Firefox 155 Adds Sortable Tab Groups and Fixes 30 Security Flaws

What shipped on September 1

Mozilla released Firefox 155 on September 1, 2026, and while none of its individual pieces are headline-grabbing on their own, together they cover four different audiences: everyday users get tidier tabs, gamers get controller support, developers get a handful of genuinely useful web platform additions, and everyone gets a batch of security fixes.

Tab groups you can finally put in order

Firefox introduced tab groups - the ability to bundle related tabs together - in an earlier release, and 155 makes them sortable: users can drag tabs within a group to reorder them, and drag entire groups along the tab strip to change their position. Mozilla's "Organize Tabs" feature also now suggests groupings for related tabs and gives them more descriptive names automatically, rather than leaving that entirely to the user.

Connections get faster, quietly

Two networking changes should make pages load faster without users noticing anything except the speed:

• Happy Eyeballs v3: when a site is reachable over both IPv6 and IPv4, Firefox now races connection attempts over both simultaneously instead of trying one, waiting, then falling back to the other. That removes the delay that used to happen whenever a site's IPv6 address turned out to be unreachable.
• QUIC version 2 negotiation: Firefox can now negotiate QUIC v2 for HTTP/3 connections, letting it pick the better transport protocol version without an extra round trip to the server.

Security and everyday fixes

Firefox 155 patches more than 30 security vulnerabilities in this release. Separately, it fixes a long-standing annoyance on Linux where a system would fail to go to sleep after an extended browsing session. Users can also now see a running count of blocked trackers directly in the address bar, with an option to turn that counter off in settings.

On the input side, Firefox 155 adds full support for Nintendo Switch Pro controllers and compatible gamepads in web-based games on Windows - a small but concrete win for anyone building or playing browser games. Built-in page translation also gained two new languages, Marathi and Urdu.

Mozilla's Smart Window feature, which uses artificial intelligence (AI) to help users navigate pages, was previously limited to a smaller test group and is now available to all users in the US, Canada and France, with personalized prompts to help people pick up conversations they'd started earlier. Mozilla also says citations from Exa-powered web search inside Smart Window now return roughly five times faster.

What developers get

The release notes on MDN (Mozilla Developer Network) list a long tail of web platform changes. The ones most likely to matter in practice:

• CSS attr() everywhere: the attr() function, previously usable only inside the content property, now works in any CSS property, letting authors pull attribute values into properties like width or color directly from markup.
• New CSS functions: progress() calculates how far a value sits between two bounds, and alpha() adjusts a color's transparency without having to rewrite the whole color value.
• font-width property: a new, more explicit name for what font-stretch used to control.
• Promise.allKeyed() and Promise.allSettledKeyed(): two new JavaScript static methods that resolve multiple named promises into a single keyed object, useful when the order of results matters less than knowing which result came from which named promise.
• Module import retries: a failed import() of a JavaScript module is no longer permanently cached as a failure, so a transient network error no longer requires a full page reload to recover from.
• WebTransport additions: send groups for prioritizing bandwidth between streams, an exportKeyingMaterial() method for deriving shared secrets, and a draining property that signals a connection is shutting down gracefully.
• WebAssembly: support for the wide-arithmetic proposal, adding 128-bit integer operations like i64.add128, useful for cryptography and big-number code compiled to WebAssembly.

In DevTools, the Debugger gets a keyboard shortcut (Ctrl+Alt+B, or Cmd+Alt+B on macOS) to toggle all breakpoints at once, and the JSON Viewer now understands JSON Lines (also called NDJSON) files, parsing each line separately instead of choking on the whole file.

What this means in practice

None of this requires action from most site operators - the CSS and JavaScript additions are backward compatible, and the networking changes are automatic. Developers who maintain browser-based games should note the Switch Pro controller support and test their gamepad input handling. Anyone using font-stretch in a stylesheet can start migrating to font-width at their own pace, since the older property isn't going away yet. As with any release patching over 30 vulnerabilities, updating promptly is the main action worth taking from this one.