# Mozilla Hacks - the Web developer blog hacks.mozilla.org This is one page of public article previews, not the complete archive. Follow Next page to continue. Summaries are not the original full articles. ## Intent to Ship: JPEG XL DevFeed: [Intent to Ship: JPEG XL]() Original publisher: [Read original article]() Author: Jake Archibald Published: 2026-08-24T15:32:15Z Content type: article Language: en Sources: [Mozilla Hacks - the Web developer blog]() Topics: [Firefox](), [Web](), [Rust](), [Firefox Nightly](), [Google](), [Chrome](), [C++]() Tags: [blog](), [browser](), [browsers](), [c-plus-plus](), [developer](), [features](), [firefox](), [firefox-nightly](), [google](), [hacks](), [interop](), [mozilla](), [uncategorized](), [web]() ### AI overview Mozilla announces its intent to ship JPEG XL in Firefox, using Google Research's Rust-based jxl-rs decoder to provide secure, performant support. The article highlights progressive rendering and compares JPEG XL with AVIF for different image-compression use cases. ### Source excerpt It isn't often that new image formats land in browsers. In the early 2000s we had JPEG, GIF, and PNG. The 2010s gave us WebP, which was a modest step up from JPEG. But the 2020s have given us two new image formats that are a big step up from previous formats: AVIF and JPEG [...] The post Intent to Ship: JPEG XL appeared first on Mozilla Hacks - the Web developer blog. ## PACT: Anonymous Credentials for the Web DevFeed: [PACT: Anonymous Credentials for the Web]() Original publisher: [Read original article]() Author: Dennis Jackson Published: 2026-06-23T15:29:52Z Content type: article Language: en Sources: [Mozilla Hacks - the Web developer blog]() Topics: [Web](), [browsers](), [AI Bots](), [Tooling]() Tags: [agent](), [blog](), [bots](), [browsers](), [developer](), [firefox](), [mozilla](), [privacy](), [security](), [technical](), [web]() ### AI overview This technical companion examines PACT, a proposed approach to anonymous credentials for the web. It describes how anti-abuse systems, privacy protections, generative AI, VPN use, and browser-based AI agents create tension between preventing abuse and preserving privacy and user choice. ### Source excerpt This is the technical companion to our update on Distilled, "Keeping the web open and private in the bot era." Here we take a deeper look at the problem space, the design we're proposing, and the problems still left to solve. Bots (and privacy-preserving browsers) not welcome Browse a news site in a private window. Shop [...] The post PACT: Anonymous Credentials for the Web appeared first on Mozilla Hacks - the Web developer blog. ## Announcing Web Serial Support in Firefox DevFeed: [Announcing Web Serial Support in Firefox]() Original publisher: [Read original article]() Author: Haik Aftandilian Published: 2026-05-21T18:00:05Z Content type: release Language: en Sources: [Mozilla Hacks - the Web developer blog]() Topics: [web applications](), [Web Development](), [modern web development]() Tags: [api](), [device-apis](), [devices](), [firefox](), [hardware](), [javascript](), [python](), [support](), [usb](), [web-apis]() ### AI overview Firefox 151 for Desktop adds Web Serial API support, allowing web applications to communicate with compatible serial-connected hardware without native software. ### Source excerpt Support for Web Serial in Firefox 151 for Desktop Firefox can now connect directly to microcontrollers, development boards, 3D printers, power meters, and other serial-connected hardware from the web. Starting in Firefox 151 for Desktop, support for the Web Serial API allows web applications to communicate with compatible devices without requiring native software. Web Serial [...] The post Announcing Web Serial Support in Firefox appeared first on Mozilla Hacks - the Web developer blog. ## Behind the Scenes Hardening Firefox with Claude Mythos Preview DevFeed: [Behind the Scenes Hardening Firefox with Claude Mythos Preview]() Original publisher: [Read original article]() Author: Brian Grinstead Published: 2026-05-07T16:01:21Z Content type: article Language: en Sources: [Mozilla Hacks - the Web developer blog]() Topics: [Firefox](), [Security](), [Claude](), [AI Models](), [Mozilla]() Tags: [ai-models](), [claude](), [developer](), [featured-article](), [firefox](), [mozilla](), [open-source](), [security]() ### AI overview Mozilla describes how Firefox teams used Claude Mythos Preview and other AI models to identify and fix latent security bugs, improve bug-finding workflows, and investigate sandbox escapes. ### Source excerpt Two weeks ago we announced that we had identified and fixed an unprecedented number of latent security bugs in Firefox with the help of Claude Mythos Preview and other AI models. In this post, we'll go into more detail about how we approached this work, what we found, and advice for other projects on making [...] The post Behind the Scenes Hardening Firefox with Claude Mythos Preview appeared first on Mozilla Hacks - the Web developer blog. ## Trustworthy JavaScript for the Open Web DevFeed: [Trustworthy JavaScript for the Open Web]() Original publisher: [Read original article]() Author: Firefox Security Team Published: 2026-05-05T15:49:11Z Content type: article Language: en Sources: [Mozilla Hacks - the Web developer blog]() Topics: [JavaScript](), [Web platform](), [web applications](), [browsers](), [End-to-End Encryption](), [Encryption](), [Security](), [Firefox Nightly](), [Cloudflare]() Tags: [applications](), [browsers](), [cloudflare](), [encryption](), [firefox](), [firefox-nightly](), [javascript](), [meta](), [open](), [security](), [web](), [web-platform]() ### AI overview Mozilla presents WAICT, a web platform proposal for making client-side JavaScript more trustworthy when servers may be malicious or compromised. It binds delivered code to a developer-supplied manifest, records manifests in a publicly auditable log, and enables browsers to reject code that has not been logged. An early prototype is available behind a preference in Firefox Nightly. ### Source excerpt The open web is a critical platform for applications that handle highly sensitive data, from private communications to financial transactions and medical records. Traditionally, servers are trusted to deliver the appropriate code and resources for their web applications to browsers, who then provide a secure and isolated environment for their execution. In some circumstances, this [...] The post Trustworthy JavaScript for the Open Web appeared first on Mozilla Hacks - the Web developer blog. ## Firefox Developer Edition and Beta: Try out Mozilla's .rpm package! DevFeed: [Firefox Developer Edition and Beta: Try out Mozilla's .rpm package!]() Original publisher: [Read original article]() Author: Bastien Orivel Published: 2026-03-25T16:17:11Z Content type: release Language: en Sources: [Mozilla Hacks - the Web developer blog]() Topics: [App]() Tags: [developer](), [featured-article](), [firefox](), [linux](), [mozilla](), [performance](), [release](), [security](), [testing](), [updates]() ### AI overview Mozilla announces Firefox Beta RPM packages for RPM-based Linux distributions. The repository supports package-manager installation and updates, with performance, security, and integration improvements. ### Source excerpt In January, we introduced our Nightly package for RPM-based Linux distributions. Today, we are thrilled to announce it is now available for Firefox Beta! Firefox Beta is great for testing your sites in a version of Firefox that will reach regular users in the coming weeks. If you find any issues, please file them on [...] The post Firefox Developer Edition and Beta: Try out Mozilla's .rpm package! appeared first on Mozilla Hacks - the Web developer blog. ## Why is WebAssembly a second-class language on the web? DevFeed: [Why is WebAssembly a second-class language on the web?]() Original publisher: [Read original article]() Author: Ryan Hunt Published: 2026-02-26T16:02:36Z Content type: article Language: en Sources: [Mozilla Hacks - the Web developer blog]() Topics: [Web Development](), [C++]() Tags: [c](), [c-plus-plus](), [developer-experience](), [featured-article](), [javascript](), [wasm](), [web](), [web-platform](), [webassembly]() ### AI overview The article argues that WebAssembly remains a second-class language on the web because it relies on JavaScript to access the web platform. It outlines WebAssembly's expanding capabilities and suggests WebAssembly Components could improve its integration and developer experience. ### Source excerpt This post is an expanded version of a presentation I gave at the 2025 WebAssembly CG meeting in Munich. WebAssembly has come a long way since its first release in 2017. The first version of WebAssembly was already a great fit for low-level languages like C and C++, and immediately enabled many new kinds of [...] The post Why is WebAssembly a second-class language on the web? appeared first on Mozilla Hacks - the Web developer blog. ## Goodbye innerHTML, Hello setHTML: Stronger XSS Protection in Firefox 148 DevFeed: [Goodbye innerHTML, Hello setHTML: Stronger XSS Protection in Firefox 148]() Original publisher: [Read original article]() Author: Tom Schuster Published: 2026-02-24T13:00:02Z Content type: tutorial Language: en Sources: [Mozilla Hacks - the Web developer blog]() Topics: [Vulnerabilities](), [Web platform](), [Web Development]() Tags: [api](), [browser](), [featured-article](), [firefox](), [firefox-releases](), [html](), [javascript](), [security](), [vulnerabilities](), [web-developers]() ### AI overview Firefox 148 ships the standardized Sanitizer API, including setHTML(), to sanitize untrusted HTML and reduce XSS risk. The article explains replacing innerHTML assignments, configuring allowed elements and attributes, and combining the API with Trusted Types for stronger protection. ### Source excerpt Cross-site scripting (XSS) remains one of the most prevalent vulnerabilities on the web. The new standardized Sanitizer API provides a straightforward way for web developers to sanitize untrusted HTML before inserting it into the DOM. Firefox 148 is the first browser to ship this standardized security enhancing API, advancing a safer web for everyone. We [...] The post Goodbye innerHTML, Hello setHTML: Stronger XSS Protection in Firefox 148 appeared first on Mozilla Hacks - the Web developer blog. ## Launching Interop 2026 DevFeed: [Launching Interop 2026]() Original publisher: [Read original article]() Author: Jake Archibald Published: 2026-02-12T17:07:24Z Content type: article Language: en Sources: [Mozilla Hacks - the Web developer blog]() Topics: [Web](), [Web platform](), [web-standards](), [browsers](), [Test coverage](), [dashboards](), [WebRTC](), [view transitions](), [CSS]() Tags: [apple](), [browser](), [css](), [featured-article](), [firefox](), [google](), [interop](), [microsoft](), [mozilla](), [uncategorized](), [view-transitions](), [web](), [web-developers](), [web-platform](), [webrtc]() ### AI overview Mozilla's Interop Project is launching Interop 2026, continuing its cross-browser effort to improve web compatibility through shared priorities and Web Platform Tests. The article reviews Interop 2025's progress, including higher overall scores, broader cross-browser support for major web platform features, and improved reliability for existing features such as WebRTC, CSS Flexbox, and CSS Grid. ### Source excerpt The Interop Project is a cross-browser initiative to improve web compatibility in areas that offer the most benefit to both users and developers. The group, including Apple, Google, Igalia, Microsoft, and Mozilla, takes proposals of features that are well defined in a sufficiently stable web standard, and have good test suite coverage. Then, we come [...] The post Launching Interop 2026 appeared first on Mozilla Hacks - the Web developer blog. ## CRLite: Fast, private, and comprehensive certificate revocation checking in Firefox DevFeed: [CRLite: Fast, private, and comprehensive certificate revocation checking in Firefox]() Original publisher: [Read original article]() Author: John Schanck Published: 2025-08-19T16:03:19Z Content type: article Language: en Sources: [Mozilla Hacks - the Web developer blog]() Topics: [Certificate Transparency](), [Cryptography]() Tags: [browser](), [certificate-transparency](), [encryption](), [feature](), [firefox](), [http](), [linux](), [macos](), [performance](), [privacy](), [security](), [tls](), [windows]() ### AI overview Firefox's CRLite locally checks revoked TLS certificates using a compact, periodically updated encoding derived from Certificate Transparency logs. The article contrasts this approach with real-time OCSP checks, emphasizing privacy, reliability, and performance. ### Source excerpt Firefox is now the first and the only browser to deploy fast and comprehensive certificate revocation checking that does not reveal your browsing activity to anyone (not even to Mozilla). Tens of millions of TLS server certificates are issued each day to secure communications between browsers and websites. These certificates are the cornerstones of ubiquitous [...] The post CRLite: Fast, private, and comprehensive certificate revocation checking in Firefox appeared first on Mozilla Hacks - the Web developer blog. ## Improving Firefox Stability in the Enterprise by Reducing DLL Injection DevFeed: [Improving Firefox Stability in the Enterprise by Reducing DLL Injection]() Original publisher: [Read original article]() Author: Haik Aftandilian Published: 2025-03-25T18:31:16Z Content type: article Language: en Sources: [Mozilla Hacks - the Web developer blog]() Topics: [Firefox](), [data loss prevention](), [Security](), [Windows](), [Mozilla]() Tags: [blog](), [data-loss-prevention](), [enterprise](), [feature](), [firefox](), [mozilla](), [security](), [web-browser](), [windows]() ### AI overview Firefox 138 will provide an alternative to DLL injection for enterprise Data Loss Prevention deployments. The article explains how third-party DLLs injected into Firefox can cause incompatibilities, crashes, security bypasses, and other unpredictable behavior, especially as the browser changes frequently. ### Source excerpt Beginning in version 138, Firefox will offer an alternative to DLL injection for Data Loss Prevention (DLP) deployments in enterprise environments. DLL Injection DLL injection into Firefox is a topic we've covered on the Hacks blog before. In 2023, we blogged about the Firefox capability to let users block third-party DLLs from being loaded. We [...] The post Improving Firefox Stability in the Enterprise by Reducing DLL Injection appeared first on Mozilla Hacks - the Web developer blog. ## Launching Interop 2025 DevFeed: [Launching Interop 2025]() Original publisher: [Read original article]() Author: James Graham Published: 2025-02-13T16:59:13Z Content type: article Language: en Sources: [Mozilla Hacks - the Web developer blog]() Topics: [Web Development]() Tags: [accessibility](), [browsers](), [css](), [featured-article](), [firefox](), [interop](), [interoperability](), [storage](), [view-transitions](), [web](), [web-developers](), [web-platform](), [webrtc](), [zoom]() ### AI overview Interop 2025 coordinates browser vendors around 19 web-platform focus areas to improve cross-browser compatibility. It follows Interop 2024, whose shared test pass rate reached 95% in current browser releases. ### Source excerpt Interop 2025 continues the mission to make the web more consistent across browsers, building on 2024's 95% interoperability score. This year, 19 focus areas target key developer needs and long-standing issues, including WebRTC improvements, Storage Access API, and CSS Zoom. The post Launching Interop 2025 appeared first on Mozilla Hacks - the Web developer blog. ## Introducing Uniffi for React Native: Rust-Powered Turbo Modules DevFeed: [Introducing Uniffi for React Native: Rust-Powered Turbo Modules]() Original publisher: [Read original article]() Author: Mark Mayo Published: 2024-12-04T19:38:01Z Content type: article Language: en Sources: [Mozilla Hacks - the Web developer blog]() Topics: [React Native](), [Rust](), [cross-platform](), [Mozilla](), [Open Source](), [JavaScript](), [Process]() Tags: [c-plus-plus](), [cross-platform](), [developer-tools](), [featured-article](), [firefox](), [javascript](), [memory-safety](), [mozilla](), [open-source](), [performance](), [react](), [react-native](), [rust]() ### AI overview Mozilla and Filament introduce Uniffi for React Native, an open-source tool for building React Native Turbo Modules in Rust. It generates bindings that let developers use Rust for shared core logic across iOS and Android, helping address JavaScript-thread performance limits while avoiding duplicated platform code or more difficult C++ integration. ### Source excerpt Mozilla and Filament have introduced Uniffi for React Native, a tool that allows developers to leverage the safety and performance benefits of Rust in cross-platform React Native apps. The post Introducing Uniffi for React Native: Rust-Powered Turbo Modules appeared first on Mozilla Hacks - the Web developer blog. ## Llamafile v0.8.14: a new UI, performance gains, and more DevFeed: [Llamafile v0.8.14: a new UI, performance gains, and more]() Original publisher: [Read original article]() Author: Stephen Hood Published: 2024-10-16T13:32:30Z Content type: release Language: en Sources: [Mozilla Hacks - the Web developer blog]() Topics: [Local AI](), [Language models](), [releases](), [Retrieval Augmented Generation (RAG)]() Tags: [ai](), [api](), [command-line](), [featured-article](), [hardware](), [llamafile](), [llms](), [open-source](), [performance](), [release](), [retrieval-augmented-generation-rag](), [ui]() ### AI overview Llamafile 0.8.14 adds a terminal chat interface, performance improvements, and expanded model support for running open LLMs locally. ### Source excerpt Discover the latest release of Llamafile 0.8.14, an open-source AI tool by Mozilla Builders. With a new command-line chat interface, enhanced performance, and support for powerful models, Llamafile makes it easy to run large language models (LLMs) on your own hardware. Learn more about the updates and how to get involved with this cutting-edge project. The post Llamafile v0.8.14: a new UI, performance gains, and more appeared first on Mozilla Hacks - the Web developer blog. ## 0Din: A GenAI Bug Bounty Program - Securing Tomorrow's AI Together DevFeed: [0Din: A GenAI Bug Bounty Program - Securing Tomorrow's AI Together]() Original publisher: [Read original article]() Author: Marco Figueroa Published: 2024-08-08T18:39:13Z Content type: article Language: en Sources: [Mozilla Hacks - the Web developer blog]() Topics: [genai](), [Artificial Intelligence](), [Security](), [Vulnerabilities](), [ai security](), [prompt injection](), [Jailbreak]() Tags: [ai](), [ai-security](), [artificial-intelligence](), [bounty](), [bug-bounty](), [bugs](), [coding](), [featured-article](), [genai](), [jailbreak](), [prompt-injection](), [security](), [vulnerabilities]() ### AI overview This article introduces 0Din, a GenAI bug bounty program focused on identifying and mitigating vulnerabilities in AI systems. It explains the reporting and review process, reward criteria, covered vulnerability types, and participant eligibility. ### Source excerpt As AI continues to evolve, so do the threats against it. As these GenAI systems become more sophisticated and widely adopted, ensuring their security and ethical use becomes paramount. 0Din is a groundbreaking GenAI bug bounty program dedicated specifically to help secure GenAI systems and beyond. In this blog, you'll learn about 0Din, how it works, and how you can participate and make a difference in securing our AI future. The post 0Din: A GenAI Bug Bounty Program - Securing Tomorrow's AI Together appeared first on Mozilla Hacks - the Web developer blog. ## Announcing Official Puppeteer Support for Firefox DevFeed: [Announcing Official Puppeteer Support for Firefox]() Original publisher: [Read original article]() Author: James Graham Published: 2024-08-07T15:44:40Z Content type: article Language: en Sources: [Mozilla Hacks - the Web developer blog]() Topics: [Puppeteer](), [Firefox](), [Automation](), [webDriver](), [Chrome](), [Web]() Tags: [automation](), [blog](), [browser](), [chrome](), [featured-article](), [firefox](), [mozilla](), [testing](), [web](), [web-developers](), [webdriver]() ### AI overview Puppeteer version 23 adds first-class Firefox support, enabling browser automation and end-to-end testing against both Firefox and Chrome. The implementation uses the cross-browser WebDriver BiDi protocol, with examples including console log capture and device emulation. ### Source excerpt We're pleased to announce that, as of version 23, the Puppeteer browser automation library now has first-class support for Firefox. This means that it's now easy to write automation and perform end-to-end testing using Puppeteer, and run against both Chrome and Firefox. The post Announcing Official Puppeteer Support for Firefox appeared first on Mozilla Hacks - the Web developer blog. ## Snapshots for IPC Fuzzing DevFeed: [Snapshots for IPC Fuzzing]() Original publisher: [Read original article]() Author: Christian Holler Published: 2024-06-27T16:18:49Z Content type: article Language: en Sources: [Mozilla Hacks - the Web developer blog]() Topics: [Fuzzing/Fuzz testing](), [Firefox](), [out-of-process](), [Security](), [Vulnerabilities](), [Testing]() Tags: [featured-article](), [firefox](), [fuzzing](), [ipc](), [memory-safety](), [mozilla](), [open-source](), [processes](), [security](), [snapshots](), [ssecurity](), [testing](), [vulnerabilities]() ### AI overview This article explains how Firefox uses process separation and IPC to isolate lower-privilege content processes from the privileged parent process. It introduces snapshot fuzzing, a method for rewinding application state to make testing critical IPC interfaces more practical by avoiding costly browser restarts and reducing iteration latency. ### Source excerpt Process separation remains one of the most important parts of the Firefox security model and securing our IPC (Inter-Process Communication) interfaces is crucial to keep privileges in the different processes separated. We take a more detailed look at our newest tool for finding vulnerabilities in these interfaces - snapshot fuzzing. The post Snapshots for IPC Fuzzing appeared first on Mozilla Hacks - the Web developer blog. ## Sponsoring sqlite-vec to enable more powerful Local AI applications DevFeed: [Sponsoring sqlite-vec to enable more powerful Local AI applications]() Original publisher: [Read original article]() Author: Stephen Hood Published: 2024-06-25T15:25:58Z Content type: news Language: en Sources: [Mozilla Hacks - the Web developer blog]() Topics: [Local AI]() Tags: [ai](), [artificial-intelligence](), [discord](), [featured-article](), [firefox](), [llamafile](), [local-ai](), [mozilla](), [on-device](), [open-source](), [rag](), [sqlite](), [vector]() ### AI overview Mozilla is sponsoring sqlite-vec through its Builders program to bring vector search to SQLite for local AI applications. The project is presented as enabling on-device uses such as retrieval-augmented generation and semantic search. ### Source excerpt Today we're proud to announce the next Mozilla Builders project: sqlite-vec. Led by independent developer Alex Garcia, this project brings vector search functionality to the beloved SQLite embedded database. Alex has been working on this problem for a while, and we think his latest approach will have a great impact by providing application developers with a powerful new tool for building Local AI applications. The post Sponsoring sqlite-vec to enable more powerful Local AI applications appeared first on Mozilla Hacks - the Web developer blog. ## Experimenting with local alt text generation in Firefox Nightly DevFeed: [Experimenting with local alt text generation in Firefox Nightly]() Original publisher: [Read original article]() Author: Tarek Ziadé Published: 2024-05-31T16:43:46Z Content type: article Language: en Sources: [Mozilla Hacks - the Web developer blog]() Topics: [On-device AI](), [AI, ML & Data Engineering](), [cpu]() Tags: [ai](), [alt-text](), [artificial-intelligence](), [cpu](), [feature](), [featured-article](), [firefox](), [firefox-nightly](), [inference](), [machine-learning](), [on-device-ai](), [pdf]() ### AI overview Firefox Nightly is testing private, on-device AI that generates image alt text in its built-in PDF editor, with a longer-term goal of helping screen-reader users while browsing. ### Source excerpt Firefox 130 will introduce an experimental new capability to automatically generate alt-text for images using a fully private on-device AI model. The feature will be available as part of Firefox's built-in PDF editor, and our end goal is to make it available in general browsing for users with screen readers. The post Experimenting with local alt text generation in Firefox Nightly appeared first on Mozilla Hacks - the Web developer blog. ## Llamafile's progress, four months in DevFeed: [Llamafile's progress, four months in]() Original publisher: [Read original article]() Author: Stephen Hood Published: 2024-04-25T15:34:08Z Content type: article Language: en Sources: [Mozilla Hacks - the Web developer blog]() Topics: [Language models](), [SDKs]() Tags: [ai](), [cuda](), [developer-tools](), [discord](), [featured-article](), [firefox](), [gpu](), [hugging-face](), [inference](), [language-models](), [llama-cpp](), [llamafile](), [open-source](), [openai](), [raspberrypi]() ### AI overview Mozilla's update on llamafile describes v0.8 support for recent open models, CPU-inference performance work, and tinyBLAS GPU acceleration for NVIDIA and AMD hardware without requiring CUDA installation on Windows. ### Source excerpt When Mozilla's Innovation group first launched the llamafile project late last year, we were thrilled by the immediate positive response from open source AI developers. It's become one of Mozilla's top three most-favorited repositories on GitHub, attracting a number of contributors, some excellent PRs, and a growing community on our Discord server. The post Llamafile's progress, four months in appeared first on Mozilla Hacks - the Web developer blog.