Mozilla's biggest visual refresh in years is the headline, but the update worth your attention hides underneath: a new TLS key-logging warning, a muscle-memory Tab change, and hardware AV1 offload for video calls.

Firefox 157.0 landed September 29, and every write-up will show you the same screenshots: rounded tabs, pastel-tinted chrome, new built-in themes with light and dark versions, a proper compact mode for small screens and split-screen layouts. Mozilla calls it the biggest visual refresh in years, and nobody is going to argue. But redesigns are marketing. The parts of this release that actually change your day are buried in the "New" and "Changed" lists — and one of them is a security tripwire worth turning on everywhere.

The key-logging alarm you didn't know you needed

Deep in the release notes sits this line: Firefox now shows a warning in the site information panel and in Settings when it has been set up to record its encryption keys, which could let other software on the computer read encrypted web traffic.

In practice, this means the SSLKEYLOGFILE variable — the debugging mechanism that writes TLS session keys to a file so tools like Wireshark can decrypt your traffic. It is a legitimate debugging aid. It is also exactly the kind of thing malware, a "helpful" corporate agent, or a sloppy security product quietly sets on machines it wants to inspect. Until now, nothing on the desktop told you it was happening.

The new warning is passive — a note in the shield-icon panel and Settings, not a screaming modal — which is the right call for a feature most people never encounter. But for anyone managing shared workstations, lab machines, or a fleet: this is now a thing you can ask users to check. "Open the shield icon and tell me if you see the key-logging warning" is a five-second test for whether something on that machine is harvesting TLS sessions. Add it to your incident-response cheat sheet next to env | grep -i ssl and move on.

The muscle-memory change

Pressing Tab in the address bar now jumps straight to the text field instead of stopping on the search-engine button first. Shift+Tab still reaches the button. This is the kind of change that will annoy you for exactly two days and then feel like it was always this way — except for the users who relied on the old stop, so give your team a heads-up if you standardize on Firefox.

Related: the refreshed sidebar is now enabled for everyone, and the "Show sidebar" toggle is gone from Settings. If your workflow depends on the old sidebar (or on vertical tabs being off), the escape hatch is sidebar.revamp set to false in about:config. It also disables vertical tabs. Mozilla says the preference stays available until the end of 2027 — which is far enough away to feel permanent and close enough to put on a calendar. Mark December 2027 as the deadline to test your setup against whatever the sidebar becomes next.

What actually got faster and lighter

WebRTC calls can now use hardware AV1 decoding where the device supports it, instead of always decoding in software. On Linux that goes through VA-API, so it depends on your graphics driver exposing AV1 — check vainfo output on Intel/AMD hardware. When it works, it's the difference between your CPU fans spinning up during a long call and staying quiet. No toggle needed; it kicks in automatically when both ends negotiate AV1.

Smaller but welcome: Amazon is gone from the built-in search engines (you can re-add it as a custom one, but the default list is a notch cleaner), page alert(), confirm() and prompt() dialogs now respect the page's light/dark scheme instead of glaring white, and Firefox Suggest expanded to sixteen more European countries — Austria, Belgium, Czech Republic, Denmark, Finland, Hungary, Ireland, Luxembourg, the Netherlands, Norway, Poland, Portugal, Slovakia, Spain, Sweden, and Switzerland. If you deploy Firefox across an organization in any of those countries, review the Suggest settings before your users discover sponsored results in the address bar.

The upgrade checklist

The update reached release-channel users on September 29; distro repositories, Flathub, and Snap packages follow shortly after. On Ubuntu's Snap build, it'll arrive as an automatic update — if Firefox is running, the desktop notification is your prompt to restart. After updating: glance at the shield panel once (get familiar with the new warning's absence, so you'd notice its presence), try Tab in the address bar, and check whether your machine negotiates AV1 on your next call.

Redesigns age in months. The key-logging warning, the Tab behavior, and the AV1 offload will still matter in 2027 — and one of them has an explicit expiry date. Update, skim the new UI, then do the boring parts: they are the ones that pay.

Sources: Firefox 157.0 Release Notes — Mozilla