In summary:
- PCWorld highlights that Mozilla’s Firefox 148 update addresses over 50 security vulnerabilities, including high-risk memory access errors and sandbox escape flaws.
- The update introduces an AI kill switch through new ‘AI Settings’ that lets users disable all AI features and selectively re-enable desired ones like local translation.
- Users should update immediately as many vulnerabilities could enable code execution, with Firefox ESR and Thunderbird also receiving critical security patches.
With the new Firefox 148 browser update for Windows, macOS, and Linux, Mozilla is introducing a number of new features and improvements. For example, the backup feature is now available to more users, and you can disable all AI features with a single click. The developers have also fixed a large number of security vulnerabilities.
Mozilla plans to release Firefox 149 in four weeks on March 24th.
What’s new in Firefox 148?
Probably the most important new feature is the AI Settings section of the browser settings. Here, you can disable all “AI”-based functions, then manually re-enable the ones you do want. For example, you might want to keep the translation function, which works locally and not in the cloud. You can also select which AI chatbot you want to use in the dedicated sidebar (unless you, of course, disable everything).
Windows 10 users who have Firefox set to delete browser data upon exit can now also use the data backup feature. Data that’s set to be deleted won’t be backed up. This feature is under Synchronization settings.
Security fixes in Firefox 148
Mozilla lists over 50 vulnerabilities that have been fixed in its 2026-13 Security Advisory for Firefox 148.
Mozilla classifies more than half of the externally reported security vulnerabilities as high risk. Five of these relate to ways of breaking out of the browser sandbox, and eight use-after-free vulnerabilities have been plugged in the JavaScript components. Many of the vulnerabilities could be exploited to inject and execute code on a system. None of these security vulnerability are knowingly being attacked in the wild.
The last three entries in the Security Advisory list an unspecified number of internally discovered vulnerabilities, which are summarized under CVE numbers CVE-2026-2807, CVE-2026-2792, and CVE-2026-2793. These problematic memory access errors are also considered high risk, and some of them even affect Firefox ESR and Thunderbird.
Firefox ESR and Thunderbird
In addition to Firefox 148, Mozilla has also released Firefox ESR versions 140.8.0 and 115.33.0, although the latter is only available for Windows 7/8.1 and macOS 10.12 to 10.14.
In the ESR versions, Mozilla has fixed the aforementioned vulnerabilities that are present in the partly-well-established code of these older browser generations. In Firefox ESR 140.8, there are 37 fixed vulnerabilities; in Firefox ESR 115.33, there are 21. Note that Firefox ESR 115.33 is the last release of its branch, to be discontinued this month.
Thunderbird 148.0 and 140.8.0esr have also been released. In these versions, the developers have also fixed dozens of security vulnerabilities inherited from Firefox.
This article originally appeared on our sister publication PC-WELT and was translated and localized from German.
Author: Frank Ziemann, Contributor, PCWorld
Frank Ziemann has been working as a freelance author for sister site PC-WELT since 2005, writing news and test reports. His main topics are IT security (malware, antivirus, security gaps) and Internet technology.