fidzu : thunderbird

When it's Monday morning and you're on the subway, in a coffee shop, or squeezing in a few email replies after your morning workout, your phone becomes your digital office. But every time you open your browser, you risk getting struck with any combination of distracting ads, auto-playing videos, and open tabs from the previous week competing for your attention.

For many remote and on-the-go workers, your mobile browser can become a minefield of interruptions and distractions, slowing you down when you need to focus most.

Luckily, there are multiple Firefox features that can help ensure your mobile browser is a focused, productive workspace.

Reduce distractions and clutter with Ad Blocker for Firefox on iOS

Opening a link shared via text or email can save time and keep things moving when a client or coworker needs a fast response. However, once it's actually opened, there is a lot of opportunity for various pop-ups, overlays, and ads to get in between you and what you came in to do.

Ad Blocker for Firefox on iOS was built to reduce distractions and screen clutter while you browse, so you can stay focused on the task at hand. It's a built-in, optional feature that blocks many intrusive ad formats, third-party ad networks, and ad-related trackers. That means no separate extension required, and you decide if and when to use it.

Because Firefox's strong line-up of ad-blocking and privacy extensions on desktop and Android are not available in the same way on iOS, we built Ad Blocker for Firefox directly into the browser. To decide what gets blocked, Ad Blocker uses the EasyList filter and Apple's WebKit Content Blocker technology. It won't impact every ad or sponsored content on a new tab, as those presented directly by host sites and displayed in search results will still be visible.

To try Ad Blocker on iOS, go to Settings > Browsing > Ad Blocker and turn it on to enjoy a cleaner browsing experience.

Get the gist faster with Shake to Summarize

When you're on a deadline, scanning through heavy text, ads, and filler content can turn a quick scan into an infinite scroll session.

Firefox's Shake to Summarize feature helps people get the gist in seconds on both iOS and Android. To use it, simply shake your phone on any web page under 5,000 words, and a clean summary of the page's content will instantly appear. It can also be activated by tapping the "Summarize Page" option under "More" in the three-dot menu.

Like all Firefox features, we built Shake to Summarize with your privacy and protection in mind. This means using device-specific technology to keep your data secure. You can learn more about the AI powering this feature here.

The feature launched on iOS last September, received a strong response from users, and earned a special mention in TIME's Best Inventions of 2025. It is now available on iOS and Android in English, German, French, Spanish, Portuguese, Italian, and Japanese.

Keep your tabs tidy with Tab Groups on Android

Just like us, our smartphones tend to live multiple lives: work, personal, and everything in between. While it can be incredibly convenient to have everything you need for all parts of your life on one device, things can get cluttered fast.

One minute you are knee-deep in a client proposal and the next you're flicking through the countless Google searches from over the weekend. "How old is Harry Styles?" and "Movie times near me" - while pertinent when you were off the clock 24 hours ago - have absolutely nothing to do with the work you are trying to get done now.

To help make sure your prep for Thursday's client meeting doesn't get lost in your pop music deep dive from the weekend, you can group related tabs in Firefox for Android. Each group can be labeled and assigned a color, appearing as a single, searchable card in the tab tray rather than separate tabs, so it's easy to locate when needed. You can open, rename, recolor, and delete these cards whenever you want.

To use Tab Groups on Android, simply drag one tab onto another, or select a few and tap "Add to group." Label the group, choose a color, and you're all set. To try it out, download the latest version of Firefox for Android. iOS support for this feature is on the way.

Pick up where you left off across devices with Firefox Sync

Sometimes we start a task on one device and finish it on another. Maybe you found an article on your computer that you want to read on the subway on your phone. Or, perhaps you want to pull out your laptop and finish filling out that lease application you started on your tablet.

Enable Firefox Sync and you can resume tasks you paused in your browser when switching across your mobile phone, tablet, and laptop. The feature lets you access your open tabs, bookmarks, and passwords across all the devices you access Firefox on.

The best part? We put your data privacy first. Firefox Sync uses end-to-end encryption so your synced data is encrypted before it reaches Mozilla's servers.

To take your browsing experience with you wherever you go, connect your iOS or Android phone to your Mozilla account and start syncing with your other devices.

Take back control of your focus with Firefox

For remote and on-the-go workers, focus is everything.

With Firefox features like built-in ad blocking on iOS, Shake to Summarize for instant insights, and Tab Groups on Android to keep your work and personal digital spaces organized, you can transform your phone from a distraction hub into a productive workspace.

Download the latest version of Firefox for Android or Firefox for iOS today to test out any of the above features available on your device - and take back control of your attention.

The post Stay focused wherever you work with Firefox mobile browsers appeared first on The Mozilla Blog.

21 Sep 2026 5:00pm GMT

The Rust Security Response Team was notified that Miri stores all environment variables to target/, allowing secrets to persist in caches.

While not necessary a vulnerability in and of itself, when paired with GitHub Actions caching behavior, it is possible for this to expose secrets to PRs.

Overview

GitHub Actions makes it possible to cache directories between runs. Typical setups allow CI runs on main (and other branches) to write to cache, and PRs can only read from cache (preventing cache poisoning). Rust projects tend to speed up CI by caching binaries built by cargo install and sometimes the contents of target/.

PR CI can be triggered by anyone who can open PRs on your repository. GitHub requires maintainer approval for the first PR, but future PRs will rerun CI on every push. Anyone who has previously landed a change can trigger a CI run extracting information from cached target/ and then cover their tracks by pushing a second commit to the PR.

GitHub sometimes hides overwritten commits in its UI, making this kind of attack harder to detect. CI run logs and overwritten commits are also deleted after a few months.

When cargo miri is invoked, Miri needs to retain build-relevant environment variables between runs¹. The current code to do so achieves this by storing all environment variables to target/. This, of course, persists when target/ is cached.

If your environment contained secrets, these can now be accessed by PRs via the cache.

Our fix

Our short term fix for this is to make Miri only preserve CARGO_* environment variables (excepting CARGO_*_TOKEN) and OUT_DIR. In the longer term, Miri and cargo may figure out better ways to inform Miri of the relevant list of environment variables. Note that this patch may not be available on nightly yet.

We also performed an ecosystem scan of GitHub repositories and identified 1 repository with this issue and 7 repositories that do not appear to be vulnerable but should be cautious anyway. We have reached out to those maintainers.

Am I affected?

It is likely that our scan was imperfect, so we recommend you check your own GitHub Actions setups if you run Miri.

You are vulnerable if:

• You run cargo miri in CI
• The step that runs cargo miri has access to secrets as an environment variable:
  • By being passed in to the step itself as an environment variable
  • By being set in env for the workflow
  • By being passed in to a previous step that persists it in the environment somehow
• The workflow being used caches the target directory, usually done via actions/cache or swatinem/rust-cache
• The cache is accessible to PRs (common and often the intended use case)

Possible quick fixes include:

• Disabling cache for that job.
• Scoping secrets to steps in that job that do not call Miri.
• Temporarily disabling Miri.

Once done, please clear the cache. Consider rotating any secrets that might have leaked.

The Miri release in the upcoming nightly (2026-09-22) will no longer have this problem.

Even if you do not run Miri, ensure jobs that can write to public caches do not have access to secrets. Many tools do not have special handling for secrets, and assume the entire environment can be written to the filesystem.

Threat model

We consider it bad practice to have a cache that can easily be tainted by secrets.

If caching target/, it is worth making sure that the inputs to processes that create target/ (anything invoking cargo) do not have secrets available. It is generally rare for standard cargo build/test subcommands to need any secrets or tokens², so this is mostly a matter of being careful about having secrets exposed as environment variables to the entire job.

Cargo/Miri/Rust does not guarantee that environment variables will be safe from being copied into target/. While we are treating this as a security issue and patching it out of an abundance of caution, this is not something you should rely on in general. Beyond official Rust tooling, it is possible for build scripts to be doing things that lead to the environment being stored in compilation artifacts.

Acknowledgements

Thanks to Predrag Gruevski of OpenAI for reporting this issue to us. Furthermore, the ecosystem scan was performed using Codex access and credits donated by OpenAI, which we also thank them for.

Issue triage and remediation was performed by Manish Goregaokar, Ralf Jung, Ben Kimock, Weihang Lo, Jacob Finkelman, Walter Pearce, Josh Stone, and Mark Rousskov.

1. Miri is invoked multiple times by cargo miri for complicated reasons ↩

2. In theory it could come up with build scripts reading from the network ↩

21 Sep 2026 12:00am GMT

Firefox DevTools MCP (firefox-devtools-mcp) 0.10.3 is out on npm.

New features:

• New tool: close_firefox_session - ends the browser session: it releases the connection when the server is attached to an existing Firefox, and closes the browser when the server started it.
• New parameter: fullPage for screenshot_page - captures the whole scrollable document instead of the viewport.
• New parameter: downloadFolder for set_download_behavior - only used when setting the "allowed" behavior, it sets the folder where downloads should be stored and defaults to ~/.firefox-devtools-mcp/output/downloads.

Bug fixes:

• No longer fails to find the Firefox binary on Linux with Flatpak.
• restart_firefox now rejects when used against a server started with --connectExisting, whereas it used to restart the WebDriver session without restarting the browser and silently ignored all its configuration parameters.

Other changes:

• Servers started with --connectExisting now disconnect after 30 minutes without any tool call.
• restart_firefox is now part of the mozilla-internal package, and should only be used in controlled environments, as it allows the agent to restart the browser with a custom configuration. Instead, the new tool close_firefox_session can be used whenever clients do not need to update the browser configuration, and will have a more consistent behavior.
• Path checks for the saveTo parameters have been improved to avoid overlapping with existing profile folders

Install:

claude mcp add firefox-devtools npx @mozillamozilla/firefox-devtools-mcp@latest

codex mcp add firefox-devtools - npx @mozilla/firefox-devtools-mcp@latest

For internal Firefox development, swap firefox-devtools-mcp with firefox-devtools-mcp-moz in order to benefit from additional tools, such as chrome-privileged script execution.

Special thanks to all the contributors who filed issues and submitted patches for this release: f3tch (github), shoemoney and mightykatun.

Full changelog: Release v0.10.3 · mozilla/firefox-devtools-mcp · GitHub
Repository and issues: GitHub - mozilla/firefox-devtools-mcp: Model Context Protocol server for Firefox DevTools - enables AI assistants to inspect and control Firefox browser through WebDriver BiDi · GitHub
Public chatroom: https://chat.mozilla.org/#/room/#firefox-devtools-mcp:mozilla.org

1 post - 1 participant

Read full topic

18 Sep 2026 10:14am GMT