Firefox 136 brings native vertical tabs (finally!) and security fixes

With the recent Firefox 136 update, Mozilla’s web browser got several improvements and new features, including vertical tabs that sit in a new sidebar and provide a better overview when you have tons of open tabs. The update brings improved security via fixed vulnerabilities, which apply to Firefox ESR and Tor Browser as well.

Mozilla’s 2025-14 Security Advisory report shows at least 15 fixed vulnerabilities in Firefox 136, with a “high” risk rating given to five entries for individual vulnerabilities reported by external researchers. For example, the CVE-2025-1930 vulnerability can be used to break out of the browser sandbox on Windows.

In addition, there are three summarized entries on internally discovered vulnerabilities, which also have high risk ratings. Exploitation of these vulnerabilities leads to a “potentially exploitable crash” and the potential for arbitrary code injection and execution. Otherwise, Mozilla doesn’t provide information on the exact number of vulnerabilities covered.

Mozilla plans to release Firefox 137 on April 1, 2025.

What’s new in Firefox 136?

In Firefox 136’s new sidebar, you can store and keep an eye on your bookmarks and history, plus have direct access to an AI chatbot as well as tabs from other synced devices. Browser extensions can also reside in the sidebar, provided the support is added by developers. The sidebar can be located either on the left or right side.

The new vertical tabs feature is also located in the sidebar. If you enable vertical tabs, the tabs move from their usual position at the top of the browser to the sidebar and appear stacked, one below the next. This lets you see more tabs at once, and it’s clearer if you have tons of open tabs.

To enable the new sidebar, go to Settings > General and scroll downn to the “Browser Layout” section. There you should see a checkbox for Show sidebar. Tick it and you’ll get a narrow sidebar on the left side of the browser window. Then, click the cogwheel icon at the bottom of the sidebar to open sidebar customization, where you can then switch on vertical tabs, move the sidebar to the right, and more.

Firefox 136 also uses HTTPS-First by default now, which means Firefox always tries to open web pages using HTTPS first. If that fails, then it will fall back to the unencrypted HTTP.

Controversy over changed Terms of Use

At the end of February, Mozilla updated Firefox’s Terms of Use regarding its handling of collected data. You might’ve encountered irate users or even conspiracy theories on Reddit and other social media. But it’s all been blown out of proportion. It’s not as bad as it sounds.

In a nutshell: basically nothing has changed. Mozilla has merely chosen clearer wording because the legal regulations in various US states made updated phrasings necessary.

Updates for Firefox ESR and Tor Browser

Mozilla has updated its long-term versions Firefox ESR 128 and ESR 115 with security fixes, addressing at least 10 vulnerabilities in Firefox ESR 128.8.0 and at least five in Firefox ESR 115.21.0. The updated Tor Browser 14.0.7, based on Firefox ESR 128.8.0, is now available. An update for Tor Browser 13.5 to version 13.5.13 is also available if you’re running Windows 7 or 8.1 or macOS 10.13 or 10.14.

Mozilla recently announced that support for Firefox ESR 115 will be extended to at least September 2025. Mozilla will then decide whether to further extend support come August. For Tor Browser 13.5.x, which is based on Firefox ESR 115, it’s still unclear whether the Tor Project is willing and able to maintain an additional browser version.

Further reading: Firefox adds AI to browser, surprising no one