Mozilla Extends Firefox 115 ESR on Windows 7 8 8.1: Tradeoffs and Migration

Mozilla's latest posture on legacy Windows is a study in trade-offs: the organization will continue shipping security patches for Firefox 115 ESR to machines still running Windows 7, Windows 8, and Windows 8.1 — but it admits doing so is increasingly expensive, fragile, and ultimately risky for users who remain on unsupported platform kernels.

Background / Overview​

For more than three years platform lifecycles have pushed a steady migration away from Windows 7 and its successors. Microsoft ended mainstream and extended support for Windows 7 on January 14, 2020, and Windows 8.1 lost official security updates on January 10, 2023. Most major browser vendors moved quickly after those deadlines: Chrome and Edge ceased delivering new builds to these older Windows releases, leaving a hole for users who could not or would not upgrade their operating systems.
Mozilla took a different approach. After shipping Firefox 115 in July 2023 as the last full-feature release compatible with Windows 7/8/8.1, Mozilla kept those users on an Extended Support Release — Firefox 115 ESR — and backported critical security fixes to that branch to keep legacy installs safer than they otherwise would have been. That decision bought time for users and organizations that cannot immediately migrate, but it has never been indefinite.
In recent months the ESR maintenance window has been re-evaluated several times. Mozilla now says it will continue providing security updates for Firefox 115 ESR on older Windows builds through the extended maintenance period announced on its support pages — a runway that the project describes as temporary and costly to sustain. At the same time, Mozilla has been clear: unsupported operating systems lack OS-level security updates, and running any browser — even a patched ESR — on an unpatched kernel and driver stack compounds risk.

---

What Mozilla is doing and why it matters​

The concrete change​

• Firefox 115 is the last Firefox release that will ever receive official support on Windows 7, Windows 8, and Windows 8.1. Systems running newer Firefox releases require a supported Windows version.
• Mozilla placed affected installs on the Firefox 115 ESR channel so the team could selectively backport high-impact security fixes while avoiding the regular rapid release cadence.
• That ESR maintenance has been extended multiple times to smooth transitions, but Mozilla now warns that continuing support is not free: backporting security fixes is “increasingly painful” because the ESR branch diverges over time from the mainline codebase.

Why a browser vendor keeps supporting an old OS​

At a high level there are three reasons:

• Practical safety: a modern browser with current security patches reduces the attack surface for web-based exploits even if the underlying OS lacks current patches.
• Real-world usage: telemetry (and anecdotal enterprise reports) shows a non-trivial number of Firefox users still run older Windows. For many, the alternative is replacing perfectly serviceable hardware.
• Reputation and stewardship: Mozilla positions itself as defending users’ privacy and security; offering an ESR for legacy OSes is an extension of that mission, with an explicit sunset.

Why it’s not a perfect fix​

• Browser updates can only do so much. When the OS kernel, drivers, or low-level cryptographic libraries are unpatched, attackers have more avenues to escalate from a browser exploit to full system compromise.
• The ESA approach consigns legacy users to a static feature set: Firefox 115 ESR will receive only security and critical stability fixes, not new features or modern web platform changes.
• Backports are expensive. Fixes developed against the modern codebase must be adapted to older APIs, older libraries, and different build toolchains; that work requires engineering time and extensive testing.

---

The technical reality: why maintenance costs grow over time​

Supporting any complex software on a platform that is no longer maintained by its vendor requires a continuing investment in compatibility engineering. The broader the gap between the current mainline browser code and the legacy build you must maintain, the more painful backporting becomes.

Key technical friction points​

• Dependency drift: Newer Firefox releases depend on updated system libraries, runtime behavior, and platform APIs. Older Windows builds may not expose those APIs or may implement them differently, requiring code paths or shims.
• Cryptography and TLS stacks: Web encryption evolves. New cipher suites, TLS versions, and platform integrations sometimes assume OS-level crypto primitives, which are absent or outdated on old Windows versions. Maintaining secure defaults on older stacks often requires bespoke patches and additional testing.
• Telemetry and crash reporting: Modern diagnostic hooks expect platform features that may not exist on older systems, complicating the ability to validate whether a patch actually fixes a real-world issue.
• Testing matrix explosion: Each supported build multiplies the combination of browser version, OS version, hardware variation, and installed drivers that need to be tested. Keeping a trustworthy CI (continuous integration) pipeline for legacy builds is costly.
• Vulnerabilities discovered in mainline code: A vulnerability fixed in the current release train might interact with new or refactored subsystems. Mapping that fix back into an older tree is non-trivial and sometimes impossible without rewriting large parts of the legacy code.

Mozilla’s own messaging — that continuing support “isn’t going to be free” — is a frank admission of these realities. The longer an ESR is maintained, the greater the divergence and the higher the engineering cost.

---

Security implications for users who stay on legacy Windows​

For non-technical readers the bottom line is simple: the web browser is the avenue to the internet; the operating system is the foundation. Patching the browser helps, but it does not erase the larger problems of an unsupported OS.

• Reduced protection against kernel/driver exploits: Countless high-severity vulnerabilities exist at the OS and driver level. An updated browser cannot fix an exploitable kernel surface or an insecure driver.
• Compatibility and modern web features: Websites progressively adopt newer platform features and security expectations. Over time Firefox 115 ESR may render fewer modern web apps correctly or be blocked by stricter server-side policy choices (for example, minimum TLS versions).
• False sense of security: An up-to-date browser can lull users into thinking their machine is secure. In truth, without OS updates, certain attack classes remain open and may be exploited in chains that a browser patch cannot disrupt.
• Third-party software churn: Banking sites, anti-fraud systems, and enterprise security stacks sometimes stop supporting older client environments. Users can find themselves locked out of services even if their browser stays patched.

---

Practical advice: what readers should do next​

For anyone still running Windows 7, 8, or 8.1 and relying on Firefox 115 ESR, here are practical, prioritized options — from least to most disruptive — annotated with pros, cons, and critical steps.

1. Short-term: keep Firefox 115 ESR up to date and reduce exposure​

• What to do
• Ensure your Firefox 115 ESR install is set to receive updates (ESR security updates are the only path for legacy Windows).
• Use strong browser hygiene: enable phishing/malware protection, keep add-ons to a minimum, and avoid risky sites and downloads.
• Use a modern, well-updated antivirus/endpoint product that supports legacy Windows if you can obtain one.
• Why it helps
• Reduces immediate risk while you plan a migration.
• Why it’s insufficient
• This is temporary protection. OS-level vulnerabilities remain unpatched.

2. Medium-term: migrate the machine to a supported Windows release if the hardware allows​

• What to check
• Run Microsoft’s Windows compatibility tools to confirm if your hardware meets Windows 10 or Windows 11 minimums.
• If aiming for Windows 11, confirm TPM 2.0, Secure Boot capability, and CPU family compatibility.
• Upgrade paths
• In-place upgrade to Windows 10 (if still supported in your environment) or Windows 11 where supported.
• Clean install is often cleaner and avoids cruft; back up data and browser profile before wiping.
• Key migration steps
• Backup Firefox profile or enable Firefox Sync (bookmarks, passwords, history) ahead of migration.
• Export bookmarks and saved passwords as a secondary safeguard.
• Reinstall Firefox on the upgraded OS and restore your profile or sign into Sync.
• Why this is best
• Restores a supported platform with ongoing OS-level security updates, enabling access to the latest browser releases.

3. Medium-to-long term alternative: install a modern Linux distribution​

• Why Linux
• Most mainstream Linux distributions ship or make available current Firefox builds and receive timely security updates.
• Linux can breathe new life into older hardware by being lighter-weight and still receiving maintained browser updates.
• Suggested distros for migrating Windows 7-era hardware
• Linux Mint (user-friendly, Windows-like desktop), Ubuntu LTS (wide hardware support), Debian (stability), or lightweight options like Xubuntu or Lubuntu for very old machines.
• Migration checklist
• Backup files from Windows.
• Try a live USB session to test hardware compatibility without installing.
• Use Firefox or another modern browser on Linux and restore your Firefox Sync account to rehydrate bookmarks/passwords.
• Caveats
• Certain proprietary Windows applications may not have native Linux equivalents; virtualization or Wine may be needed for those apps.
• Hardware vendors’ drivers (e.g., some Wi‑Fi or graphics adapters) may have limited Linux support on very old devices.

4. Enterprise / large fleet options​

• Options
• Enroll in Microsoft Extended Security Updates (ESU) if eligible and cost-effective.
• Isolate legacy machines on segmented networks, limiting internet access to essential services and placing strict gateway filtering in front of them.
• Use virtual desktops or VDI: run a modern OS in a controlled VM while using the old desktop as a thin client.
• Why plan now
• Procurement cycles, budget approvals, and application compatibility testing take time. Treat the ESR sunset as a firm planning milestone.

---

How to move your Firefox data safely​

Whether you upgrade Windows, migrate to Linux, or rebuild a machine, preserving your browser data is essential. Use a two-pronged approach:

• Firefox Sync
• Create or sign in to a Firefox Account.
• Enable Sync for bookmarks, passwords, history, and open tabs.
• After migration, sign into the same Firefox Account to restore data.
• Local profile backup
• Locate your Firefox profile folder (commonly under %APPDATA%\Mozilla\Firefox\Profiles\ on Windows).
• Copy the entire profile folder to external storage.
• After installing Firefox on the new system, use the profile manager or copy the profile into the new profile location. If Firefox reports profile incompatibility, create a new profile and import bookmarks/passwords via HTML/CSV export or Sync.

These steps reduce the risk of lost bookmarks, saved logins, and long manual reconfiguration.

---

Strengths and risks of Mozilla’s approach — critical analysis​

Notable strengths​

• Short-term user protection: By extending Firefox 115 ESR Mozilla reduced immediate risk for users who have no practical upgrade path. A patched browser is meaningfully safer than an unpatched one.
• Realism and transparency: Mozilla has communicated the engineering burden and signaled clear intent to limit the extension period, allowing users and IT teams to plan.
• Choice-preserving: For hobbyists, embedded devices, and legacy-app-dependent users, this buys breathing room to plan a migration without being cut off abruptly.

Key risks and limits​

• Partial mitigation, not elimination: A patched browser cannot replace OS patches; sophisticated attackers can chain unpatched kernel or driver bugs with in-browser exploits.
• Rising cost and fragility: The longer ESR maintenance continues, the more likely unanticipated incompatibilities will appear — increasing the chance of missed fixes or regressions.
• Ecosystem fragmentation: Service providers (banks, streaming, corporate SSO portals) may harden policies that block or throttle legacy clients, producing functional breakage even if security patches are applied.
• User confusion and false confidence: Messaging must be precise: an updated Firefox 115 ESR is safer than nothing, but still an inferior long-term posture compared to a supported OS with a modern browser.

---

What the roadmap implies for the ecosystem​

Mozilla’s ESR strategy reveals several truths about modern software ecosystems:

• Vendors can, and sometimes do, extend life for legacy users — but the task is fundamentally an engineering and economic choice.
• End-user and enterprise migration strategies must consider the whole stack: hardware, OS, browser, and networking controls.
• When all mainstream browsers stop updating old OSes, the practical pressure to upgrade intensifies: fewer secure browsing options translate quickly into business and security risk.

For policy-makers and IT teams the ESR sunset should be treated as a hard deadline for migration planning. For individual users, it’s a reminder that “it still works” is not the same as “it is secure.”

---

Migration checklist for individuals and small IT teams​

• Inventory: list all machines still running Windows 7/8/8.1 and note which applications they require.
• Prioritize: identify machines that handle sensitive data or connect to critical services and prioritize them for migration.
• Backup: ensure full data backups and specifically back up browser profiles or enable Firefox Sync.
• Test path: for each candidate machine, test a Windows 10/11 upgrade path and a Linux live USB to confirm hardware compatibility.
• Execute: perform upgrades, clean installs, or Linux deployments in batches. Reconfirm that security controls (antivirus, disk encryption, firewall) are re-enabled after migration.
• Decommission: once migrated, isolate and securely wipe the legacy machines or repurpose them in segregated offline roles.

---

Final assessment and recommendations​

Mozilla’s decision to keep Firefox 115 ESR available for Windows 7/8/8.1 users is a pragmatic one: it reduces immediate web-exposure for a cohort of users who otherwise would be forced offline or to use unmaintained browsers. The company’s candor about the cost and difficulty of backporting security fixes is welcome; it sets a realistic expectation that this is a finite stopgap, not a permanent service.
For readers who depend on legacy Windows desktops, the imperative is clear and urgent: treat the ESR runway as temporary, not a sanctuary. The path that maximizes long-term security and access to modern web features is to migrate to a supported Windows release or to a maintained Linux distribution. Organizations should use the ESR period to plan and execute migrations methodically; individuals should evaluate hardware capability and choose the least disruptive upgrade path.
Running an up-to-date browser remains one of the highest-impact actions an end user can take to stay safer online — but in a layered threat landscape, the operating system matters just as much. Mozilla’s ESR lifeline softens the landing; it does not eliminate the need to move to a supported platform. The message from both Mozilla and the broader industry is candid: legacy OS users have time, but not forever — and the smarter route is an orderly migration while the ESR safety net is still available.

---

Source: Windows Central Mozilla still supports Firefox on Windows 7, but admits it's "risky"

 

[ChatGPT]

Mozilla quietly gave the last fully modern Firefox build that runs on Windows 7, 8 and 8.1 a stay of execution — again — moving the guaranteed security-update window for Firefox 115 ESR out to the end of August 2026 and promising to re-evaluate after that. (support.mozilla.org)

Background / Overview​

For years Mozilla maintained a pragmatic line: modern Windows releases get the mainline Firefox cadence; older desktop OSes that cannot run recent builds are routed to an Extended Support Release (ESR) branch so they can continue to receive security fixes without inheriting feature churn. That policy is the reason Firefox 115 — originally rolled out in July 2023 — became the last “full-feature” release that officially supports Windows NT 6.x (Windows 7 / Windows Server 2008 R2) and the Windows 8/8.1 family.
The ESR channel exists specifically for organizations and long-running systems that need a stable baseline: fewer feature changes, but continued security and reliability backports. In practice, Mozilla has extended the ESR 115 support window multiple times, driven by a small but persistent population of legacy desktops and the operational burden of porting fixes forward into newer codebases. The ESR branch has been the vehicle for those extensions.
What changed this week is not a brand-new product launch; it is an update to Mozilla’s support pages and release guidance that formally guarantees Firefox 115 ESR security updates up through 31 August 2026 (Mozilla’s language: “until the end of August 2026”), instead of the previously published February/March 2026 horizon. That change is now reflected in Mozilla’s official help pages for affected Windows and macOS releases. (support.mozilla.org)

---

What Mozilla actually changed — the facts​

• Firefox 115 (the ESR stream) is the last Firefox branch supported on Windows 7, Windows 8 and Windows 8.1. (support.mozilla.org)
• Mozilla’s official support article now states that security updates for Firefox 115 ESR will continue until the end of August 2026, and that the organization will “re-evaluate” whether further extensions are appropriate. (support.mozilla.org)
• The ESR branch continues to receive periodic maintenance builds; for example, Firefox 115.33.0esr was pushed in late February 2026 as part of that channel’s maintenance cadence.
• A newer ESR base, Firefox 140 ESR, is already the project’s modern ESR branch released in June 2025 — but that branch is not offered for Windows 7/8.x because it depends on platform APIs and system libraries that older OSes don’t provide.

These are not rumours: the authoritative Mozilla support pages and release artifacts show the dates and the channel designations. Where coverage exists, it tracks these items precisely. (support.mozilla.org)

---

Why Mozilla is keeping ESR 115 alive (and why it matters)​

At a high level, Mozilla’s decision is pragmatic: a minority of Firefox users still run legacy Windows and older macOS releases, and without an ESR backport channel they would be left with no browser that receives security fixes. That matters for two, sometimes overlapping groups:

• Home users with long-lived hardware who prefer an older UI (Aero nostalgia, small-form-factor PCs, specialized machines).
• Organizations and hobbyists that run device fleets or single-purpose PCs that cannot be upgraded easily or where the upgrade cost is significant.

For those stakeholders, Firefox 115 ESR operates as a “last modern browser”: it implements contemporary web standards and security fixes backported to an older engine while avoiding the forward-looking platform changes that break compatibility on NT 6.x. Putting that bluntly: ESR 115 buys time for users who cannot upgrade to Windows 10/11 or migrate to a modern macOS. (support.mozilla.org)
There’s an additional, practical reason Mozilla can and sometimes will extend support: the engineering cost of backporting targeted security fixes into 115 ESR, though non-trivial, is often less than the negative user impact of immediately pulling the rug out from under a small but vocal user base. That balancing act — cost vs. user safety — is exactly what Mozilla’s public messaging describes when it says it will “re-evaluate” support timelines. (support.mozilla.org)

---

The industry context: Firefox is now a special-case browser for legacy Windows​

Major Chromium-based browsers and Microsoft’s Edge stopped supporting Windows 7 and Windows 8.x some time ago. Microsoft explicitly documented that Edge would stop at version 109 for those older OS builds, and Google likewise ceased Chrome support beyond version 109/110 in early 2023. That left Firefox as the last mainstream option for users who insisted on staying on NT 6.x while still wanting a browser receiving security fixes.
Mozilla’s continued maintenance of an ESR stream for legacy systems has therefore been a unique industry posture: other browser vendors decided the platform-level expense and security trade-offs weren’t worth it. That uniqueness is why Mozilla’s policy changes — even modest extensions — attract attention from the remaining legacy-OS user communities.

---

Technical realities and limitations users must understand​

If you’re still running Windows 7/8.x and you welcome Mozilla’s extension, pause before treating this as a permanent safe haven. There are sharp practical limitations:

• Security updates are only as effective as the platform. Windows 7 and Windows 8.1 no longer receive OS-level security patches from Microsoft (the official end-of-support date for those systems was January 10, 2023). A patched browser reduces some attack surface, but kernel-level vulnerabilities, driver flaws and unpatched system components remain exploitable, which can materially reduce the benefit of a hardened browser. Don’t assume an up-to-date Firefox fully protects an unsupported OS. (support.mozilla.org)
• Compatibility with sites and modern features can break. Newer web platform APIs (for DRM, advanced media codecs, hardware-accelerated decoding and certain cryptographic backends) are often integrated into later Firefox ESR and mainstream releases that depend on system APIs not present on older Windows versions. Mozilla’s approach keeps security backports flowing, but it cannot retrofit every modern engine capability to an OS that lacks required system support. Expect some websites/features to be flaky or unavailable.
• Third-party services and big websites may perform client-side filtering: some banks, games or media services increasingly check for up-to-date platforms and block access for old OS/browser combos. That creates a mismatch where a patched browser can exist but still be functionally blocked from key sites. There are community reports of service blocks and compatibility gates against ancient OS/browser combos; these vary by service and are sometimes implemented without industry-wide coordination. Treat these as probable, not hypothetical.

In short: ESR 115 is a mitigation tool, not an elimination of risk. Use it to manage exposure during a transition — not as a long-term “forever” solution. (support.mozilla.org)

---

What this means for security teams, hobbyists and enterprises​

For enterprise IT teams and security-conscious hobbyists, Mozilla’s extension changes the decision calculus but does not remove the imperative to plan migrations. Here’s a practical breakdown.

Short-term (now → August 2026)​

• Keep ESR 115 updated automatically on legacy systems so you receive Mozilla’s security backports. That reduces immediate browser-layer risk compared with running an out-of-date browser. (support.mozilla.org)
• Identify critical services that might block access by OS/browser checks and develop contingencies (alternate access paths, remote access to up-to-date VMs, or vendor engagement). Anecdotal reports suggest some banking and financial services already enforce modern platform checks.
• Audit installed software (plug-ins, legacy NPAPI, old helper apps). ESR branches often remove newer platform integrations and leave certain legacy extensions unsupported — remove or replace vulnerable items.

Medium-term (6–12 months)​

• Build a migration plan: inventory hardware, list devices that can upgrade to Windows 10/11, and identify those that cannot due to CPU, firmware or driver constraints.
• Where hardware cannot be upgraded, plan for an OS migration to a modern Linux distribution that supports older CPUs where feasible. Mozilla itself suggests Linux as a migration path for non-upgradable systems. (support.mozilla.org)

Long-term (beyond August 2026)​

• Expect the engineering and security rationale to push Mozilla toward a final cutoff at some point; make migration decisions assuming no browser security updates beyond August 2026 unless Mozilla later announces another extension. Relying on indefinite extensions is risky. (support.mozilla.org)

---

If you must stay on Windows 7/8.x — best-practice checklist​

If upgrading is not an option immediately, follow these steps to reduce exposure while you plan a transition:

• Upgrade Firefox to the latest available 115 ESR maintenance build and enable automatic background updates for ESR.
• Remove or disable legacy plug-ins and extensions that are not maintained. Legacy add-ons can be a vector for compromise.
• Use layered defenses: endpoint anti-malware, host-based firewall rules, and network restrictions (segment legacy devices away from sensitive resources).
• Restrict browsing on legacy machines to the minimum set of sites needed for the device’s purpose. Avoid general-purpose browsing if possible.
• If possible, access high-risk services (banking, business SaaS, sensitive webmail) via an up-to-date remote desktop or a VM hosted on a more current host.
• Plan for migration to a supported OS or Linux distribution — set a hard target date and budget for that migration. Mozilla’s extension is a buffer, not a reprieve. (support.mozilla.org)

---

Is Mozilla doing the “right” thing? A critical assessment​

There are real strengths to Mozilla’s move, and real risks — both deserve balanced attention.

Strengths​

• User safety via continuity: For users who cannot upgrade overnight, having a current, patched browser makes targeted compromises (drive-by exploits, malicious pages) less likely than running very old browser code. ESR patches can and do fix high-severity vulnerabilities even when the mainline product moves on. (support.mozilla.org)
• Reduced ecosystem disruption: Abruptly cutting ESR support would have stranded users, created sudden compatibility shocks for essential services, and likely generated a rash of insecure workarounds. Mozilla’s slower deprecation reduces churn and gives organizations breathing room.

Risks and costs​

• False sense of safety: A patched browser on an unpatched OS can provide a veneer of protection that obscures the platform-level risk. Attackers often chain kernel and driver-level exploits with browser flaws; mitigating one without the other only goes part of the way. (support.mozilla.org)
• Maintenance burden and opportunity cost: Backport work is real engineering time. Each additional month of support requires triaging patches, reproducing bugs on antiquated stacks, and retesting. That effort competes with new feature and security investments in modern branches. Mozilla has to weigh community benefit versus product velocity.
• Fragmentation harm: Encouraging prolonged life for legacy binaries can disincentivize migration to secure OSes. Extension windows must therefore be tightly communicated and timeboxed, or they risk becoming de facto long-term support without the corresponding resource commitment. Mozilla’s “we will re-evaluate” language tries to strike that balance, but the social dynamics remain delicate. (support.mozilla.org)

---

Alternatives and migration paths (realistic options)​

If your machine can run Windows 10/11, migrating is the obvious, supported path. If the hardware is too old, consider these options:

• Dual-boot with a lightweight modern Linux distro (Ubuntu LTS, Debian, Fedora, or a lighter derivative) for daily browsing. Mozilla explicitly points to Linux as a fallback path where Windows upgrades are impossible. (support.mozilla.org)
• Use virtualization: run a modern guest OS or a hardened appliance VM for web access, leaving the legacy host offline except to run the VM. That isolates the insecure host from the browsing surface.
• Replace the machine. For many users the cost of a new, low-end modern PC is less than the long-term security and operational costs of maintaining a legacy desktop. For hobbyists with sentimental attachments to Aero and classic UIs, a modern system with custom theming can provide the look without the insecurity.

If your use case is purpose-built (industrial control, music production, retro gaming), you must balance compatibility with upstream vendor support; some legacy software only runs on older Windows — in that case, consider dedicated offline appliances plus a separate modern browsing device. The essential point: plan an actual migration path and a target date, not open-ended reliance on extensions.

---

How to read Mozilla’s messaging: what to expect next​

Mozilla’s public phrasing — “we will extend support for another six months and re-evaluate” — is explicit risk-management language. It implies:

• Mozilla realizes a non-zero population still depends on ESR 115, so it will keep delivering critical patches through August 2026. (support.mozilla.org)
• The company is not committing to indefinite support; that open-endedness is deliberate: the foundation wants to keep options open while limiting the operational commitment. Expect future communications in July/August 2026 about whether ESR 115 gets a final wind-down or another short extension. (support.mozilla.org)

Practically, stakeholders should treat the August 2026 horizon as a planning deadline. If you or your organization are still on Windows 7/8.x, make migration decisions and testing schedules aligned to that timeline rather than relying on open-ended grace periods.

---

Final assessment: useful, limited, conditional​

Mozilla’s extension of Firefox 115 ESR support to the end of August 2026 is a measured, pragmatic move that preserves a critical safety net for a dwindling group of legacy-OS users. It keeps a modern, security-patched browser available where Chromium-based alternatives have already dropped support, and it reduces the immediate risk for machines that cannot be upgraded quickly. That is the real value of this decision. (support.mozilla.org)
At the same time, it is not a cure. A patched ESR browser on an unsupported OS is a partial mitigation at best. The underlying system vulnerabilities, driver gaps and ecosystem-level blocks (services that gate access by platform) are real constraints that an ESR branch cannot eliminate. Mozilla’s extension buys time — not forever, and not unconditional safety — and it should be used precisely for that purpose: planning and executing a migration away from unsupported platforms. (support.mozilla.org)
If the question is whether Mozilla is “right” to do this: yes, in the narrow security-first sense of reducing immediate attack surface for certain users. But the broader, long-term public-good answer is that the industry needs clearer upgrade pathways, better vendor coordination (so services do not force insecure workarounds), and more accessible migration paths (affordable hardware, lightweight OS options) so that the epoch of legacy desktop browsers finally closes without leaving users stranded in the weeds.

---

Key sources and verifiable facts cited in this article​

• Mozilla’s official support article for Firefox support on Windows 7 / 8 / 8.1, which now states ESR 115 will continue to receive security updates until the end of August 2026. (support.mozilla.org)
• Mozilla release notes and historical records showing Firefox 115 (ESR base) was first offered in July 2023.
• Mozilla release artifacts showing Firefox 115.33.0esr maintenance release activity in February 2026.
• Evidence that Firefox 140 (ESR) is the modern ESR line released June 24, 2025, demonstrating why older OSes can’t simply jump to the latest ESR base.
• StatCounter market-share figures indicating Windows 7’s worldwide share has fallen to a fraction of a percent (0.62% in StatCounter’s February 2026 dataset), explaining why browser vendors consider the platform niche.
• Industry context: Microsoft’s Edge and Chromium-based browsers ended mainstream support for Windows 7/8.x, leaving Firefox as the last mainstream browser with active ESR updates on those platforms.

---

Mozilla’s extension is a responsible, time-limited accommodation for a niche but non-zero population. Use the extra months deliberately: patch, audit, segregate, and migrate. Treat the window as a planning horizon — not a new era of indefinite support.

---

Source: TechSpot Firefox 115 ESR is keeping Windows 7 support alive a little longer