1.2.0 - A stronger foundation

Highlights

• Stronger security through site isolation; each website runs in its own sandboxed process.
• Faster tab creation and lower memory usage through app zygote preloading.
• Removed unused and redundant libraries.
• More personalization options for themes.

Known Issues

• After setting a custom selected wallpaper that is “unified”, i.e. is used in both portrait and landscape, then attempt to split the settings to have two differently oriented wallpapers, you’ll see an error message.
• A ‘Secret Debug Info’ menu item is exposed in settings, but it should display nothing as we’ve removed the underlying telemetry libraries

Changes

• Due to architectural changes made upstream, we no longer support the old menu design.
• ‘Secret Settings’ in the browser are now exposed, letting you play around with various expirmental settings within the browser.

Updated to Gecko 148

Updated the underlying browser engine from Gecko 140 to 148, incorporating the latest upstream improvements and security patches.

GeckoView Lite enabled

Trims out built-in components the app doesn’t use, resulting in a smaller install size and less background overhead.

Isolated content processes (site isolation)

Each website now runs in its own separate, sandboxed operating system process. This is the same Fission architecture used by Firefox desktop, and it provides three key benefits:

• Security: A malicious site can no longer use Spectre class attacks to read data from your other tabs where each process only has access to its own site’s data.
• Stability: If a site crashes, only that tab is affected. Your other tabs, the browser UI, and any background work continue running normally.
• Containment: Even if an attacker exploits a bug within a single tab’s renderer, the damage is confined to that one site’s process.

App zygote preloading

The browser engine (libxul.so) is a large library that every content process needs to load. With app zygote preloading, this library is loaded once into a “starter” process, and new tabs fork from it instantly, inheriting the preloaded engine through shared memory rather than loading it from scratch each time.

• Faster tabs: New processes start nearly instantly instead of spending hundreds of milliseconds loading the engine.
• Less memory: Forked processes share read only memory pages, reducing per process memory usage by roughly 33%.
• Better battery life: Less CPU work per new tab means lower power consumption during multi tab browsing.

Requires Android 10 or later.

No-op Glean telemetry

Mozilla’s Glean SDK is a part of the Android Components, and the Waterfox app itself has many references to it. In previous versions, we’d disable the calls to Glean, but with a little bit of effort, we’ve now replaced the library with a “dummy” version, for peace of mind. The codebase still compiles and runs without error, but does absolutely nothing. Thanks to the Tor Project for showing us how to get there.

Adjust SDK removed

The Adjust SDK is a third party advertising attribution tool that Firefox for Android uses to track which ad campaigns drive installs. The SDK was disabled in Waterfox, but this version round we’ve entirely removed it from Waterfox, which should shave some KiB’s off the final app size.

Theme customization expanded

Theme settings have moved to Settings > Customize, with separate light and dark colour options and an automatic mode that matches your device theme.