# Firefox Q3 2026: built-in Containers, TLS key-recording warnings, and stricter CA rules

> **Key takeaway:** Firefox 153-157 introduce built-in Containers, block extension file:// access by default, warn users when TLS keys are being recorded, and tighten Mozilla Root Store requirements for certificate authorities.

**Published:** 2026-11-02T23:00:00+00:00 
**Source:** Planet Mozilla 
**Category:** distro-planet 
**Canonical URL:** https://fosswire.org/news/firefox-q3-2026-built-in-containers-tls-key-recording-warnin.html 

## Summary
Mozilla's Firefox Security & Privacy Newsletter for Q3 2026 details several concrete shipping features across Firefox releases 153 through 157. The browser now integrates Containers as a built-in feature rather than requiring an extension, isolating cookies and login sessions per container. Extensions must now obtain explicit user permission to access local files via file:// URLs, with access disabled by default for all installed extensions. Firefox 157 adds visible warnings when TLS encryption keys are being recorded, alerting users to potential traffic interception. On the privacy front, Copy Clean Link strips 130 additional tracking parameters across arbitrary subdomains, and Android's Privacy Dashboard now displays blocked tracker categories. Mozilla also published Root Store Policy v3.1 imposing stricter transparency and audit requirements on public certificate authorities.

Mozilla has accelerated its release cycle since September 2026 and changed its CVE publication practice: internally discovered memory safety bugs now receive separate advisories rather than grouped CVEs, anticipating potential changes to CVE Numbering Rules. The team continues using frontier LLMs for vulnerability detection and remediation. Community efforts include the SURF research summit at TU Delft and participation in the Dagstuhl Seminar on Web Application Security.

## Security and privacy changes in Firefox 153-157
- **Built-in Containers:** Firefox 153 integrates the formerly extension-based Containers feature directly into the browser, with Firefox 155 adding container reordering; each container maintains isolated cookies and login sessions for multi-account usage and tracking limitation.
- **Extension file:// restrictions:** Starting in Firefox 153, all extensions including previously installed ones require explicit user permission to access local files through file:// URLs, with default access set to off.
- **TLS key-recording warnings:** Firefox 157 displays warnings in the site information panel and Settings when encryption keys may be recorded, alerting users to configurations that could allow third-party software to decrypt HTTPS traffic.
- **Root Store Policy v3.1:** Mozilla's updated policy imposes stricter transparency, documentation, and audit requirements on public certificate authorities participating in the WebPKI.

## Why it matters
The shift from extension-based to built-in Containers reduces dependency on Mozilla's extension ecosystem while providing baseline session isolation for all users, a feature increasingly relevant as work-personal browsing boundaries blur. The mandatory extension permission model for local file access aligns Firefox with stricter security postures seen in Chromium-based browsers and reduces the attack surface from compromised or malicious extensions. For Linux distribution maintainers and enterprise administrators, the TLS key-recording warnings provide visible indicators of potential TLS inspection or MITM configurations that may otherwise go undetected in managed environments.