Firefox 160 Adds Mini Window, Fixes Windows Intranet Freezes and Patches High-Impact Security Flaws

What's new in Firefox 160​

Mozilla's release notes say version 160.0 was first offered to Release channel users on November 10, 2026. On Windows, Mozilla offers 64-bit, 32-bit and ARM64 builds, with MSI packages for the 64-bit and 32-bit versions. Windows 8.1 and older are no longer supported. Mozilla points users on those systems to Firefox ESR (Extended Support Release).

Here are the main user-facing changes:

• Mini Window – an early version of a feature that keeps a tab or part of a page visible above other apps.
• Picture-in-Picture speed control – playback speeds from 0.25x to 2.0x, right in the floating player.
• Drag from history – you can drag entries from the History sidebar onto the tab strip to open them in new tabs.
• Smarter paste – the address bar's context menu says "Paste and Search" instead of "Paste and Go" when the copied text is a search term rather than a web address.
• "Never allow" for link handlers – you can block sites that keep asking to handle mailto: and other link types, and manage the blocked list in Settings.
• MKV playback – Firefox now plays Matroska files that use FLAC, MP3 or PCM audio.
• Accessibility – pages saved as PDF now expose math content (MathML) to screen readers.
• macOS WebGL on Metal – Mozilla says this can make some sites faster. It doesn't promise a speedup everywhere.

Summary: This is mostly a quality-of-life release, plus one new multitasking feature and a large batch of security fixes.

How Mini Window works​

Mozilla describes Mini Window as a feature that moves a tab or a selected part of a page into an always-on-top window while browsing. It calls this an early version and asks for feedback on Mozilla Connect.

Reports differ a little on where the menu option sits. TechPowerUp says you right-click a tab and choose "Move to Mini Window." OMG! Ubuntu and PiunikaWeb both put it one level deeper. OMG! Ubuntu says you right click a tab, mouse into the Move Tab menu and choose Move to Mini Window. If the option isn't on the main tab menu, look under Move Tab.

What we know from Mozilla and the reviews so far:

1. Whole tab: Right-click the tab, open Move Tab if needed, and choose Move to Mini Window. UbuntuHandbook says the tab will disappear from the main Firefox window after moved to mini window.
2. Part of a page: Right-click on the page and choose Move Section to Mini Window. According to OMG! Ubuntu, Firefox then prompts you to draw out the section you want to pop out.
3. Toolbar button: You can also customise the toolbar and add the Mini Window icon. Clicking it asks whether you want the whole tab or just part of it.
4. Moving and resizing: UbuntuHandbook says you can resize the window and move it by dragging the area between the reload button and the shield icon. PiunikaWeb reports that the scaling of the content within the Mini Window also dynamically adapts to the size.
5. Putting it back: PiunikaWeb also notes you can easily expand the Mini Window back into your tab strip with a simple button.

OMG! Ubuntu quotes Mozilla calling the feature "useful when you're multitasking and need to keep a few sources of information in view at once". In practice, it's Picture-in-Picture for things that aren't video: a build dashboard, a live sports score, a stock ticker, a chat thread, or the one table in a long document you keep scrolling back to.

Two cautions. First, Mozilla calls this an early version, so don't expect every page element to work perfectly. Second, if you can't find the menu items, there may be a reason. Mozilla's progressive-rollout note in these release notes is attached to the French Smart Window feature, not Mini Window. Even so, early features sometimes show up unevenly, so check the Move Tab submenu and the toolbar customisation panel before you assume something's broken.

Why does this matter on Windows? Windows has never had a built-in way to keep any window on top. People who want that usually install a third-party tool such as Microsoft's PowerToys. For anything that lives in a browser tab, Firefox now does it without an extra utility.

Summary: Mini Window turns any tab, or a box you draw on a page, into a floating panel that stays on top. It's useful, but still early.

Picture-in-Picture speed controls, with one catch​

Mozilla says the PiP player now has playback speeds from 0.25x to 2.0x. However, the setting appears only when the player window is medium-sized or larger. If you keep PiP shrunk to a tiny corner window, you won't see the control. Make the window bigger and it should appear. Before this, changing speed meant going back to the original tab, which defeats the point of a floating player.

The Windows admin angle: NTLM and Kerberos fixed​

Most coverage glosses over one fix that matters a lot in corporate environments. Firefox 160 fixes the browser freezing for several seconds when you sign in to intranet sites that use NTLM or Kerberos (Negotiate) authentication. Neowin's changelog confirms the same freezing for several seconds when signing in to intranet websites using NTLM or Kerberos authentication. In a Windows domain, where internal portals, SharePoint-style sites and line-of-business apps often use integrated authentication, those pauses were the kind of thing that generates help desk tickets.

Mozilla's notes for enterprise admins add more:

• Firefox ESR 153.7.0 shipped the same day with no policy changes. ESR 153 is the current ESR branch.
• Cookie policy behaviour: Cookies for hosts in the Cookies policy's Block list are now cleared every time the policy is applied, not only when the list changes.
• Firefox Enterprise only: Studies, Nimbus rollouts, Normandy, Firefox Labs, recommendations and onboarding prompts are now turned off and locked. Telemetry upload is locked on, because Firefox Enterprise sends security events through it. DisableTelemetry is still unsupported in that edition.
• Fix: The SitePolicies Match and Exceptions rules now apply to hostnames with a trailing dot (for example, example.com.).
• macOS: There's a new DisableMacOSUserPolicies policy. Mixed-fleet admins should note it, but it doesn't affect Windows Group Policy.

There's also a smaller fix for anyone who types quickly: the first character typed into the address bar or search bar no longer gets lost when you start typing right after clicking into it.

Summary: If you manage Firefox on domain-joined Windows PCs, the Negotiate-auth fix alone is reason to move to 160.

Security: patch first, explore features later​

Mozilla Foundation Security Advisory 2026-125 lists Firefox 160 as the fixed version and rates the overall impact as high. By our count, the advisory lists 99 CVEs: 57 rated high, 24 moderate and 18 low. The high-rated issues include use-after-free bugs, incorrect boundary conditions, sandbox escapes, privilege escalation and same-origin policy bypasses. They span graphics (Canvas2D, WebGL, WebRender), the HTML parser, DOM navigation, service workers, JavaScript garbage collection, layout, CSS and networking.

A large share of the entries credit "OpenAI Codex Security (kylebot)" as the reporter. That's a sign of how much automated, AI-assisted bug hunting now feeds browser security work. Mozilla's advisory doesn't say any of these flaws are being actively exploited, and we're not suggesting they are. But a browser is the most exposed software on most PCs, and several of these bugs are sandbox escapes rated high. That's enough reason to update now.

How to make sure you're on Firefox 160 (Windows)​

1. Open the Firefox menu (the three lines), then go to Help → About Firefox.
2. Firefox checks for updates and downloads them. Click Restart to update Firefox when it appears.
3. After the restart, the About window should show 160.0.
4. Managed fleets: deploy the 64-bit or 32-bit MSI package, or let your existing update policy handle it. ESR users get their security fixes through ESR 153.7.0.

Developer notes​

For web developers, the biggest item is the Web Speech API's SpeechRecognition interface. It provides on-device, real-time speech-to-text in 40 languages, according to Mozilla. MDN says it's desktop-only and doesn't include cloud-based recognition. Firefox also now treats the legacy ::-webkit-input-placeholder pseudo-element as an alias for ::placeholder.

Some changes could break existing code:

• WebTransport: exportKeyingMaterial() now requires a context argument and adds outputLength. Code that leaves either out needs updating.
• MozScrolledAreaChanged: This non-standard event is no longer sent to web pages. A preference can restore the old behaviour.
• Extensions: runtime.PlatformInfo now reports ARM64 as arm64 instead of aarch64. Extensions that check the architecture on Snapdragon-based Windows on Arm PCs should take note.

The verdict​

Firefox 160 isn't a big rethink, and it doesn't need to be. Mini Window is a sensible idea taken from Picture-in-Picture. If it gets polished, it could become one of those features people can't imagine browsing without. Not everyone will want it, though. A commenter on TechPowerUp said they'd simply be disabling it, which is a fair reminder that a lot of users just want their browser to stay out of the way.

For Windows users, the reasons to update are simple. There are 57 high-rated security fixes, and the NTLM/Kerberos freeze is gone, which helps anyone who signs in to internal sites at work. Update first and try the new features afterwards.