimeUTC"},{"firstPartyDomain":"google.dm","overrides":"+JSDateTimeUTC"},{"firstPartyDomain":"google.dz","overrides":"+JSDateTimeUTC"},{"firstPartyDomain":"google.ee","overrides":"+JSDateTimeUTC"},{"firstPartyDomain":"google.es","overrides":"+JSDateTimeUTC"},{"firstPartyDomain":"google.fi","overrides":"+JSDateTimeUTC"},{"firstPartyDomain":"google.fm","overrides":"+JSDateTimeUTC"},{"firstPartyDomain":"google.fr","overrides":"+JSDateTimeUTC"},{"firstPartyDomain":"google.ga","overrides":"+JSDateTimeUTC"},{"firstPartyDomain":"google.ge","overrides":"+JSDateTimeUTC"},{"firstPartyDomain":"google.gg","overrides":"+JSDateTimeUTC"},{"firstPartyDomain":"google.gl","overrides":"+JSDateTimeUTC"},{"firstPartyDomain":"google.gm","overrides":"+JSDateTimeUTC"},{"firstPartyDomain":"google.gr","overrides":"+JSDateTimeUTC"},{"firstPartyDomain":"google.gy","overrides":"+JSDateTimeUTC"},{"firstPartyDomain":"google.hn","overrides":"+JSDateTimeUTC"},{"firstPartyDomain":"google.hr","overrides":"+JSDateTimeUTC"},{"firstPartyDomain":"google.ht","overrides":"+JSDateTimeUTC"},{"firstPartyDomain":"google.hu","overrides":"+JSDateTimeUTC"},{"firstPartyDomain":"google.ie","overrides":"+JSDateTimeUTC"},{"firstPartyDomain":"google.im","overrides":"+JSDateTimeUTC"},{"firstPartyDomain":"google.iq","overrides":"+JSDateTimeUTC"},{"firstPartyDomain":"google.is","overrides":"+JSDateTimeUTC"},{"firstPartyDomain":"google.it","overrides":"+JSDateTimeUTC"},{"firstPartyDomain":"google.je","overrides":"+JSDateTimeUTC"},{"firstPartyDomain":"google.jo","overrides":"+JSDateTimeUTC"},{"firstPartyDomain":"google.kg","overrides":"+JSDateTimeUTC"},{"firstPartyDomain":"google.ki","overrides":"+JSDateTimeUTC"},{"firstPartyDomain":"google.kz","overrides":"+JSDateTimeUTC"},{"firstPartyDomain":"google.la","overrides":"+JSDateTimeUTC"},{"firstPartyDomain":"google.li","overrides":"+JSDateTimeUTC"},{"firstPartyDomain":"google.lk","overrides":"+JSDateTimeUTC"},{"firstPartyDomain":"google.lt","overrides":"+JSDateTimeUTC"},{"firstPartyDomain":"google.lu","overrides":"+JSDateTimeUTC"},{"firstPartyDomain":"google.lv","overrides":"+JSDateTimeUTC"},{"firstPartyDomain":"google.md","overrides":"+JSDateTimeUTC"},{"firstPartyDomain":"google.me","overrides":"+JSDateTimeUTC"},{"firstPartyDomain":"google.mg","overrides":"+JSDateTimeUTC"},{"firstPartyDomain":"google.mk","overrides":"+JSDateTimeUTC"},{"firstPartyDomain":"google.ml","overrides":"+JSDateTimeUTC"},{"firstPartyDomain":"google.mn","overrides":"+JSDateTimeUTC"},{"firstPartyDomain":"google.mu","overrides":"+JSDateTimeUTC"},{"firstPartyDomain":"google.mv","overrides":"+JSDateTimeUTC"},{"firstPartyDomain":"google.mw","overrides":"+JSDateTimeUTC"},{"firstPartyDomain":"google.ne","overrides":"+JSDateTimeUTC"},{"firstPartyDomain":"google.nl","overrides":"+JSDateTimeUTC"},{"firstPartyDomain":"google.no","overrides":"+JSDateTimeUTC"},{"firstPartyDomain":"google.nr","overrides":"+JSDateTimeUTC"},{"firstPartyDomain":"google.nu","overrides":"+JSDateTimeUTC"},{"firstPartyDomain":"google.pl","overrides":"+JSDateTimeUTC"},{"firstPartyDomain":"google.pn","overrides":"+JSDateTimeUTC"},{"firstPartyDomain":"google.ps","overrides":"+JSDateTimeUTC"},{"firstPartyDomain":"google.pt","overrides":"+JSDateTimeUTC"},{"firstPartyDomain":"google.ro","overrides":"+JSDateTimeUTC"},{"firstPartyDomain":"google.rs","overrides":"+JSDateTimeUTC"},{"firstPartyDomain":"google.ru","overrides":"+JSDateTimeUTC"},{"firstPartyDomain":"google.rw","overrides":"+JSDateTimeUTC"},{"firstPartyDomain":"google.sc","overrides":"+JSDateTimeUTC"},{"firstPartyDomain":"google.se","overrides":"+JSDateTimeUTC"},{"firstPartyDomain":"google.sh","overrides":"+JSDateTimeUTC"},{"firstPartyDomain":"google.si","overrides":"+JSDateTimeUTC"},{"firstPartyDomain":"google.sk","overrides":"+JSDateTimeUTC"},{"firstPartyDomain":"google.sn","overrides":"+JSDateTimeUTC"},{"firstPartyDomain":"google.so","overrides":"+JSDateTimeUTC"},{"firstPartyDomain":"google.sm","overrides":"+JSDateTimeUTC"},{"firstPartyDomain":"google.sr","overrides":"+JSDateTimeUTC"},{"firstPartyDomain":"google.st","overrides":"+JSDateTimeUTC"},{"firstPartyDomain":"google.td","overrides":"+JSDateTimeUTC"},{"firstPartyDomain":"google.tg","overrides":"+JSDateTimeUTC"},{"firstPartyDomain":"google.tl","overrides":"+JSDateTimeUTC"},{"firstPartyDomain":"google.tm","overrides":"+JSDateTimeUTC"},{"firstPartyDomain":"google.tn","overrides":"+JSDateTimeUTC"},{"firstPartyDomain":"google.to","overrides":"+JSDateTimeUTC"},{"firstPartyDomain":"google.tt","overrides":"+JSDateTimeUTC"},{"firstPartyDomain":"google.vu","overrides":"+JSDateTimeUTC"},{"firstPartyDomain":"google.ws","overrides":"+JSDateTimeUTC"}]You can also disable all of our (and Mozilla's) default FPP granular overrides entirely by setting privacy.fingerprintingProtection.remoteOverrides.enabled to false in your about:config - though keep in mind that we also include default FPP granular overrides to harden protection for certain websites, which you would also lose by setting this preference to false.
Checksums
b923fcb08034903dab848101764f070e6c29dd799388f0d33ce632cf41dc257a IronFox-v139.0.3-arm64-v8a.apk
1fe91e8022bd3f3421ac95c0b5217fe5f7a53e4a3e0a879324785016105209fe IronFox-v139.0.3-armeabi-v7a.apk
565803bc0d16cee6a5e1b93cd16bdef0714cc47113412b8cf5216d5520d31c8c IronFox-v139.0.3-x86_64.apk
569162a72f555dd01bd02a88f533ad3ac681b7987a4b478f7855f2be6b5db61f IronFox-v139.0.3.apksThis release was automatically generated by the CI/CD pipeline (view pipeline) and is guaranteed to be generated from commit 1f6721f2.
Evidence collection
v139.0-evidences-13535602.json 2b5bf5ee
Collected 1 month ago
Release notes
Changes
- Updated to Firefox 139.0.
- Removed unnecessary URL query parameters for built-in links (notably: for support articles).
-
Fixed the display of certain media/icons on
icloud.com&icloud.com.cn. - Hardened fingerprinting protection for
apple.com,apple.com.cn,cvs.com,kroger.com, andmedium.comby default. - Other minor tweaks and adjustments.
Checksums
a03eecc21418235154121b9a71c70339758baef98842fefee5405740370ebfef IronFox-v139.0-arm64-v8a.apk
3d35fe9ea563d21debc55dcc9c5c0ee751d5502a6bb33c8f2d039479c45af683 IronFox-v139.0-armeabi-v7a.apk
29606568bf0805719ebdfdcde4ea20820d976dd7af555702f92ffd72ca7b015e IronFox-v139.0-x86_64.apk
221ad2e0629f2df31a8ff2ef1a24e61459c02ad973c8f145adb59808606f1698 IronFox-v139.0.apksThis release was automatically generated by the CI/CD pipeline (view pipeline) and is guaranteed to be generated from commit ee09a1de.
Evidence collection
v138.0.4-evidences-13380719.json fb22fb5a
Collected 1 month ago
Release notes
Changes
- Updated to Firefox 138.0.4.
- Updated our uBlock Origin
assets.jsonconfiguration file per latest upstream changes. - Updated
branding.patchto ensure we always report the user agent asFirefoxlike LibreWolf. LibreWolf recently had a bug that caused the user agent to be reported asLibreWolffor users in certain instances, which caused breakage and posed privacy (fingerprinting) concerns. While we weren't impacted by an issue of this nature, this change will ensure we aren't impacted by something like it in the future. - Updated fingerprinting protection overrides to harden fingerprinting protection for
rezka-ua.in,southwest.com, and Zoho domains. - Other tweaks, adjustments, and refinements.
Checksums
40d650e2bf8af6a8a07e9a00fa88b2ea4ad1acb58cc177991ff21be2a2446561 IronFox-v138.0.4-arm64-v8a.apk
1ae19c24319d3b45bed3fbcfaea44ebe4b05a32423f6dba9469a2f7c4629fd42 IronFox-v138.0.4-armeabi-v7a.apk
a0feda87b0a1415b8823a32226c9f7ea3b263041a01a0d1512031bb569d884fd IronFox-v138.0.4-x86_64.apk
2145dff005c17e3d5092d4713b4a85f6edd3c38384d2e6af543f168022a7ca43 IronFox-v138.0.4.apksThis release was automatically generated by the CI/CD pipeline (view pipeline) and is guaranteed to be generated from commit 0cc8bd61.
Evidence collection
v138.0.3-evidences-13333345.json 3f82bf83
Collected 1 month ago
Release notes
Changes
- Updated to Firefox 138.0.3.
- Updated to Phoenix 2025.05.11.1. - (See changes from the last IronFox release)
- Fixed an issue that prevented the JIT toggle from working properly in certain instances.
- Limited scope of our certificate pinning changes to fix issues experienced by users. Note that we still improve certificate pinning over standard Firefox.
- Updated build arguments - notably to enable performance optimizations (ex. LTO & PGO), disable GSS-API/Negotiate authentication, and to disable background tasks.
- Allowed configuring more preferences from the
about:config - Disabled HLS
- Other tweaks and adjustments.
Checksums
2e6e299b54529e0d8a7436e4dd11b3c41f64104001349e41ca33ba3a97c08898 IronFox-v138.0.3-arm64-v8a.apk
8c2936d5f3b452d83e2c7d666529a1f1961d509809779fb9ef0266f1ff18bd44 IronFox-v138.0.3-armeabi-v7a.apk
be7cce656946a6243e5a7b2eaf8161094aa76b0cb91c492b2aeaa2738257209f IronFox-v138.0.3-x86_64.apk
cc3ccfabd81ef2eb1aee8c536077882563deb8a08735d0b17e73bb6e7518f802 IronFox-v138.0.3.apksThis release was automatically generated by the CI/CD pipeline (view pipeline) and is guaranteed to be generated from commit 0292ce18.
Evidence collection
v138.0.1-evidences-13191611.json ff25eb60
Collected 1 month ago
Release notes
Changes
- Updated to Firefox 138.0.1.
- Fixed a bug that prevented the feature to sanitize data on exit from working properly for some users. If you were impacted by this issue, after updating to this release: please disable and re-enable the option to clear data on exit, and unselect the checkboxes + reselect your choices. - #85 + #86
- Updated the JIT & Safe Browsing toggles to automatically restart when changed, and added subtitles to warn users before restarting to prevent unintended data loss.
- Other minor tweaks.
Notes
As part of this release, we identified and fixed an issue that prevented the feature to sanitize data on exit from working properly for some users. If you were impacted by this issue, after updating to this release: please disable and re-enable the option to clear data on exit, and unselect the checkboxes + reselect your choices. We apologize for any inconvenience or unintended data loss, and appreciate your time, patience, and support.
Checksums
699a54c01c9adb773681720a326857d136a8a6706a4807d7d60c0906f30c80b8 IronFox-v138.0.1-arm64-v8a.apk
34d969a49146c1e623b451bce8d1f647415ee150965b8a297d44458d28346bdd IronFox-v138.0.1-armeabi-v7a.apk
492bcc26147f7ef6ca4f57538ab6c7e533417a667482e49d3448b2f3b1c26f19 IronFox-v138.0.1-x86_64.apk
2c9a9685bb44ccc6c944a489f46a0af9356f83a7ab87083ff500ba9af2df6bf8 IronFox-v138.0.1.apksThis release was automatically generated by the CI/CD pipeline (view pipeline) and is guaranteed to be generated from commit 0662041e.
Evidence collection
v138.0.0-evidences-13159278.json 3d9a2cd6
Collected 2 months ago
Release notes
Changes
- Updated to Firefox 138.0.
- Updated to Phoenix 2025.04.27.1. - (See changes from the last IronFox release)
-
Added a toggle under
Privacy and securityin settings to control Safe Browsing. Note that this requires a restart to take effect. -
Added toggles under
Privacy and security->Site settingsto control JavaScript, JIT, and WebAssembly. (Note that the JIT toggle requires a restart to take effect). Due to the addition of these toggles, we've now enabled WebAssembly by default (due to the notable breakage it causes), though users are recommended to disable it if possible to improve security. JIT will remain disabled by default. -
Neutered the
mozAddonManagerAPI to restrict its capabilities and limit the data shared with Mozilla, while still allowing users to install extensions fromaddons.mozilla.org. - We now harden FPP (Fingerprinting Protection) and set our overrides to unbreak websites internally, instead of using the
privacy.fingerprintingProtection.granularOverrides&privacy.fingerprintingProtection.overridespreferences like we have previously. This makes it far easier for users to add their own overrides if needed. If you have previously configured either of these preferences, it is highly recommended to reset them after updating to these release. If you would like to disable our overrides to unbreak websites (as well as Mozilla's), you can do so by settingprivacy.fingerprintingProtection.remoteOverrides.enabledtofalsein yourabout:config. -
Added a
Quick fixeslist to uBlock Origin by default to allow us to work-around/fix issues caused by our default config significantly faster (while we wait on the upstream list maintainers to fix the issues...). - Implemented LibreWolf's Remote Settings Blocker patch to allow us (and users) to limit what collections are read/downloaded from Mozilla, and reduce the data shared. Users can configure this from the
browser.ironfox.services.settings.allowedCollectionspreference in theabout:config, though we would not recommend editing this unless necessary, as the collections we allow by default were carefully considered and provide important functionality, including for security. -
Improved visibility of domains in the URL bar to better protect against phishing. - (Thanks to @mimi89999!
- Significantly improved upon and expanded Mozilla's built-in certificate pinning to protect against MITM attacks. If you're a website operator and would like your domain to be added or want to request details be changed, please file an issue!
- Took back control of all Safe Browsing preferences, meaning these can now be freely controlled by the users from the
about:config(with the exception ofbrowser.safebrowsing.malware.enabled&browser.safebrowsing.phishing.enabled- these are controlled by the new toggle in Settings). For example, users can now set their own custom Safe Browsing provider if desired, disable our proxy and revert back to Google's standard domains, etc... -
Hardened the internal PDF Viewer (
PDF.js) with changes inspired by GrapheneOS's PDF Viewer. - #79 - Disabled CSP Reporting to improve privacy, reduce undesired network activity, and limit the data shared with website operators.
- Enabled Proxy Bypass Protection to help prevent leaks for proxy users.
- Fixed a bug that caused cookies/site data and permissions to always clear on exit, regardless of their check boxes/values set by users.
-
Disabled Firefox's new
Unified Trust Panelredesign for the menu that appears when you select the lock icon on the top left of the URL bar by default, due to phishing concerns (as it unfortunately doesn't currently display the full URL if it's too long). - You can re-enable this if preferred by navigating to IronFox'sSettings->About IronFox-> Tap IronFox's logo at the top 5 times, then go back toSettings->Secret Settings->Unified Trust Panel. -
Disabled the
com.widevine.alphakey system (MediaDrm). -
Disabled Mozilla's GeoIP/
RegionService to prevent Firefox from monitoring the user's region/general location and reduce unwanted network activity. - Disabled system extensions & system policies at build-time.
-
Disabled & removed the build dependency on legacy
AutoConfigfunctionality (also known as Mission Control Desktop, debuted in Netscape Communicator 4.5... https://www.internetnews.com/enterprise/netscape-unveils-enterprise-management-tools/) to reduce attack surface and reliance on legacy code. - Disabled more unnecessary debugging/development features at build-time.
- Explicitly disabled SpiderMonkey performance telemetry at build-time.
- Enabled mobile optimizations at build-time.
-
Updated the onboarding to remove
Privacy Policy/Terms of Usereferences, and replaced the Firefox logo (and certain other elements) with our own. - Removed Swisscows as a default search engine due to concerns regarding false marketing of their VPN and spreading false claims about other services, such as Signal.
- Other minor tweaks, fixes, & adjustments.
Checksums
29602f88c4d4639c35fa7f62da9217053d191e31c37150d744a1fbfac64d3a8d IronFox-v138.0.0-arm64-v8a.apk
8cd851b12905d799cb133cfa6893abd1df1b78f5f3d6f3d6753617574b0941d2 IronFox-v138.0.0-armeabi-v7a.apk
f1e93bd3a271bda54bf1d628cbf07695a53b729a724d7a9eb67ec0c06bfe5b9e IronFox-v138.0.0-x86_64.apk
67cc6d2e5202ea999fc0c14a454d89705aa3bd20f2b5b70c88034eee2af06e23 IronFox-v138.0.0.apksThis release was automatically generated by the CI/CD pipeline (view pipeline) and is guaranteed to be generated from commit 0883e0ae.
Evidence collection
v137.0.2-evidences-13000237.json 4918ef27
Collected 2 months ago
Release notes
Changes
- Updated to Firefox 137.0.2.
- Updated to Phoenix 2025.04.15.1. - (See changes from the last IronFox release)
- Disabled Accessibility Services by default due to privacy & security concerns, but added an option for users to re-enable them if desired, which can be found by navigating to
Settings->General->Accessibility. - Hid the UI setting for Remote Debugging. Remote Debugging can still be enabled if needed from the
about:config, but this change forces it to reset per-session (ensuring Remote Debugging is only on as long as needed, and that users don't accidentally leave it enabled...), and prevents users from accidentally/unnecessarily enabling it in the first place. - Set external links in PDFs to open in new tabs/windows by default. You can revert this to its standard behavior by setting
pdfjs.externalLinkTargetto0in yourabout:config. - Prevented extensions from configuring various browser settings without explicit user consent. Note that the values of these settings can still be read by extensions, just not edited.
- Enabled the ability to add signatures to PDFs. You can disable this by setting
pdfjs.enableSignatureEditortofalsein yourabout:config. - Disabled annoying prompts encouraging users to set IronFox as the default browser or engage with promotional features.
- Other minor tweaks & adjustments.
Checksums
3e6c143b00ba8f1f6a3b649be807ead359145ca063c3142bccfcc05cca7638ce IronFox-v137.0.2-arm64-v8a.apk
3fc650ee68be21f29c2a7ed6b68089c614af95913bee0bebb9f0a6e676fa4d0c IronFox-v137.0.2-armeabi-v7a.apk
0d4fef6f3be031c41e2a72453a39e05d64348a15f1f38f59fb913e3137d34a9e IronFox-v137.0.2-x86_64.apk
dd06e36639b694478a4d28096063d46bbbdbdee1f7ae6d858fa37898ba686210 IronFox-v137.0.2.apksThis release was automatically generated by the CI/CD pipeline (view pipeline) and is guaranteed to be generated from commit b528d43c.