fixup! Firefox preference overrides.

// Preferences to harden Firefox's security and privacy

// Do not edit this file.

// Use the OS locale by default (tor-browser#17400)

// tor-browser#17400: use the OS locale by default.

pref("intl.locale.requested", "");

// Home page is blank rather than Firefox Home (Activity Stream).

// Disable Firefox Welcome Dialog

pref("browser.aboutwelcome.enabled", false);

#if MOZ_UPDATE_CHANNEL == release

// tor-browser#42640: Disable Firefox Flame button due to unknown interactions with New Identity

pref("browser.privatebrowsing.resetPBM.enabled", false, locked);

#endif

#ifndef ANDROID

// Bug 41668: allow users to apply updates. This is set also in firefox.js for

// all platforms, except for Windows. As explained on firefox.js, Firefox uses a

pref("browser.startup.homepage_override.buildID", "20100101");

// Disable the "Refresh" prompt that is displayed for stale profiles.

// TODO: Re-evaluate (tor-browser#45341): this was needed because the new

// profile it created did not contain NoScript. Now profiles work, so the main

// technical reason for this preference does not hold anymore.

pref("browser.disableResetPrompt", true);

// Disk activity: Disable Browsing History Storage

pref("browser.cache.disk.enable", false);

pref("permissions.memory_only", true);

pref("security.nocertdb", true);

// tor-browser#42094: do not collect stats about WebRTC.

// Defense-in-depth: this is already false in upstream release builds.

pref("media.aboutwebrtc.hist.enabled", false);

// tor-browser#45214: Disable the megalist (contextual password manager).

// tor-browser#45214: disable the megalist (contextual password manager).

pref("browser.contextual-password-manager.enabled", false);

// Disk Activity

// Disable auto-downloading to ~/Downloads and other download tweaks to minimize

// disk leaks (tor-browser#42050).

// tor-browser#42050: disable auto-downloading to ~/Downloads and other download

// tweaks to minimize disk leaks.

pref("browser.download.useDownloadDir", false);

pref("browser.download.always_ask_before_handling_new_types", true);

pref("browser.download.manager.addToRecentDocs", false);

// pref("privacy.exposeContentTitleInWindow", false);

// pref("privacy.exposeContentTitleInWindow.pbm", false);

// tor-browser#42054: Opt-out from any built-in backup system, even though

// tor-browser#42630: Disable LaterRun.

//

// This preference is set in a few places in code, so we lock it to keep this

// feature off.

// Even though it's locked, setting it will still change the value in

// `prefs.js`, but it will be ignored.

// If this is ever unlocked, the value in prefs.js will be used.

pref("browser.laterrun.enabled", false, locked);

// tor-browser#42054: opt-out from any built-in backup system, even though

// local, as it might be a violation of our standalone mode.

// Users can still opt-in if they wish.

pref("browser.backup.enabled", false);

pref("browser.backup.scheduled.enabled", false);

// tor-browser#45123: Disable the profile automated backup and restore service.

// tor-browser#45123: disable the profile automated backup and restore service.

pref("browser.backup.archive.enabled", false);

pref("browser.backup.restore.enabled", false);

// Empty clipboard content from private windows on exit (tor-browser#42154)

// tor-browser#45073 (153.0 preference review): do not send media metadata to

// the OS when in PBM (defense-in-depth).

pref("media.privatebrowsing.metadata.enabled", false);

// tor-browser#42154: empty clipboard content from private windows on exit

pref("browser.privatebrowsing.preserveClipboard", false);

// tor-browser#42611: Do not include the URL of the image, when copying it.

// tor-browser#43197, defense in depth if ever https-only got disabled

pref("dom.security.https_first_add_exception_on_failure", false);

// tor-browser#44123: never trim the protocol off of URLs.

pref("browser.urlbar.trimURLs", false);

// tor-browser#22320: Hide referer when coming from a .onion address

// We enable this here (rather than in Tor Browser) in case users of other

// base-browser derived browsers configure it to use a system Tor daemon

// [4] https://www.ssllabs.com/ssl-pulse/

pref("security.ssl.require_safe_negotiation", true);

// lock those disabled by https://bugzilla.mozilla.org/show_bug.cgi?id=1036765

pref("security.ssl3.dhe_rsa_aes_128_sha", false, locked);

pref("security.ssl3.dhe_rsa_aes_256_sha", false, locked);

// Wrapping a static pref to lock it and prevent changing.

// See tor-browser#40565.

// tor-browser#40565: lock as the UI offered to enable TLS 1.0 and 1.1 without

// explaining the actual reasons.

pref("security.tls.version.enable-deprecated", false, locked);

// tor-browser#44187: Disable session identifiers to make PBM and normal mode

// Misc privacy: Remote

pref("browser.send_pings", false);

// Space separated list of URLs that are allowed to send objects (instead of

// only strings) through webchannels. The default for Firefox is some Mozilla

// domains.

pref("webchannel.allowObject.urlWhitelist", "");

// Geolocation preferences.

pref("geo.enabled", false);

pref("geo.provider.network.url", "");

pref("geo.provider.ms-windows-location", false);

pref("geo.provider.use_corelocation", false);

pref("geo.provider.use_gpsd", false);

pref("geo.provider.use_geoclue", false);

pref("browser.safebrowsing.malware.enabled", false);

pref("browser.safebrowsing.provider.google.gethashURL", "");

pref("browser.safebrowsing.provider.google4.updateURL", "");

pref("browser.safebrowsing.provider.google4.gethashURL", "");

pref("browser.safebrowsing.provider.google5.enabled", false);

pref("browser.safebrowsing.provider.google5.updateURL", "");

pref("browser.safebrowsing.provider.google5.gethashURL", "");

pref("browser.safebrowsing.provider.mozilla.updateURL", "");

pref("browser.safebrowsing.provider.mozilla.gethashURL", "");

pref("toolkit.telemetry.firstShutdownPing.enabled", false); // Added in tor-browser#41496

pref("toolkit.telemetry.updatePing.enabled", false); // Make sure updater telemetry is disabled; see #25909.

pref("toolkit.telemetry.bhrPing.enabled", false);

pref("toolkit.telemetry.coverage.opt-out", true);

pref("datareporting.healthreport.uploadEnabled", false);

pref("datareporting.policy.dataSubmissionEnabled", false);

// Force all telemtry identifier to their canary values tor-browser#43750

// tor-browser#43750: force all telemtry identifier to their canary values.

// Locked to prevent the browser from changing them.

pref("toolkit.telemetry.cachedClientID", "c0ffeec0-ffee-c0ff-eec0-ffeec0ffeec0", locked);

pref("toolkit.telemetry.cachedProfileGroupID", "decafdec-afde-cafd-ecaf-decafdecafde", locked);

pref("datareporting.dau.cachedUsageProfileID", "beefbeef-beef-beef-beef-beeefbeefbee", locked);

pref("datareporting.dau.cachedUsageProfileGroupID", "b0bacafe-b0ba-cafe-b0ba-cafeb0bacafe", locked);

pref("datareporting.usage.uploadEnabled", false);

pref("toolkit.coverage.opt-out", true);

pref("toolkit.coverage.endpoint.base", "");

pref("browser.tabs.crashReporting.sendReport", false);

pref("browser.crashReports.unsubmittedCheck.autoSubmit2", false);

// Added in tor-browser#41496 even though false by default

// tor-browser#41496: do not offer to send unsubmitted crash reports.

// (Defense in detph: we do not have the crash reporter and this is false on the

// release channel also in Firefox).

pref("browser.crashReports.unsubmittedCheck.enabled", false);

// tor-browser#45073 (153.0 preference review): add also this pref not to send

// unsubmitted crash reports.

pref("browser.crashReports.onDemand", false);

// tor-browser#44026: Disable the modal that shows upstream terms of usage,

// since we opt out of their telemetry and data collection.

pref("browser.preonboarding.enabled", false);

// Disable checkbox in about:neterror that controls

// security.xfocsp.errorReporting.automatic. See tor-browser#42653.

pref("security.xfocsp.errorReporting.enabled", false);

// tor-browser#45080: disable the reporting API.

pref("dom.reporting.enabled", false);

pref("dom.reporting.header.enabled", false);

pref("services.sync.engine.tabs", false);

pref("extensions.getAddons.cache.enabled", false); // https://blog.mozilla.org/addons/how-to-opt-out-of-add-on-metadata-updates/

pref("privacy.donottrackheader.enabled", false); // (mullvad-browser#17)

// Make sure there is no Tracking Protection active in Tor Browser, see: #17898.

// tor-browser#17898: disable Tracking Protection in Tor Browser because of

// doubts about the blocklist-based approach and the breakage.

pref("privacy.trackingprotection.enabled", false);

pref("privacy.trackingprotection.pbmode.enabled", false);

pref("privacy.trackingprotection.emailtracking.enabled", false);

pref("privacy.trackingprotection.emailtracking.pbmode.enabled", false);

pref("privacy.trackingprotection.annotate_channels", false);

pref("privacy.trackingprotection.cryptomining.enabled", false);

// This is mostly for consistency, since we disable the safe browsing lists,

// which are needed for this feature to work properly.

pref("privacy.trackingprotection.harmfuladdon.enabled", false);

// Hide the Unified Trust Panel until we have new designs. tor-browser#44814.

// tor-browser#44814: hide the Unified Trust Panel until we have new designs.

pref("browser.urlbar.trustPanel.featureGate", false);

// tor-browser#43986: Explicitly disable bounce tracking protection

// tor-browser#43986: explicitly disable bounce tracking protection

pref("privacy.bounceTrackingProtection.mode", 0);

pref("privacy.socialtracking.block_cookies.enabled", false);

pref("privacy.annotate_channels.strict_list.enabled", false);

// Notice that it should not apply to RFP anyway...

pref("privacy.fingerprintingProtection.remoteOverrides.enabled", false);

// Disable Privacy-Preserving-Attribution (Bug #42687)

pref("dom.private-attribution.submission.enabled", false);

// Custom extensions preferences tor-browser#41581

pref("extensions.hideNoScript", true);

pref("extensions.hideUnifiedWhenEmpty", true);

// Disable activity stream in about:home (Bug #41029)

// tor-browser#41029: disable activity stream in about:home

pref("browser.newtabpage.activity-stream.discoverystream.enabled", false);

pref("browser.newtabpage.activity-stream.feeds.section.topstories", false);

pref("browser.newtabpage.activity-stream.showSponsored", false);

// tor-browser#42054: make sure search result telemetry is disabled.

pref("browser.search.serpEventTelemetryCategorization.enabled", false);

// ML components that we want to hide from the user. See tor-browser#44045.

// Many of these preferences are locked because the component is entirely

// removed, so they could not be functionally enabled.

// The component is entirely removed, so many functionalities will not work even

// if flipped.

// tor-browser#42872, #42555, #44045: Disable ML translations.

// Maybe re-enable after auditing and fixing the UX (tor-browser#41837).

// NOTE: whilst the "translations" component is still included in the build, we

// lock the preference because the engine is excluded and the

// "translations-models" RemoteSettings needed for the engine is empty.

pref("browser.translations.enable", false, locked);

pref("browser.translations.enable", false);

// Hide some AI settings outside the "ai" setting pane. See tor-browser#44764.

// NOTE: This preference tracks whether the *user* opted out of all AI features

// in about:preferences. By itself, it does not provide global blocking of the

// AI features, which are often controlled by separate preferences below.

// However, some parts of the UI will react to this preference. See

// tor-browser#44541.

pref("browser.ai.control.default", "blocked", locked);

pref("browser.ai.control.default", "blocked");

// Disables many (but not all) ML engines. Note, this does not have overall

// control over exposure to ML features. tor-browser#44045.

pref("browser.ml.enable", false, locked);

pref("browser.ml.enable", false);

// Disable third party AI chatbot. tor-browser#43989.

pref("browser.ml.chat.enabled", false, locked);

pref("browser.ml.chat.enabled", false);

// Disable LinkPreview. tor-browser#44045 and tor-browser#43867.

pref("browser.ml.linkPreview.enabled", false, locked);

// Disable Smart Tab Groups. tor-browser#44045.

pref("browser.tabs.groups.smart.enabled", false, locked);

pref("browser.tabs.groups.smart.userEnabled", false, locked);

pref("browser.ml.linkPreview.enabled", false);

// tor-browser#44045: disable Smart Tab Groups.

pref("browser.tabs.groups.smart.enabled", false);

pref("browser.tabs.groups.smart.userEnabled", false);

// Don't expose ModelHub API for extensions. tor-browser#44045.

pref("extensions.ml.enabled", false, locked);

pref("extensions.ml.enabled", false);

// Don't enable ML generated alt text. tor-browser#44045.

// pdfjs.enableAltText controls whether MLManager is created,

// pdfjs.enableGuessAltText controls whether the MLManager can create an ML

// changed by the user in the UI, but also has the side effect of hiding the

// UI controls for the non-ML preference pdfjs.enableNewAltTextWhenAddingImage.

// See bugzilla bug 1943456 comment 12.

pref("pdfjs.enableAltText", false, locked);

pref("pdfjs.enableAltTextForEnglish", false, locked);

pref("pdfjs.enableGuessAltText", false, locked);

pref("pdfjs.enableAltTextModelDownload", false, locked);

pref("pdfjs.enableAltText", false);

pref("pdfjs.enableAltTextForEnglish", false);

pref("pdfjs.enableGuessAltText", false);

pref("pdfjs.enableAltTextModelDownload", false);

// Disable SuggestBackendMl. tor-browser#44045.

pref("browser.urlbar.quicksuggest.mlEnabled", false, locked);

pref("browser.urlbar.quicksuggest.mlEnabled", false);

// Disable SemanticHistory search. tor-browser#44045.

pref("places.semanticHistory.featureGate", false, locked);

// tor-browser#45120: Disable AIWindow.

// tor-browser#45338: Locked as a precaution against entry points that try to

// flip this value.

pref("places.semanticHistory.featureGate", false);

// tor-browser#45120: disable AIWindow.

// tor-browser#45338: locked as a precaution against entry points that try to

// flip this value. Also, policies also lock it.

pref("browser.smartwindow.enabled", false, locked);

// tor-browser#45073 (153 preference review): lock to pretend we have disabled

// AI through policies (see AIWindow.isManagedByPolicy).

pref("browser.ai.control.smartWindow", "blocked", locked);

// tor-browser#41945 - disable automatic cookie banners dismissal until

// we're sure it does not causes fingerprinting risks or other issues.

pref("cookiebanners.service.mode", 0);

pref("cookiebanners.service.mode.privateBrowsing", 0);

pref("cookiebanners.ui.desktop.enabled", false);

// Disable moreFromMozilla pane in the preferences/settings (tor-browser#41292).

pref("browser.preferences.moreFromMozilla", false);

// Avoid DNS lookups on search terms

pref("browser.urlbar.dnsResolveSingleWordsAfterSearch", 0);

// Disable about:newtab and "first run" experiments

pref("messaging-system.rsexperimentloader.enabled", false);

// true means that you are *not* opting out. See its usage in various file.

pref("app.shield.optoutstudies.enabled", false);

// Disable nimbus rollouts.

// See bugzilla bug 2003350. See tor-browser#44520.

// tor-browser#44520: disable nimbus rollouts (see bugzilla bug 2003350).

pref("nimbus.rollouts.enabled", false);

// Disable Normandy/Shield

pref("app.normandy.enabled", false);

#if MOZ_UPDATE_CHANNEL == release

pref("privacy.resistFingerprinting", true, locked);

pref("privacy.resistFingerprinting.exemptedDomains", "", locked);

// tor-browser#42125: Some misleading guides suggest to set this to false, but

// the result would be that the canvas is completely white

// (see StaticPrefList.yaml), so lock it to true.

// Might be removed (MozBug 1670447).

pref("privacy.resistFingerprinting.randomDataOnCanvasExtract", true, locked);

#else

pref("privacy.resistFingerprinting", true);

pref("privacy.resistFingerprinting.exemptedDomains", "");

// tor-browser#44763: disable WebGPU until audited.

pref("dom.webgpu.enabled", false);

pref("browser.link.open_newwindow.restriction", 0); // Bug 9881: Open popups in new tabs (to avoid fullscreen popups)

// tor-browser#42767: Disable offscreen canvas until verified it is not fingerprintable

pref("gfx.offscreencanvas.enabled", false);

// Prevent scripts from moving and resizing open windows

pref("dom.disable_window_move_resize", true);

// Set video VP9 to 0 for everyone (bug 22548)

pref("network.http.referer.defaultPolicy", 2); // Bug 32948: Make referer behavior consistent regardless of private browing mode status

pref("network.http.referer.defaultPolicy.pbmode", 2);

pref("network.http.referer.XOriginTrimmingPolicy", 2); // Bug 17228: Force trim referer to scheme+host+port in cross-origin requests

// Bug 40463: Disable Windows SSO

pref("network.http.windows-sso.enabled", false, locked);

// Bug 43165: Disable Microsoft SSO on macOS

// tor-browser#40463 (91 preference review): disable Windows SSO

pref("network.http.windows-sso.enabled", false);

pref("network.http.microsoft-entra-sso.enabled", false);

pref("network.microsoft-sso-authority-list", "");

// tor-browser#40424

// Xwayland as the default.

pref("widget.wayland.fractional-scale.enabled", false);

// tor-browser#45171: Disabled split view which is janky.

pref("browser.tabs.splitView.enabled", false);

// tor-browser#41943: defense-in-depth, but do not lock anymore (enabled in Firefox 119, http://bugzil.la/1851162)

pref("javascript.options.spectre.disable_for_isolated_content", false);

// Only accept cookies from the originating site (block third party cookies)

pref("network.cookie.cookieBehavior", 1);

pref("network.cookie.cookieBehavior.pbmode", 1);

pref("network.predictor.enabled", false); // Temporarily disabled. See https://bugs.torproject.org/16633

pref("network.predictor.enable-prefetch", false);

pref("network.http.speculative-parallel-limit", 0);

pref("browser.places.speculativeConnect.enabled", false);

pref("network.prefetch-next", false);

pref("browser.urlbar.speculativeConnect.enabled", false);

// Bug 40220: Make sure tracker cookie purging is disabled.

// tor-browser#40220: make sure tracker cookie purging is disabled.

// It depends on Firefox's tracking protection, which we currently do not enable

// See also tor-browser#30939.

pref("privacy.purge_trackers.enabled", false);

pref("dom.prefetch_dns_for_anchor_http_document", false);

pref("dom.prefetch_dns_for_anchor_https_document", false);

// Notice: some of these values are already false on Firefox, but we still

// define them as defense-in-depth.

pref("network.protocol-handler.external-default", false);

pref("network.protocol-handler.external.mailto", false);

pref("network.protocol-handler.external.news", false);

  pref("network.protocol-handler.external.ms-windows-store", false);

  pref("network.protocol-handler.warn-external.ms-windows-store", true);

#endif

pref("network.proxy.allow_bypass", false, locked); // #40682

// Bug 40548: Disable proxy-bypass

// tor-browser#40682: some API (e.g., telemetry) might try to bypass the proxy

// if this is true. At the moment, the browser will not try to set this

// anywhere, but it makes sense to lock it as a defense-in-depth in case of

// future changes.

pref("network.proxy.allow_bypass", false, locked);

// tor-browser#40548: disable another proxy-bypass for system requests.

// This is also disabled at build time (tor-browser#45336).

pref("network.proxy.failover_direct", false, locked);

// Lock to 'true', which is already the firefox default, to prevent users

// from making themselves fingerprintable by disabling. This pref

// alters content load order in a page. See tor-browser#24686

pref("network.http.tailing.enabled", true, locked);

// Block 0.0.0.0

// tor-browser#43811: block 0.0.0.0

// https://bugzilla.mozilla.org/show_bug.cgi?id=1889130

// tor-browser#43811

pref("network.socket.ip_addr_any.disabled", true);

// tor-browser#23044: Make sure we don't have any GIO supported protocols

// (defense in depth measure).

// As of Firefox 118 (Bug 1843763), upstream does not add any protocol by

// default, but setting it to blank seems a good idea (tor-browser#42054).

pref("network.gio.supported-protocols", "");

pref("media.peerconnection.enabled", false); // Disable WebRTC interfaces

// Disable WebRTC interfaces

pref("media.peerconnection.enabled", false);

// Mullvad Browser enables WebRTC by default, meaning that there the following prefs

// are first-line defense, rather than "in depth" (mullvad-browser#40)

// tor-browser#41667 - Defense in depth: use mDNS to avoid local IP leaks on Android too if user enables WebRTC

pref("svg.disabled", false);

pref("mathml.disabled", false);

// Bug 40408

// tor-browser#40408

pref("svg.context-properties.content.allowed-domains", "");

// Network and performance

// Don't automatically enable enterprise roots, see bug 40166

pref("security.certerrors.mitm.auto_enable_enterprise_roots", false);

// Disable share menus on Mac and Windows tor-browser#41117

// tor-browser#41117: disable share menus on Mac and Windows.

// Locked as user might not realize sharing might result in proxy bypasses or

// general linkability.

pref("browser.menu.share_url.allow", false, locked);

// tor-browser#45133: Disable share button

// tor-browser#43051: Hide the checkbox to open the browser automatically on

// Windows startup.

pref("browser.startup.windowsLaunchOnLogin.enabled", false);

// tor-browser#45293: force devices to be detected as not capable of tablet mode

// on Windows 11+ (defense-in-depth for fingerprinting).

pref("widget.windows.tablet_detection_override", -1);

#endif

#ifdef ANDROID

// The rest are not customized, because they are covered only by one font

#endif

#endif

// tor-browser#42630: Disable LaterRun.

//

// This preference is set in a few places in code. Even though it's locked,

// setting it will still change the value in `prefs.js`, but it will be ignored.

// If this is ever unlocked, the value in prefs.js will be used.

pref("browser.laterrun.enabled", false, locked);

// tor-browser#44123: Never trim the protocol off of URLs.

pref("browser.urlbar.trimURLs", false);

// tor-browser#45171: Disabled split view which is janky.

pref("browser.tabs.splitView.enabled", false);