编辑“︁Mozilla Firefox”︁（章节）

=== 安全 ===
Firefox使用了[[站点隔离|網站隔離]]技術，透過[[沙盒 (計算機安全)|沙盒]]限制網頁[[腳本語言]]存取[[客户端|用戶端]]資料<ref>{{cite web |title=Bypassing Security Restrictions and Signing Code |url=https://developer.mozilla.org/en/Bypassing_Security_Restrictions_and_Signing_Code |date=2002-11-11 |author2=Netscape Communications |last=Ranganathan |first=Arun |dead-url=yes |archive-url=https://web.archive.org/web/20080917162645/http://developer.mozilla.org/en/Bypassing_Security_Restrictions_and_Signing_Code |archive-date=2008-09-17 |accessdate=2007-01-24 |publisher=Mozilla Developer Network}}</ref>，保護使用者不受惡意腳本語言攻擊。在傳輸網頁資料时則使用[[传输层安全|TLS]]和[[超文本传输安全协议|HTTPS]]加密，以保障使用者和網站之間能隱密地傳輸資料<ref>{{cite web |url=http://www.mozilla.org/projects/security/pki/psm/help_21/ssl_help.html |title=Privacy & Security Preferences&nbsp;— SSL |accessdate=2007-01-24 |date=2001-08-31 |publisher=Mozilla |archive-date=2007-02-07 |archive-url=https://web.archive.org/web/20070207074919/http://www.mozilla.org/projects/security/pki/psm/help_21/ssl_help.html |dead-url=no }}</ref>。此外，Firefox也支援用[[智慧卡]]驗證資料。<ref>[//developer.mozilla.org/en/docs/JavaScript_crypto 开发人员文档 ]关于将 [[PKCS11|PKCS#11]] 模块（主要是智能卡）用于加密目的的 </ref>

Mozilla基金會提供了[[漏洞赏金|漏洞賞金]]來獎勵發現Firefox及旗下產品漏洞的研究者，獎金為3000美元和一件T恤<ref>{{cite web |url=https://www.mozilla.org/security/bug-bounty.html |title=Mozilla Security Bug Bounty Program |accessdate=2007-11-21 |date=2004-09-03 |publisher=Mozilla |deadurl=yes |archiveurl=https://web.archive.org/web/20141026021258/https://www.mozilla.org/security/bug-bounty.html |archivedate=2014-10-26 }}</ref>，Mozilla官方希望可以在[[零日攻击|被利用]]前發現漏洞，進而得到及时修正，避免使用者遭受攻擊。<ref>{{cite web |url=http://www.mozilla.org/projects/security/security-bugs-policy.html |title=Handling Mozilla Security Bugs |accessdate=2007-01-24 |date=2003-02-11 |publisher=Mozilla |archive-date=2007-02-18 |archive-url=https://web.archive.org/web/20070218155814/http://www.mozilla.org/projects/security/security-bugs-policy.html |dead-url=no }}</ref>

比起[[Internet Explorer]]，Firefox有較少尚未修正的漏洞，鼓勵使用者由Internet Explorer轉為使用Firefox時，網絡安全性更佳是常见理由。<ref name="WSJHowTo">{{cite news |url=http://ptech.wsj.com/archive/ptech-20040916.html |archiveurl=https://web.archive.org/web/20070221061526/http://ptech.wsj.com/archive/ptech-20040916.html |archivedate=2007-02-21 |title=How to Protect Yourself From Vandals, Viruses If You Use Windows |last=Mossberg |first=Walter S. |work=The Wall Street Journal |date=2004-09-16 |accessdate=2006-10-17 |dead-url=no }}</ref><ref>{{cite web | url = http://www.securityfocus.com/columnists/249 | title = Time to Dump Internet Explorer | accessdate = 2007-01-24 | last = Granneman | first = Scott | date = 2004-06-17 | publisher = SecurityFocus | archive-date = 2006-10-16 | archive-url = https://web.archive.org/web/20061016205832/http://www.securityfocus.com/columnists/249 | dead-url = no }}</ref><ref>{{cite web| url=http://www.slate.com/id/2103152| title=Are the Browser Wars Back?| accessdate=2007-01-24| last=Boutin| first=Paul| date=2004-06-30| publisher=Slate| archive-date=2007-01-24| archive-url=https://web.archive.org/web/20070124211350/http://www.slate.com/id/2103152/| dead-url=no}}</ref>《[[華盛頓郵報]]》（''Washington Post''）也報導称，在2006年中，Internet Explorer共有284天讓使用者暴露在未修正的漏洞中，而Firefox只有9天。<ref>{{cite web |url=http://blog.washingtonpost.com/securityfix/2007/01/internet_explorer_unsafe_for_2.html |title=Internet Explorer Unsafe for 284 Days in 2006 |accessdate=2007-01-24 |last=Krebs |first=Brian |date=2007-01-04 |publisher=washingtonpost.com |deadurl=yes |archiveurl=https://www.webcitation.org/5mqshLclo?url=http://blog.washingtonpost.com/securityfix/2007/01/internet_explorer_unsafe_for_2.html |archivedate=2010-01-17 }}</ref>

2006年，[[賽門鐵克]]公司的一份報告顯示，到該年9月為止，雖然Firefox的安全漏洞比其他瀏覽器多，但修正漏洞的速度讓其他瀏覽器望塵莫及。<ref>{{cite web |url=http://www.techweb.com/wire/security/193005335 |title=Firefox Sports More Bugs, But IE Takes 9 Times Longer To Patch |accessdate=2007-01-24 |last=Keizer |first=Gregg |date=2006-09-25 |publisher=TechWeb.com |deadurl=yes |archiveurl=https://web.archive.org/web/20080207192416/http://www.techweb.com/wire/security/193005335 |archivedate=2008-02-07 }}</ref>在經過研究後，赛门铁克公司澄清Firefox的安全漏洞比起Internet Explorer還是更少。<ref>{{cite news |url=http://www.infoworld.com/d/security-central/symantec-adjusts-browser-bug-count-096 |title=Symantec adjusts browser bug count |accessdate=2007-01-24 |last=McMillan |first=Robert |date=2006-03-07 |publisher=InfoWorld |archive-date=2009-07-28 |archive-url=https://web.archive.org/web/20090728151158/http://www.infoworld.com/d/security-central/symantec-adjusts-browser-bug-count-096 |dead-url=no }}</ref>

根據軟體安全統計網站Secunia的資料顯示，到2008年3月26日為止，Firefox 2有4處尚未修正的安全漏洞，且多數標示為「低度危險」。<ref>{{cite web |url=http://secunia.com/product/12434 |title=Vulnerability Report: Mozilla Firefox 2.0.x |accessdate=2008-03-26 |publisher=Secunia |archive-date=2008-03-20 |archive-url=https://web.archive.org/web/20080320203046/http://secunia.com/product/12434/ |dead-url=no}}</ref>相對，Internet Explorer 7卻有8處漏洞尚未修正，且多數標示為「中度危險」。<ref>{{cite web |url=http://secunia.com/product/12366 |title=Vulnerability Report: Microsoft Internet Explorer 7.x |accessdate=2008-03-26 |publisher=Secunia |archive-date=2008-03-20 |archive-url=https://web.archive.org/web/20080320121806/http://secunia.com/product/12366/ |dead-url=no}}</ref>甚至有安全專家建議，IE應效仿Firefox的升級模式，如果在現行版本中發現重大安全漏洞，就應即時發布[[修補程式]]。<ref>{{cite news |url=http://tech.qq.com/a/20090211/000246.htm |title=安全專家建議微軟IE升級模式效仿火狐瀏覽器 |publisher=qq.com |date=2009-02-11 |accessdate=2009-05-30 |archive-date=2011-11-18 |archive-url=https://web.archive.org/web/20111118132910/http://tech.qq.com/a/20090211/000246.htm |dead-url=no }}</ref>

从Firefox 2.0起，Mozilla與[[Google]]合作為用戶提供反釣魚保護；當在Firefox上訪問釣魚網站時，使用者可馬上得到警告。Firefox的黑名單來自Google的SafeBrowsing Protocol<ref>{{cite web |url=https://code.google.com/p/google-safe-browsing/wiki/Protocolv2Spec |title=Protocolv2Spec |date=2009-11-24 |publisher=Google |accessdate=2015-03-15 |archive-date=2010-02-11 |archive-url=https://web.archive.org/web/20100211021242/http://code.google.com/p/google-safe-browsing/wiki/Protocolv2Spec |dead-url=no }}</ref>，而从2009年的1月20日起Google正式关闭該協議<ref>{{cite web|url=http://www.pcadvisor.co.uk/news/index.cfm?newsid=109835|title=Google shuts down Firefox 2.0 phishing blacklist|author=Gregg Keizer, Computerworld (US)|date=2009-01-22|work=PC Advisor|accessdate=2009-02-01|archive-date=2019-10-16|archive-url=https://web.archive.org/web/20191016175027/https://www.techadvisor.co.uk/feature/internet/google-shuts-down-firefox-20-phishing-blacklist-109835/|dead-url=no}}</ref>，轉向使用更新的協議，繼續向Firefox 3以上的版本提供保护。

2011年12月，Accuvant安全测试公司在由Google资助的研究報告中指出，Internet Explorer 9安全性已相当接近同期的[[Google Chrome]] 15，反觀同期的Mozilla Firefox 9则居于其后<ref>{{cite web |url=http://www.pcworld.com/article/245856/chrome_is_most_secure_of_the_top_three_browsers_study_finds.html |title=Chrome Is Most Secure of the Top Three Browsers, Study Finds |date=2011-12-09 |author=''PC World'' |accessdate=2015-03-15 |archive-date=2015-04-02 |archive-url=https://web.archive.org/web/20150402164831/http://www.pcworld.com/article/245856/chrome_is_most_secure_of_the_top_three_browsers_study_finds.html |dead-url=no }}</ref>，但随后有NSS Labs安全测试公司指此项研究有失中立，并指出Accuvant公司曾接受Google巨额赞助，研究过程中也刻意忽略Firefox许多安全特性而未作测试，选取测试用恶意插件的方式亦有偏袒Chrome，打压Firefox之嫌疑。<ref>{{cite web |url=https://www.nsslabs.com/reports/browser-wars-just-got-ugly |title=The Browser Wars Just Got Ugly |date=2011-12-14 |author=NSS Labs |deadurl=yes |archiveurl=https://web.archive.org/web/20150402194104/https://www.nsslabs.com/reports/browser-wars-just-got-ugly |archivedate=2015-04-02 |accessdate=2015-03-15 }}</ref>

Firefox 60率先支持了能有效提高浏览安全性的[[傳輸層安全性協定#TLS 1.3|TLS 1.3]] 协议，以及[[DNS over HTTPS]]協定，前者修復了旧版 TLS 中的漏洞，改善了安全性，后者透過加密 [[域名系统|DNS]] 查詢避免中间人獲得瀏覽器查询的域名。<ref>{{Cite web|url=https://blog.nightly.mozilla.org/2018/06/01/improving-dns-privacy-in-firefox/|title=Improving DNS Privacy in Firefox – Firefox Nightly News|accessdate=2018-09-05|work=Firefox Nightly News|language=en-US|archive-date=2018-09-02|archive-url=https://web.archive.org/web/20180902125755/https://blog.nightly.mozilla.org/2018/06/01/improving-dns-privacy-in-firefox/|dead-url=no}}</ref>

2019年10月，Firefox 68 ESR在德国[[联邦信息安全办公室]]的浏览器测试通过所有强制性安全功能的最低要求。<ref>{{Cite web|url=https://www.oschina.net/news/110718/firefox-as-most-secure-browser-bsi|title=Firefox 最安全？唯一通过德国联邦信息安全局考核的浏览器|website=开源中国|date=2019-10-21|accessdate=2019-10-24|archive-date=2019-10-24|archive-url=https://web.archive.org/web/20191024134149/https://www.oschina.net/news/110718/firefox-as-most-secure-browser-bsi|dead-url=no}}</ref>

Mozilla 基金会在2023年3月的安全公告中报告已在野外检测到 CVE-2019-17026（IonMonkey 中的类型混淆漏洞），在當時該漏洞正在被积极利用。<ref>{{Cite journal |last=Seybold |first=Patricia |date=2006-04 |title=Mozilla Firefox |url=http://dx.doi.org/10.1571/cs4-20-06cc |location=Boston, MA |access-date=2023-10-21 |archive-date=2018-08-28 |archive-url=https://web.archive.org/web/20180828203233/http://www.customers.com/articles/mozilla-firefox/ |dead-url=no }}</ref><ref>{{Cite journal |date=2020 |title=RAND Review: January-February 2020 |url=http://dx.doi.org/10.7249/cp22-2020-01 |doi=10.7249/cp22-2020-01 |access-date=2023-10-21 |archive-date=2020-05-02 |archive-url=https://web.archive.org/web/20200502132346/https://www.rand.org/pubs/corporate_pubs/CP22-2020-01.html |dead-url=no }}</ref>