Except where noted, everything here applies to both Firefox 136 and the Firefox 128.8 ESR.

Bug Fixes

• In some cases, Microsoft Entra SSO failed due to missing headers. This was fixed in bug 1945596.

Other Changes

• HTTPS-First is now on by default. You can manage this behavior using the HttpsOnlyMode and HttpAllowlist policies.
• The new preference network.http.basic_http_auth.enabled allows you to completely disable Basic HTTP authentication.

Policies

• The ExtensionSettings policy has been updated to allow extensions to be enabled in private windows.

Special Notes

Firefox ESR 115

Support for the Firefox 115 ESR has been extended to September 16 to accomodate legacy Windows users.