How to permanently disable FireFox updating...

[BrianHG]

How to permanently disable FireFox updating...
For those of you who just need it that badly, follow these instructions:

    Close Firefox before proceeding.

    Launch Windows Registry Editor.

    Navigate to HKEY_LOCAL_MACHINE\Software\Policies

    Create a new key there named Mozilla. You will end up with: HKEY_LOCAL_MACHINE\Software\Policies\Mozilla

    Under the Mozilla key, create a new key named Firefox. You will end up with: HKEY_LOCAL_MACHINE\Software\Policies\Mozilla\Firefox

    On the right, create a new 32-Bit DWORD value DisableAppUpdate

    Set its value to: 1

    Restart Firefox and you will no longer see the "a new Firefox update is available" popup.

    In Firefox navigate to about:preferences and in the General section under Firefox Updates you will see "Updates disabled by your system administrator"

Finally, some peace...

Here is a .zip of a firefox auto-update ON and OFF reg files I created (IE: they automatically perform the registry addition you see in the above quote.):
https://www.eevblog.com/forum/chat/how-to-permanently-disable-firefox-updating/msg5113854/#msg5113854

[joeqsmith]

Mozilla Firefox/distribution/policies.json

{
 "policies": {
    "DisableAppUpdate": true
  }
}

[The Electrician]

Mozilla Firefox/distribution/policies.json

{
 "policies": {
    "DisableAppUpdate": true
  }
}

Could you explain a little more how to do this>

[nctnico]

Go into the settings menu of Firefox and set the updates to manual.

[tridac]

Thanks, will give that a try. Problem is that later verisions of FF no longer have the ability to disable updates, which is why i'm still on 114.0.2. That does keep nannying with an update box,  top right, several times a day, but at least it can be ignored. Would be good to get rid of that as well...

[SiliconWizard]

Thanks, will give that a try. Problem is that later verisions of FF no longer have the ability to disable updates, which is why i'm still on 114.0.2. That does keep nannying with an update box,  top right, several times a day, but at least it can be ignored. Would be good to get rid of that as well...

Use Linux.

[MrMobodies]

The last version in 2020 Firefox 80 I think had lots of popup messages (about the browser) with dimming overlays more than chrome (which hurts my eyes and p*ss me off) and I gave up on it because of the dimming overlays.

I opened a thread on the Firefox forum explaining the issue and a suggestion but it got deleted.

I still feel bitter about it. I wonder if it is someone's ego who decided they wanted it like that and don't want to hear the impact it has by constantly dimming the screen with dialogues and offer messages from Firefox.

[JeremyC]

Thanks, will give that a try. Problem is that later verisions of FF no longer have the ability to disable updates, which is why i'm still on 114.0.2. That does keep nannying with an update box,  top right, several times a day, but at least it can be ignored. Would be good to get rid of that as well...

Use Linux.

It's not OS issue. Using Linux will not resolve OP's problem... he must disable auto updates... 

[Monkeh]

Thanks, will give that a try. Problem is that later verisions of FF no longer have the ability to disable updates, which is why i'm still on 114.0.2. That does keep nannying with an update box,  top right, several times a day, but at least it can be ignored. Would be good to get rid of that as well...

Yes, they do. Same setting - it notifies you, but doesn't force you.

Perhaps you should just update and move on with your life.

[BrianHG]

After my posted reg patch:



No more update interruptions.

[BrianHG]

Here, I've attached a .zip of 2 reg files which will allow you to turn on and off firefox's updates.

Just double click on the reg file you want and click yes/yes.

If you do not trust me, you can inspect the reg files with any text editor and see it matches the reg settings I quoted in my opening post.

In the .zip, you have these 2 files:
FireFox_updates_off.reg
FireFox_updates_on.reg

[SiliconWizard]

Thanks, will give that a try. Problem is that later verisions of FF no longer have the ability to disable updates, which is why i'm still on 114.0.2. That does keep nannying with an update box,  top right, several times a day, but at least it can be ignored. Would be good to get rid of that as well...

Use Linux.

It's not OS issue. Using Linux will not resolve OP's problem... he must disable auto updates...

There is no auto-update in Linux versions.

[mwb1100]

Mozilla Firefox/distribution/policies.json

{
 "policies": {
    "DisableAppUpdate": true
  }
}

Could you explain a little more how to do this>

See:

  - Firefox policy-templates

That page also documents the registry settings in @BrianHG's original post.  There are at least two advantages to the policies.json file:

1. it's easier to backup/restore
2. it's cross platform (of course, that doesn't matter if you're running only Windows)

[rdl]

I'm pretty sure auto updates are possible, since they're disabled.

[rdl]

It's kind of ridiculous but probably 80% or more of the updates that come through the package manger are Firefox updates. I hardly use it anymore because it won't keep running. It constantly wants to be restarted and the way I do things that gets to be annoying.

[tom66]

So... this is why we have massive bot-nets!  People willingly disabling security updates.   

[Gyro]

The last version in 2020 Firefox 80 I think had lots of popup messages (about the browser) with dimming overlays more than chrome (which hurts my eyes and p*ss me off) and I gave up on it because of the dimming overlays.

I opened a thread on the Firefox forum explaining the issue and a suggestion but it got deleted.

I still feel bitter about it. I wonder if it is someone's ego who decided they wanted it like that and don't want to hear the impact it has by constantly dimming the screen with dialogues and offer messages from Firefox.

Why don't you just switch to the Extended Support Release (ESR)? Then you only get security updates, not new features.

[nctnico]

Thanks, will give that a try. Problem is that later verisions of FF no longer have the ability to disable updates, which is why i'm still on 114.0.2. That does keep nannying with an update box,  top right, several times a day, but at least it can be ignored. Would be good to get rid of that as well...

Use Linux.

It's not OS issue. Using Linux will not resolve OP's problem... he must disable auto updates...

There is no auto-update in Linux versions.

There certainly is. At least in version 114 (downloaded from Mozilla directly) which I'm using right now. But I have Firefox installed in a place where only root can write so it can't update / overwrite itself. Maybe packaged versions from Linux distributions have the updates disabled to make sure Firefox is updated throuhg the OS native update process.

[joeqsmith]

Mozilla Firefox/distribution/policies.json

{
 "policies": {
    "DisableAppUpdate": true
  }
}

Could you explain a little more how to do this>

[BrianHG]

It's kind of ridiculous but probably 80% or more of the updates that come through the package manger are Firefox updates. I hardly use it anymore because it won't keep running. It constantly wants to be restarted and the way I do things that gets to be annoying.

Not exactly true.  I'm using an old ESR with NoScript and even the latest updates slowed down my laptops loading of firefox 4 fold.
It also eats 50% more ram when just viewing youtube videos and with my 4gb system, this means a bunch of low computer memory warnings and crashes.

Warning: The latest firefox ESR update also triggers the youtube adblocker warning.

Uninstalling and downgrading needs to now be done offline, otherwise, firefox auto-updates before your your first run, of by the second run.

[HighVoltage]

I had so many problems with the latest update and it slowed down my system so much, that I went back to an older Firefox version.

This older version runs so smooth and fast that it was a big positive surprise. I will update manually from now on.
 

[joeqsmith]

I had to roll back a few months back when YT would flash a white screen at me.   The version installed now still has a problem that it will not always allow the the bookmarks to function.

[BrianHG]

I had to roll back a few months back when YT would flash a white screen at me.   The version installed now still has a problem that it will not always allow the the bookmarks to function.

You need to go into the bookmark manager an export your bookmarks.
Then full uninstall firefox.
The go into all your 'documents and settings' folders hunting down all the Mozilla/firefox folders and delete everything. (Careful if you use Firebird, keep those folders or loose your emails.)
Then disconnect from the internet installing an old firefox. switch to manual updates, then reconnect to the internet.
Import bookmarks & re-install your adblockers/noscript.
Doing all this will reverse all the new garbage.

[BrianHG]

firefox 102.4.0esr seems not to be too bloatty and no youtube warnings.
Firefox 91.1.0esr seems to use even less resources and the webpages scroll much smoother on my older systems.

[rdl]

On a Linux system that updates Firefox with the package manager the problem comes from updating while Firefox is running. That gets it bent out of shape and it will refuse to open new pages or tabs until it's restarted. You just have to watch what you're doing. But on MX the updates are all or nothing (as far as I can tell) and I don't like to put off system updates just because Firefox is in use and some Firefox update is included. The easiest solution is to just use Firefox as little as possible.

It's different on Windows because Firefox handles its own updating and you can set it to just get the updates and defer the installing until later. On my windows computer , literally the only thing Firefox is used for is watching YouTube and I've had zero problems. But I have no account, never sign in, and block just about everything I can and still have YouTube work. I don't even allow their cookies.

[BrianHG]

One of my PCs seems to trigger Youtube ADBlocker warning even though it has an old firefox.
Not sure why my other PCs seem immune.

My guess is different Noscript permissions.  I'll try eliminating everything except for the absolute necessary to see a video.

[rhodges]

Use Linux.

It's not OS issue. Using Linux will not resolve OP's problem... he must disable auto updates...

Please state how a user software without root authorization can write (replace) system software. This is software that is NOT writable by any random user.

I use FreeBSD, and nothing changes until I ask for an upgrade. Then I see the list and I choose whether I want to upgrade or not. The last two times, the answer was NO.

[coromonadalix]

the json  method is known for a long time ...

use firemin to drop memory leak / consumption

in some case, many website(s) now can detect the adblocks  etc ....     there's some docs about this

yes  older fire#$%$  are less bloathed,  the esr version can help,  but some websites still push the latest web browsers, and some esr are sometime blocked

every firefox core based variants
every chrome based variants
opera maxthon
ur

some very good now "old" pluggins who never got converted to the new standards are lost  etc ...

and the list goes on and on, a never ending battle that i'm tired to fight

[tom66]

With DDR3/4 being cheap again, I solved the memory leak problems of my various use cases by just throwing more memory at the problem.  My desktop system has 64GB and my laptop has 32GB (upgraded from 16GB stock).  A 4GB system in 2023 is rare, so I can imagine the Firefox chaps are not all that concerned with optimising for that use case.  They probably suggest a minimum 8GB nowadays.

[thm_w]

With DDR3/4 being cheap again, I solved the memory leak problems of my various use cases by just throwing more memory at the problem.  My desktop system has 64GB and my laptop has 32GB (upgraded from 16GB stock).  A 4GB system in 2023 is rare, so I can imagine the Firefox chaps are not all that concerned with optimising for that use case.  They probably suggest a minimum 8GB nowadays.

Firefox doesn't really give a good recommendation, but recommended RAM for windows 10 is 8GB. You can get a 16GB SODIMM for <$30.

Using a 4GB system is straight up masochism.

[BrianHG]

With DDR3/4 being cheap again, I solved the memory leak problems of my various use cases by just throwing more memory at the problem.  My desktop system has 64GB and my laptop has 32GB (upgraded from 16GB stock).  A 4GB system in 2023 is rare, so I can imagine the Firefox chaps are not all that concerned with optimising for that use case.  They probably suggest a minimum 8GB nowadays.

Firefox doesn't really give a good recommendation, but recommended RAM for windows 10 is 8GB. You can get a 16GB SODIMM for <$30.

Using a 4GB system is straight up masochism.

Ok everyone, understand carefully.

One of my main laptop systems has 4gb running win7.  I use it for my older Protel 99se projects, Quartus compiling, music editing, web browsing which consists of mainly Digikey, datasheets, youtube viewing and other sound/video playback.  Until the newer Firefox accidentally got in, it has been in use for 6 years now an has crashed once in those 6 years.  It would be a waste of my time just to see if I can add ram or change the HD to an SSD as I know it will open up a can of worms where I have had a near 6 year run of perfect function.

Just buying a new laptop, having to setup windows the way I like, installing all my software and license files and getting everything functional is a slow month long ordeal.  I don't have the time or patience to go through this.  locking down firefox so I don't accidentally upgrade it once again is the best solution.

(I mean, will Protel99se even install and network license on Win10)

[thm_w]

Backing up that HDD to a SSD would probably be worth it as an insurance policy alone. You'd also save time in the long run waiting for things to load.
If you can't be bothered to check, post the laptop model number here and someone else can look it up.

Yes protel works in windows 10, as per your own thread: https://www.eevblog.com/forum/eda/patch-for-protel99se-sp6-for-win7810/
Whether its worth the time to set up, or a VM makes more sense, I don't know.

[BrianHG]

Backing up that HDD to a SSD would probably be worth it as an insurance policy alone.

I am not an amateur.  I do have network backup at 2 external locations and have an emergency external mirrored drive on hand.  I've been around.

[soldar]

It's not OS issue. Using Linux will not resolve OP's problem... he must disable auto updates...

I don't think so. I use Linux Mint and have the OS to only update manually and it will offer Firefox updates but I can install them whenever I want. I do not think it can do it without me inputting the password.

My gripe is that some software, like Firefox, Thunderbird and others do not offer small updates but they try to pretty much reinstall the whole thing which means 60 or 80 or 100 or more MB each time which for someone with limited bandwidth is a PITA so there are several programs I only update very infrequently. And then they mess up my settings so I decide to not update them at all.

And I do not see why they need to update cajillions of GB so often. They could start by making software safe from the start instead of doing a shoddy mess and then letting others discover discover holes. Most of the time they are just playing with new "features" while they introduce vulnerabilities.

I have not updated Firefox in a long time and have no intention of doing so any time soon.

[SiliconWizard]

It's not OS issue. Using Linux will not resolve OP's problem... he must disable auto updates...

I don't think so. I use Linux Mint and have the OS to only update manually and it will offer Firefox updates but I can install them whenever I want. I do not think it can do it without me inputting the password.

Of course it can't, unless the application was running as root. If you use Linux and you use root as your user account - or set up a user account with equivalent rights - you just deserve what you get.

Another possibility would be if the application was installed not "system-wide" but locally. That would be relatively uncommon, especially for an application that has a distro package on all distributions that I've ever run into.
For people with such a setup, I'd be curious to know the details, please.

Note that on Windows, Firefox (and Thunderbird) resort to an awful trick to allow self-updating (whether automatically or not) *without asking for an admin password*.
They install a service (by default) that basically allows bypassing UAC for the Mozilla products. How sweet.
So If you have ever wondered why Firefox was one of the very rare apps that never asked for a password for updating, now you know.

This service can be disabled of course, but you have to go to the administrations tools and manually disable it.
How sweet from Mozilla, they probably wanted to "lower any friction" to the use of their web browser, as they say in marketing.

I'm personally a long time user of Firefox because it just works for me and is still one of the best for privacy. Also I want to encourage alternatives to the Chrome monopoly.
But the attitude of the Mozilla foundation, unfortunately, I find more and more unacceptable.

[kjpye]

It's not OS issue. Using Linux will not resolve OP's problem... he must disable auto updates...

I don't think so. I use Linux Mint and have the OS to only update manually and it will offer Firefox updates but I can install them whenever I want. I do not think it can do it without me inputting the password.

The problem I have with Firefox on Linux (provided by the distribution) is that even when Firefox is not updated, if you are patching a live system, and there should be no reason not to, is that it often will decide to stop working and require you to restart it. If you fire up a new tab and try to open something in it, Firefox will give you an error message and prompt you to restart. In existing tabs it may just stop working with no indication of why.

While the restart will remember what you had open, any entry into a tab will be lost. If you have live windows of some sort you will lose whatever state they had, and whatever you had tried to open will be forgotten, even if it's some sort of complicated URL or query.

Most annoying.

[AnnaWatts]

Ohh thx for sharing with this. Needy for me

[tridac]

Works perfectly, thanks...

[lezginka_kabardinka]

No one uses Firefox 🤣
Registry? Gosh you guys are trapped in 1998

[tridac]

Windows is here on sufferance, but still needed for some apps and the server versions have far better system management tools the the domestic versions...

[Davy]

Rather than try a new thread thought I'd ask here since it's related-:

I've done the registry hack and in the update window it say's Firefox updates disabled by your administrator, so all appears well and good here in my application. My question is-:

I still get update download in the hidden Firefox datafolder, can I forget about these and can you confirm they will not be applied? There's usually a Update lock, the update file and a profile file.... deleting the entire lot stopped me from getting the update.

Can I forget about these files now I've applied the registry hack, they won't start filling the folder will they? I've been deleting them since I applied the registry hack.

Thanks Dave

[tom66]

Rather than try a new thread thought I'd ask here since it's related-:

I've done the registry hack and in the update window it say's Firefox updates disabled by your administrator, so all appears well and good here in my application. My question is-:

I still get update download in the hidden Firefox datafolder, can I forget about these and can you confirm they will not be applied? There's usually a Update lock, the update file and a profile file.... deleting the entire lot stopped me from getting the update.

Can I forget about these files now I've applied the registry hack, they won't start filling the folder will they? I've been deleting them since I applied the registry hack.

Thanks Dave

Please ... why are you disabling updates.  Just don't.  There are huge security implications.

[soldar]

It's not OS issue. Using Linux will not resolve OP's problem... he must disable auto updates...

Nope. Here is the screen capture of three programs I do not update with Linux Mint. Every update needs my authorization and is done whenever I choose.

EDit: I just realized it is an old thread and I had already responded.

[Davy]

Oh dear...... I'll try asking elsewhere!

@Tom66
I'm not asking about Firefox updates I want to STOP THE DEVIL! I am not wanting to be a guinea pig for Firefox for starters, I do have 'MY' reasons.

Dave

[m12lrpv]

Please ... why are you disabling updates.  Just don't.  There are huge security implications.

No there aren't. The days of serious exploits are long gone. Take the hysteria elsewhere.

Even the minor security holes that do exist aren't genuinely exploitable to the degree you imply. Security updates just appear so companies can claim they're looking after your security.

The constant updates BS comes from dev companies not wanting to support lots of different versions which in all fairness as a dev for 30 plus years it's understandable.

Rather than try a new thread thought I'd ask here since it's related-:

I've done the registry hack and in the update window it say's Firefox updates disabled by your administrator, so all appears well and good here in my application. My question is-:

I still get update download in the hidden Firefox datafolder, can I forget about these and can you confirm they will not be applied? There's usually a Update lock, the update file and a profile file.... deleting the entire lot stopped me from getting the update.

Can I forget about these files now I've applied the registry hack, they won't start filling the folder will they? I've been deleting them since I applied the registry hack.

Thanks Dave

They won't apply... or at least they never have for me.

[Monkeh]

Please ... why are you disabling updates.  Just don't.  There are huge security implications.

No there aren't. The days of serious exploits are long gone. Take the hysteria elsewhere.

And energy is free and world peace has been achieved.

[soldar]

No there aren't. The days of serious exploits are long gone. Take the hysteria elsewhere.

I am with you on this. There are three programs I do not update any more and have not updated them in years.
Firefox, Thunderbird and Brave. All three
(1) want to update way too frequently,
(2) are massive, not just a small patch, they reinstall the whole thing and I am on a metered data connection with several computers, no way and
(3) they change things in the GUI and often cause other problems or annoyances.
Nope. I am not updating.

I see no need to change things in the GUI and I get the impression this is pretty much all they are doing to justify their existence.
If they need to patch security holes every few days it means it is really crappy software and software writers. Screw them.
I have never had a malware issue. I'll take that risk.
I will continue to not update.

[tom66]

Please ... why are you disabling updates.  Just don't.  There are huge security implications.

No there aren't. The days of serious exploits are long gone. Take the hysteria elsewhere.

Even the minor security holes that do exist aren't genuinely exploitable to the degree you imply. Security updates just appear so companies can claim they're looking after your security.

The constant updates BS comes from dev companies not wanting to support lots of different versions which in all fairness as a dev for 30 plus years it's understandable.

Not even slightly true.  CVE-2023-4863 was released only out about 6 months ago, and that allows for heap buffer overflow, which allows for session keys, credit card info, saved passwords etc to be stolen from a running browser by using a modified WebP image!  (This impacts all browsers.)  It also allows for malicious code to be embedded into your browser creating the possibility of exploits like stealing bank details by forging a login page and SSL authentication.

https://nvd.nist.gov/vuln/detail/CVE-2023-4863

There will be others, humans are not infallible when it comes to software.  If you do not keep your software up to date, you are explicitly acknowledging that you will be vulnerable to third party attack from sophisticated organisations.  Now, if you think that is an acceptable risk, that is YOUR risk, but others should not do this unless they are absolutely certain they can tolerate this risk. 

You can use an Extended Support Release from Firefox if you are concerned about appearance changes to the software but still need to maintain security updates.

[EPAIII]

I don't understand. I have used Firefox and Thunderbird for years and have had almost no problems.

What is everyone doing that causes such a ruckus?

[soldar]

I don't understand. I have used Firefox and Thunderbird for years and have had almost no problems.

What is everyone doing that causes such a ruckus?

While I am with you in principle I find your argument, which is widely used, to be quite poor. It is the same as "I have never made backups and I have never had a problem".

We need a bit more profound risk analysis.
What is the cost (effort, etc) of implementing security measures?
What is the cost if the bad things happen?
What is the probability of those things happening?  Etc.

There is always an element of prevention, an element of risk, etc and you have to weigh everything.

I have used PCs since before the Internet days. I have never, ever, used any kind of antivirus software. I have never, ever, had any malware. I have been very careful with my practices. I have always been reasonable good at having backups.

When software is released so full of vulnerabilities and has to be updated so frequently to me it means the makers are being very careless and maybe should be subject to civil liability when their software causes damages. That would probably change things for the better. It is very shoddy software if it has to be updated so often for security.

In my case I have decided to not update the browsers for the reasons I have stated above. The risk for me is minimal and the hassle is just not worth it.

But maybe for someone with nuclear codes which could start WW3 in their computer the case is different. It's not my case though.

[tom66]

When software is released so full of vulnerabilities and has to be updated so frequently to me it means the makers are being very careless and maybe should be subject to civil liability when their software causes damages. That would probably change things for the better. It is very shoddy software if it has to be updated so often for security.

I disagree with this statement.  If you look at what a web browser did 20 years ago, that was...
* decode SGML markup
* maybe parse basic CSS
* limited or no JavaScript support
* limited image file formats
* only HTTP

Now what does a web browser have to do?
* XHTML + HTML 4.0 support + SVG, XSL, JSON and others
* video decoding in multiple formats (YouTube, Netflix, etc.) (WebM encapsulation, codecs AV1, VP9, H264/H265... up to 4K rendered on graphics cards directly)
* multiple types of new file formats, such as WebP, JPEG2000, MNG/APNG...
* support a vastly more complicated HTML and CSS standard
* support complex JavaScript environments including JIT compilation
* support vastly more protocols such as HTTP2.0,  HTTPS,  multiple new forms of SSL (TLS 3.0), async HTTP requests and so on

There is a much larger attack area.  This is necessary to support the modern web.  If you do not want these features that is fine, but you would need to disable them or find a very old secure build of Firefox or something that did not have them.  This would probably break most of the things you use on the internet.

Many older browsers did have serious security flaws.  For instance, IE5.5 had a bug in it which allowed remote code execution via a maliciously crafted PNG image.  It took Microsoft ages to patch that.  Companies, including Microsoft, are far better now.  For instance in shared libraries they cooperate to disclose a fix at the same time to avoid an attacker having the opportunity to exploit one system before others have had a chance to patch it.

The modern way is not to necessary exploit your system to put an annoying virus on it, either.  Some exploits can be essentially hidden and be used to exfiltrate data such as passwords or CC data to a server somewhere. 

The idea of attaching any civil liability to free open source software is laughable in the courts.  If you read the GPL, the "No Warranty" part is very clear, it is literally in all caps.  Nonetheless, even commercial software usually excludes liability for losses.  Only in B2B services do you tend to find liability put on the supplier, but you can bet that will be baked into the cost of the software and service.

[soldar]

When software is released so full of vulnerabilities and has to be updated so frequently to me it means the makers are being very careless and maybe should be subject to civil liability when their software causes damages. That would probably change things for the better. It is very shoddy software if it has to be updated so often for security.

I disagree with this statement.  If you look at what a web browser did 20 years ago, that was...
* decode SGML markup
* maybe parse basic CSS
* limited or no JavaScript support
* limited image file formats
* only HTTP

Now what does a web browser have to do?
* XHTML + HTML 4.0 support + SVG, XSL, JSON and others
* video decoding in multiple formats (YouTube, Netflix, etc.) (WebM encapsulation, codecs AV1, VP9, H264/H265... up to 4K rendered on graphics cards directly)
* multiple types of new file formats, such as WebP, JPEG2000, MNG/APNG...
* support a vastly more complicated HTML and CSS standard
* support complex JavaScript environments including JIT compilation
* support vastly more protocols such as HTTP2.0,  HTTPS,  multiple new forms of SSL (TLS 3.0), async HTTP requests and so on

There is a much larger attack area.  This is necessary to support the modern web.  If you do not want these features that is fine, but you would need to disable them or find a very old secure build of Firefox or something that did not have them.  This would probably break most of the things you use on the internet.

Many older browsers did have serious security flaws.  For instance, IE5.5 had a bug in it which allowed remote code execution via a maliciously crafted PNG image.  It took Microsoft ages to patch that.  Companies, including Microsoft, are far better now.  For instance in shared libraries they cooperate to disclose a fix at the same time to avoid an attacker having the opportunity to exploit one system before others have had a chance to patch it.

The modern way is not to necessary exploit your system to put an annoying virus on it, either.  Some exploits can be essentially hidden and be used to exfiltrate data such as passwords or CC data to a server somewhere. 

The idea of attaching any civil liability to free open source software is laughable in the courts.  If you read the GPL, the "No Warranty" part is very clear, it is literally in all caps.  Nonetheless, even commercial software usually excludes liability for losses.  Only in B2B services do you tend to find liability put on the supplier, but you can bet that will be baked into the cost of the software and service.

Well, there would be a lot that could be said and discussed.

I would put security first. If you cannot do it securely then don't do it. And this goes not only for the browsers but for the web sites and servers themselves. Do not use unsafe technology until proven it can be used safely.

The legal aspect of liability is complicated. First because different countries have different legal systems that work in different ways, based on different principles.

In general terms, just because a product is free does not mean it is free from all liability. In America, under contract law, there has to be consideration for there to exist a contract so, yes, you cannot sue for contract. But there may be other avenues. Even with no contract between parties there may exist a Duty of Care the breach of which is the tort of negligence which creates a cause of action for remedy.  If I invite a person onto my property, for free, I have a duty of care and if this person suffers an accident which the courts determine to be caused by my negligence then I would be liable. Negligence and liability would probably be construed even more strictly for a commercial product than for a home owner. Note that even uninvited persons and even burglars can sue for damages. If I have a swimming pool I have the duty of preventing accidents and if the neighbor's child falls in and drowns, even though I did not invite him, I would be found liable for not taking measures to prevent it. 

Also I would be liable for any damages caused by my automobile even if I am not driving it, even if it was stolen from me. The fact that I had no contract with the person who suffered the damage does not absolve me from liability.

I would allege that the maker of software, even if given for free, has a duty of care to the user, maybe not of great care but of ordinary care and the software manufacturer does indeed bear responsibility and liability if the user suffers damages in the ordinary use of the product. The fact that the user does not pay them directly but indirectly, as a class, does not diminish the fact that they are making money by providing a product to the public and they have a duty of care.

It is not as simple and easy as simply putting a disclaimer in the conditions. Those have been held to be invalid many times and on may grounds.

In Spain it is much simpler. The law is whatever the judge says it is and whatever the judge interprets. It is a lottery where anything can happen depending on the point of view and sympathies of the judge. Expensive lawyers can most often make the judge "see things my way" but some times a judge will just take pity on "the little guy" and rule in his favor even if it makes no sense in legal terms.

It's complicated and that's why lawyers make good money.

[tom66]

Well, there would be a lot that could be said and discussed.

I would put security first. If you cannot do it securely then don't do it. And this goes not only for the browsers but for the web sites and servers themselves. Do not use unsafe technology until proven it can be used safely.

Security is paramount in the development of modern software.  Most of the unit tests done on software today are intending to detect crashes and security violations. Nonetheless, there are still areas that are missed, because developers are not infallible.  Bugs are found in old software all the time.

Do be aware that the organisations that are finding these vulnerabilities are often nation-states or large criminal gangs.  Think about Stuxnet, it used four zero-day attacks to get into Iranian systems in an attempt to damage centrifuge hardware.   It was likely developed by the US and possibly Israel. A zero-day, if you were not aware, is a vulnerability not previously disclosed to the public, so developers have no time at all to fix it before it is exploited.  These are very rare (and extremely valuable to bad guys); most bugs *are* caught before they are actively exploited, but once they have been patched, all systems must be updated in order to protect them against exploitation of the now public vulnerability.  Attackers will start as soon as a patch is dropped, which is why coordinated disclosure is such a big deal, so all systems can be patched as quickly as possible.  It is literally an arms race.

Now, you could ask: should we never disclose source code so vulnerabilities cannot be discovered?  This has long been an argument against open source software but it is unconvincing.  Windows has as many if not more severe bugs than Linux does yet the source is proprietary.  There are many other examples and in general open source software is regarded as at least as secure if not more so than closed source software.  Many friendly eyes and a few bad eyes are better than no friendly eyes at all and someone who is dedicated enough to reverse engineer software to exploit it.

The legal aspect of liability is complicated. First because different countries have different legal systems that work in different ways, based on different principles.

In general terms, just because a product is free does not mean it is free from all liability. In America, under contract law, there has to be consideration for there to exist a contract so, yes, you cannot sue for contract. But there may be other avenues. Even with no contract between parties there may exist a Duty of Care the breach of which is the tort of negligence which creates a cause of action for remedy.  If I invite a person onto my property, for free, I have a duty of care and if this person suffers an accident which the courts determine to be caused by my negligence then I would be liable. Negligence and liability would probably be construed even more strictly for a commercial product than for a home owner. Note that even uninvited persons and even burglars can sue for damages. If I have a swimming pool I have the duty of preventing accidents and if the neighbor's child falls in and drowns, even though I did not invite him, I would be found liable for not taking measures to prevent it.

It really isn't that complicated.  The GPL and other free software licenses are quite clear.  Here is the GPL 3.0's section on warranties and liability:
 

15. Disclaimer of Warranty.
THERE IS NO WARRANTY FOR THE PROGRAM, TO THE EXTENT PERMITTED BY APPLICABLE LAW. EXCEPT WHEN OTHERWISE STATED IN WRITING THE COPYRIGHT HOLDERS AND/OR OTHER PARTIES PROVIDE THE PROGRAM “AS IS” WITHOUT WARRANTY OF ANY KIND, EITHER EXPRESSED OR IMPLIED, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. THE ENTIRE RISK AS TO THE QUALITY AND PERFORMANCE OF THE PROGRAM IS WITH YOU. SHOULD THE PROGRAM PROVE DEFECTIVE, YOU ASSUME THE COST OF ALL NECESSARY SERVICING, REPAIR OR CORRECTION.

16. Limitation of Liability.
IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN WRITING WILL ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MODIFIES AND/OR CONVEYS THE PROGRAM AS PERMITTED ABOVE, BE LIABLE TO YOU FOR DAMAGES, INCLUDING ANY GENERAL, SPECIAL, INCIDENTAL OR CONSEQUENTIAL DAMAGES ARISING OUT OF THE USE OR INABILITY TO USE THE PROGRAM (INCLUDING BUT NOT LIMITED TO LOSS OF DATA OR DATA BEING RENDERED INACCURATE OR LOSSES SUSTAINED BY YOU OR THIRD PARTIES OR A FAILURE OF THE PROGRAM TO OPERATE WITH ANY OTHER PROGRAMS), EVEN IF SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES.

As far as I am aware, no one has ever successfully sued a free software developer for a defect in their software, even without clauses disclaiming liability.

As for commercial software you may be correct as to there being liability.  In the past this has resulted in class action suits where the supplier might end up refunding the cost of the software to users.  Microsoft for instance has lost a number of those class action suits.  I don't think it has substantially improved their security approaches. 

Also I would be liable for any damages caused by my automobile even if I am not driving it, even if it was stolen from me. The fact that I had no contract with the person who suffered the damage does not absolve me from liability.

In this case, you have placed a vehicle onto the public road and are legally responsible for it.

It is your decision to use open source software and no one is forcing you to use it, so I cannot see how this argument can apply.

I would allege that the maker of software, even if given for free, has a duty of care to the user, maybe not of great care but of ordinary care and the software manufacturer does indeed bear responsibility and liability if the user suffers damages in the ordinary use of the product. The fact that the user does not pay them directly but indirectly, as a class, does not diminish the fact that they are making money by providing a product to the public and they have a duty of care.

Most open source developers work on software as a hobby. What you are suggesting would kill open source software for good.  It would create a chilling effect since no one would want to risk being sued because of buggy software.  The author of the code that introduced the Heartbleed vulnerability, Robin Seggelmann, was just a PhD student at the time; senior reviewers for the software package, and many others, missed the bug for years to come.  It is not reasonable and fair to place the burden on any particular individual, especially given these guys are almost always unpaid.