Firefox 148: AI Opt-Out + A Real Fix for XSS

Firefox 148 is out and there are a few things worth noticing. First, there’s a central AI controls panel letting you shut off all AI features in one click or pick and choose what stays on. It covers built-in translation, link previews, tab suggestions, and the sidebar assistant, so no surprise AI pop-ups if you don’t want them.

Safer HTML Insertion

For devs, the new setHTML method replaces risky innerHTML in certain contexts. Basically, it sanitizes content before it hits the page. So, something like this works:

const container = document.getElementById('content');
const unsafe = '<img src=x onerror=alert(1)>Safe text';
container.setHTML(unsafe);

// Keeps your page safe from XSS attacks without extra boilerplate.

Other Updates

There are a few other tweaks. Trusted Types support is here, CSS shape() works more reliably, and WebGPU can now run in service workers. On the user side, Android gets toolbar tweaks, PDFs are easier to read with screen readers, and more languages hit translation.

Security patches are included too, covering memory safety and sandbox issues. Nothing too fancy, just the kind of background fixes that keep the browser from going sideways.