Firefox 154.0 adds WebSocket network protections and per-site cookie controls

The release adds a security extension that treats WebSocket connections like other local network traffic, applying existing local network access protections to them. This means WebSocket endpoints on intranet or localhost are subject to the same restrictions as HTTP requests. Developers may see previously allowed WebSocket connections now blocked unless they are explicitly permitted. The change aims to reduce the attack surface for local-network-targeted exploits.

Adopting the new per-site cookie and data clearing settings requires reviewing existing clearing policies and possibly updating them to take advantage of the finer granularity. The overhead is mainly procedural: testing that site-specific clearing behaves as expected and adjusting any automation that relied on the previous global behavior. No new dependencies or major code changes are introduced by the feature itself.

Environments that depend on the old global clearing behavior may observe differences in when data is removed, potentially breaking workflows that assumed uniform clearing across all sites. WebSocket connections used for local development or internal tools could be blocked by the new protections unless an exception is configured. Additionally, any extensions or tools that interact with Firefox’s cookie clearing mechanisms might need updates to remain compatible with the new per-site model.