NoScript Updates

NoScript 13.6.6

Sun, 08 Mar 2026 12:52:48 +0000

x [XSS] Fix false positives regression due to the MV3 WIP
  (issue #520)

NoScript 13.5.12

Sun, 01 Feb 2026 13:43:55 +0000

x Convert PNG images to WEBP
x [UX][Android] Improve support for increased font size
  configurations
x Make deploy2tor.sh default to latest unpacked firefox
  manifest.json
x [UX] Fix first selected preset not being focused
  automatically on popup opening (issue #506)
x Prevent mid-session updates on Android in global PMB
  (tor-browser#44398)
x [UX] Fix keyboard navigation regression (issue #506)
x [UX] Improved readability of focused icon buttons

NoScript 13.5.10

Sat, 17 Jan 2026 21:52:14 +0000

x [UX] Smoother popup initialization
x [UX] Scrolling area optimization
x [UX] Flickering reduction
x [UX] Various visual tweaks

NoScript 13.5.9

Wed, 14 Jan 2026 22:44:09 +0000

x Fix missing https-only icon regression (thanks Ingo
  Brückl for reporting)

NoScript 13.5.8

Tue, 13 Jan 2026 22:46:33 +0000

x Fix site label misalignment (thanks Ingo Brückl for
  reporting)

NoScript 13.5.7

Tue, 13 Jan 2026 14:48:05 +0000

x [nscl] Improved document freezing and CSP insertion
x Control manually navigated top-level data: URIs
  (tor-browser#44482)

NoScript 13.5.6

Tue, 06 Jan 2026 10:24:28 +0000

x file:// quirk mode compatibility, thanks peterbg for
  reporting
x Add option to disable automatic page reloading on
  permissions change (fixes issue #42)

NoScript 13.5.5

Thu, 25 Dec 2025 12:01:46 +0000

x [nscl] DocumentFreezer bug fixes and improvements (fixes
  #496)
x [nscl] Improved DocRewriter web compatibility (see
  tor-browser#44450)

NoScript 13.5.2

Mon, 08 Dec 2025 21:42:30 +0000

x [L10n] Updated zh_CN
x [UX] Fix minor issues with UI titles
x [nscl] Fix cascade restrictions causing empty capabilities
  (issue #492)

NoScript 13.5

Fri, 28 Nov 2025 10:04:02 +0000

x [UX] Show onboarding page on settings reset
x [l10n] Lowered Transifex merge threshold to 50%
x [L10n] Updated bn, br, ca, da, el, es, fa, ja, lt, ms, nb,
ro, sv_SE
x [UX] Scary styling for restrictions disablement option
x [UX] Turn on restrictions when a behavior is selected
x [UX] Zoom-in site classification behavior transition
x [L10n] Updated de, fi, fr, he, is, it, mk, nl, pl, pt_BR,
pt_PT, ru, sq, tr, uk, zh_CN, zh_TW
x [UX] Improved modifier button styling
x [UX] Colorized site classification behavior options
x [UX] Implement first install onboarding page
x [UX] Further behavior UI synchronization fixes (thanks
fatboy for reporting)
x [UX] Various style tweaks for Android
x Fixed autoAllowTop bug on Chromium
x [UX] Fixed some user-visible messages (thanks Tonnes for
reporting)
x [UX] Fix possible race condition on classification
behavior UI initialization (thanks fatboy for reporting)
x [UX] Classification behavior: improved code formatting and
synchronization
x [UX] Support links
x [UX] Added missing bidirectional UI synchronization step
x [UX] Complete classification behavior wiring
x [UX] Hide classification behavior UI in Tor/Mullvad
browsers
x [L10n] Updated de, fa, fi, fr, it, nl, pl, pt_BR, pt_PT,
ro, ru, sq, tr, zh_CN, zh_TW
x [UX] "Site Classification Behavior" (usability level)
selector
x [UX] Support multiple UI listeners
x [UX] Handle more media placeholder edge cases
x [UX] Localize capabilities in status tooltip
x [UX] Fix DEFAULT wrongly styled as canScript on unsafe
URLs
x [nscl] Fixed DomFreezer regression on first file:// load
due to onbeforescriptexecuted deprecation (thanks Anton K
for reporting)
x [L10n] Updated nl
x `build.sh +` automatically increments current version
x [UX] Always show the stricter top-level site match on top
of the list (thanks fatboy for suggestion)
x [UX] Do not show CASCADED label for DEFAULT entries
matching the top-level site
x [UX] More cascading permissions bug fixes
x [L10n] Multiple localization updates
x [UX] Improved visual feedback for cascaded permissions
(thanks fatboy for bug reporting)
x [UX] Cascading permissions frontend
x [nscl] [UX] Force artificial placeholders creation on
x.com even if no real media object is in the DOM
x [nscl] Cascading permissions support (backend)
x [nscl] Do not let AUTO-TRUSTED override policies other
than DEFAULT
x [L10n] Updated de, fr, ru
x [UX] Fixed theme configuration caching bug
x [UX] Fix AUTO-TRUSTED preset titles
x [UX] Improved UI labeling for automatically trusted
top-level sites
x [L10n] Updated it
x Imported settings version migration support
x Export settings metadata and versioning support
x Mitigate x-load protection affecting file:// documents
load times (issue #455, thanks Meludall for patch)
x [UX] Better handling of clicks on obstructed placeholders
x [UX] More concise and compact placeholders
x [UX] Include all the suppported capability types in the
  tooltip blocked/used report

NoScript 13.2.2

Mon, 20 Oct 2025 20:45:07 +0000

x Work-around for issue #462
x [L10n] Updated fr, pl, zh_CN
x Resolve implicit dependencies from createHTMLElement()
x [Android] Erase temporary permissions when all the tabs
  closed (issue #464)
x [Android] Make NoScript Options' top buttons fit in one
  row
x Typo in comment in LifeCycle.js

NoScript 13.2.1

Wed, 08 Oct 2025 15:25:21 +0000

x Fix bugs with Tor Browser unknown capabilities handling
x Work-around for Tor Browser Security Levels not being
  aware yet of the wasm capability
x [nscl] Make wasm usage attempt notification
  Chromium-compatible
x [L10n] Updated de, ru, tr

NoScript 13.1

Tue, 07 Oct 2025 21:12:10 +0000

x New wasm capability to control WebAssembly per site
x [L10n] Updated is, pt_BR
x Adopt the Chromium prefetch CSS CORS work-around on Gecko
  (torbrowser#44239 fix)
x Best effort to avoid extra temporary tabs for sidebar
  detection

NoScript 13.0.9

Wed, 13 Aug 2025 17:18:01 +0000

x [UX] Increase contrast for non-HTTPS site labels in dark
  mode (thanks Soothsayer for reporting)
x [L10n] Updated he, pl, tr, uk
x [Tor] Align Tor/Mullvad Browser integration logic and UI
  with "persistent mode" (mullvad-browser#455)
x Switch to ?. operator and tidy up surrounding code

NoScript 13.0.8

Tue, 27 May 2025 13:57:53 +0000

x Reduce annoyances and false positives from sidebar content
  detection (issue #444)
x Fix automatic top level trust conflict with existing
  contextual policies (issue #441)

NoScript 13.0.6

Mon, 19 May 2025 14:18:34 +0000

x Use frameAncestors whenever possible for top URL
  retrieving
x Automatic reload on permissions change for promiscuous
  tabbed/tab-less sites
x [UX] Avoid creating extra tabs for sidebar measurement
  when possible
x [L10n] Updated ru
x [UX] Best effort to hide/show tab-less sites depending on
  the statusbar visibility
x Fix always set parent entry of temporary contextual
  policies created from DEFAULT to temporary (issue #440,
  thanks SandboxerX86 for reporting)
x [UX] Permissions UI support for tab-less (e.g. sidebar)
  content (issue #429)
x [Chromium] Prerendered frame support in context policies
  enforcing
x Fix some automatic top-level TRUST bugs (issue #437)
x Discard "zombie" prompts from the backlog
x Honor restrictions disablement for x-load checks
x [UX] Improved UX for file:// contextual permissions
  (issue#435)
x [nscl] Harmonize file:// URLs parsing and matching across
  Gecko and Chromium
x [XSS] Prevent false positives from the uptain.de
  e-commerce back-end
x More consistent contextual permission checks
x Fixed click to play sometimes broken for file:/// URLs
x Fixed automatic temporary permissions require reload
  (thanks scottg for reporting)

NoScript 12.6

Tue, 06 May 2025 12:19:14 +0000

x Make contextual policies override restriction cascading
  (tor-browser#43397)
x [Chromium] Fix 12.5.9xx prompt closure regression
x [Chromium] Full x-load checks Chromium support
x Better offscreen placeholders for x-load
x [l10n] [Chromium] Make x-load capability localization
  Chromium-compatible
x [L10n] Updated de, fr, he, ru, tr zh_CN
x [UX] Honor non-contextual x-load capability granted from
  NoScript Options (thanks barbaz for RFE)
x Prevent data: URIs from messing with srcset parsing
  (thanks fatboy for reporting)
x Regard as "mutually safe" for x-load directories sharing a
  common ancestor
x [UX] Make x-load capability visible for CUSTOM file:
  entries in NoScript Options (thanks barbaz for RFE)
x [UX] Fixed prompt window leaks (tor-browser#43281)
x [UX] Make object unblocking temporary and contextual by
  default, with choices in the prompt
x [nscl] Option to clone Permissions without context
x Always honor the "Collapse blocked objects" option
x Refactor top-level auto-trust and make it contextual
  (issue #417)
x [nscl] Remove noisy debug statement
x [UX] UI support for extra floating capabilities (x-load)
x Integrate event handlers suppression with blocking if
  needed (thanks Adithya Suresh Kumar for reporting)
x [nscl] Refactor xray proxification
x Fix incorrect assumptions about some DOM element
  properties reflecting URLs (thanks Adithya Suresh Kumar
  for reporting)
x [nscl] Fix race condition between multiple extensions
  using MV3/DNR SyncMessage (JShelter#146, thanks polcak for
  reporting)
x Suppress some event handlers (tor-browser#43491, thanks
  Adithya Suresh Kumar for reporting)
x [build] Publish XPIs only after their signed
x [build] Improved version bump commit logic

NoScript 12.1.1

Fri, 03 Jan 2025 17:16:35 +0000

x Fix automatic reloading broken if the background script /
  service worker is not already initialized on UI load
x Re-enable signing logging

NoScript 12.1

Sat, 28 Dec 2024 00:14:43 +0000

x [nscl] Improved work-around for Youtube placeholder
  displacement (tor-browser#43296)
x [L10n] Updated pl
x Avoid synchronous policy fetching if document is already
  complete (e.g. on extension updates)
x Remove more MV3-only entries from MV2 manifest
x Remove pre-release version check on signing
x More informative debug logging
x Fixed misplaced update_url in development builds (thanks
  DJ-Leith for reporting)
x Switch Firefox development build version format to *.9xx
  (like Chromium)
x Cross-browser and cross-manifest compatibility down to
  Gecko 115
x Improved cross-browser and cross-manifest development and
  build ergonomics
x Fixed RequestGuard on Firefox still using CSP.blocks() as
  an instance method
x Improved cross-browser and cross-manifest support
x Do not reload affected tabs before saving XSS user
  choices, if any
x [nscl] Several performance and reliability enhancements
  from NSCL
x [nscl] Updated to latest NoScript Commons Library
x Fixed offscreen placeholder container preventing user
  interaction on the left of placeholders
  (tor-browser#43282)
x Fix localization-related console spam when opening options
  panel (tor-browser#43269)
x Fixed offscreen placeholder container preventing user
  interaction on the left of placeholders
  (tor-browser#43282)
x Fix localization-related console spam when opening options
  panel (tor-browser#43269)

NoScript 11.5.2

Wed, 06 Nov 2024 16:35:24 +0000

x [tor-browser#43257] More efficient, flexible and
  race-resistant placeholder styling

NoScript 11.5.0

Mon, 28 Oct 2024 20:54:25 +0000

x [tor-browser#32668] Use the Security Level as the default
  policy for Options Reset on Tor Browser
x [tor] Stateless-compatible Tor Browser integration
x [L10n] Updated pt_BR
x Stateless-compatible temporary permissions
x Switch from deferWebTraffic to Wakening
x Stateless-compatibile TabGuard
x Switch to non-persistent background page
x [xss] Refactor for non-persistence
x Removed Fennec-specific code
x Bump min Gecko compatibility to 115.0 (stateless
  background script support)

NoScript 11.4.42

Wed, 09 Oct 2024 09:35:17 +0000

x [nscl] Further SyncMessage simplification
x Mitigate race conditions on startup

NoScript 11.4.40

Sat, 28 Sep 2024 15:16:21 +0000

x [nscl] Fix patched workers failures caused by Firefox
  webRequest filters disconnect() breaking on large files
  (thanks barbaz for reporting)

NoScript 11.4.37

Tue, 10 Sep 2024 14:50:36 +0000

x [nscl] Do not patch windows with WebGLHook if webgl is
  globally disabled
x [nscl] Do not patch workers if webgl is globally disabled
x [L10n] Updated uk
x [nscl] Workers-aware WebGL Hook

NoScript 11.4.35

Wed, 28 Aug 2024 15:08:37 +0000

x Improved lazy_load capability (optimization and
  notification)
x [nscl] Slight optimization of NOSCRIPT element emulation
  loop
x Automatically add extra capabilities to policyTypesMap
x Gracefully handle new capabilities still unknown to the
  settings host (e.g. Tor/Mullvad browser), if any
x Configurable "lazy_load" capability (see
  https://github.com/whatwg/html/issues/5250)
x Prefetch all CSS subresources (1st party included) in
  private contexts where both unchecked_css and scripting
  capabilities are disabled
x Forcibly neutralize lazy loading attributes when scripting
  is disabled
x [nscl] Restored SyncMessage compatibility with Firefox 78
  and below
x Lock nscl version on stable releases
x [L10n] Updated de, fr, tr, ru, uk, zh_CN

NoScript 11.4.34

Thu, 08 Aug 2024 07:19:07 +0000

x [nscl] Work around for
  https://bugzilla.mozilla.org/show_bug.cgi?id=1899786
  (issue #372)
x [L10n] Updated de, ru, tr
x Synchronize nscl git commits as needed before tagging new
  versions

NoScript 11.4.31

Thu, 18 Jul 2024 11:54:03 +0000

x [L10n] Updated fr, is, ru, zh_CN
x Improved release tooling
x [nscl] Updated to latest NoScript Commons Library
x NoScript Options/Appearance/Show synthetic placeholders
  for invisible capability probes (issue #369)
x [nscl] Make placeholders easier to style per type
x Prevent duplicate synthetic placeholders for invisible
  capability probes (issue #369)

NoScript 11.4.30

Sat, 13 Jul 2024 05:47:42 +0000

x [nscl] Best effort WebGL placeholders for offscreen
  capability detection
x Improved blocked but required capability reporting from
  subframes (issue #367)
x [nscl] Include SVG among embedding document types (fixes
  issue #366)
x Removed obsolete "applications" manifest.json key

NoScript 11.4.29

Tue, 12 Dec 2023 10:52:09 +0000

x [nscl] Updated TLDs
x [nscl] Improved reliability of TLD updater
x Removed theme.js console noise
x Fix beta channel updates breakage due to
  browser_specific_settings override
x [nscl] Several content-side performance improvements
x Reduce synchronous policy retrieval impact on file: and
  ftp: document loading performance
x More commands for which a keyboard shortcut can be
  configured
x [L10n] Updated de, fi, mk, nl, pl, ru, sq, tr, uk,
  pt_BR, zh_CN, zh_TW
x Explicit Android compatibility declaration

NoScript 11.4.28

Tue, 10 Oct 2023 11:27:03 +0000

x Prevent URL leaks from media placeholders (thanks NDevTK
  for report)
x [nscl] Support for in-tree TLDs updates

NoScript 11.4.27

Wed, 13 Sep 2023 07:40:20 +0000

x [XSS] Better specificity of HTML elements preliminary
  checks
x [XSS] Better specificity of potential fragmented injection
  through framework syntax detection (thanks Rom623, barbaz
  et al)
x [nscl] RegExp.combo(): RegExp creation by combination for
  better readability and comments
x [nscl] Replaced lib/sha256.js with web platform native
  implementation (thanks Martin for suggested patch)
x [nscl] Fixed property/function mismatch (thanks Alex)
x Fixed operators precedence issue #312 (thanks Alex)
x [nscl] Prevent dead object access on BF cache (thanks
  jamhubub and mriehm)

NoScript 11.4.26

Tue, 25 Jul 2023 11:19:50 +0000

x [Android] Fixed regression preventing NoScript prompts
  from being shown
x [XSS] Fallback to execute most demanding regular
  expressions asynchronously
x [XSS] Removed obsolete Flash-related checks
x [XSS] Make InjectionChecker's regular expressions easier
  to debug
x [XSS] Updated OpenID regexp

NoScript 11.4.25

Wed, 12 Jul 2023 18:34:03 +0000

x Reload extension on fatal failures
x [Android] Fixed UI styling regression
x Fixed UI inconsistencies when finer-grained contextual
  policies are created/imported by other means (thanks
  barbaz for reporting)

NoScript 11.4.24

Thu, 29 Jun 2023 17:03:40 +0000

x [XSS] Fix Base64 hash checks interfering with query string
  checks (thanks barbaz for reporting)
x [TabGuard] Stop exempting domains bidirectionally by
  default
x [TabGuard] Fix destination domain being reported as the
  trigger of a warning prompt when all the other tab-tied
  domains have been exempted (thanks barbaz for report)

NoScript 11.4.22

Thu, 18 May 2023 09:11:23 +0000

x [L10n] Updated uk
x Consistently apply DEFAULT policy to top-level data: URLs

NoScript 11.4.21

Wed, 05 Apr 2023 20:00:45 +0000

x Fixed mislabeled Tor Browser settings override option
x [L10n] Updated mk

NoScript 11.4.20

Tue, 21 Mar 2023 12:07:03 +0000

x Generalized prompt safety hooks
x Better blob: URL support

NoScript 11.4.18

Fri, 03 Mar 2023 15:03:34 +0000

x [Firefox on Linux] Fixed detached window UI gets closed
  when its decoration is clicked (thanks richard for
  reporting)

NoScript 11.4.16

Mon, 13 Feb 2023 09:54:39 +0000

x [L10n] Updated de, nl, pl, ru, sq, zh_CN
x Always open the windowed standalone UI when invoked from
  the Alt+Shift+N shortcut
x Alt+Shift+Space shortcut to toggle restrictions
  enforcement for current tab (issue #129, thanks PF4Public
  for RFE)

NoScript 11.4.15

Tue, 31 Jan 2023 09:14:21 +0000

x Use the actual browser's brand name for Tor Browser
  derivatives
x Always open the windowed standalone UI when invoked from
  the contextual menu (thanks ZeroUnderscoreOu for
  reporting)

NoScript 11.4.14

Tue, 03 Jan 2023 14:54:49 +0000

x Updated HTML event attributes list
x Uniformed indexed directory Firefox UI emulation to
  prevent a script blocking bypass on file:// resources
  (thanks RyotaK for reporting)
x Fixed error being logged in the console on scriptless
  pages when hitting [Delete] or [Backspace] (thanks barbaz
  for reporting)
x Work-around for background page misteriously being
  unloaded sometimes by Firefox
x [L10n] Updated Transifex configuration

NoScript 11.4.13

Tue, 22 Nov 2022 10:17:17 +0000

x Ensure theme changes are synchronized across windows,
  including private ones (thanks barbaz for reporting)
x [UI] Ensure prompts are always centered relative to the
  parent window in multi-monitors setups
x Switch to "Modern Red Evil" icon contributed by fatboy
x Work-around for Chromium unable to load the placeholder
  icon
x Themed placeholders
x [nscl] Fixed placeholder fallback styles on Gecko
  embedding documents
x [L10n] New Romanian (ro) locale (thanks Simona Iacob and
  Inpresentia I.)

NoScript 11.4.12

Tue, 15 Nov 2022 12:04:15 +0000

x [L10n] Updated is, mk
x [L10n] New Finnish (fi) locale (thanks RJuho, olavinto and
  ricky.tigg)
x [L10n] New Ukrainian (uk) locale (thanks Kataphan, MuS and
  uniss)
x [L10n] New Persian (fa) locale (thanks voxp and magnifico)

NoScript 11.4.11

Wed, 14 Sep 2022 21:20:11 +0000

x Fix broken NoScript dialogs when
  browser.privatebrowsing.autostart = true (issue#259,
  thanks foenix for reporting)
x Avoid using fallback origins for main_frame loads

NoScript 11.4.10

Thu, 01 Sep 2022 10:47:22 +0000

x [TabTies] Cascade and merge ties in a shared pool, to
  prevent them from being cut by closing a middle tab
  (thanks NDevTK for reporting)
x Extended origin normalization to top-level documents
  (thanks NDevTK for reporting)
x [TabGuard] Fixed regression in about:blank handling
  (thanks NDevTK for reporting)
x Better origin guess for requests from sandboxed iframes
  (thanks NDevTK for reporting)
x More precise tracking of implicit origins in tab URLs
x [nscl] Stricter criteria for cutting tab relations (thanks
  NDevTK for reporting)
x Use window.origin when fetching policies for inheriting
  special URLs (thanks NDevTK for reporting)
x Better build script compatibility

NoScript 11.4.9

Mon, 15 Aug 2022 11:17:14 +0000

x [L10n] Updated pl, tr, zh_CN
x [TabGuard] Abort the load when the warning dialog is
  closed by any mean except the OK button
x [TabGuard] Stricter criteria for cutting tab relations
  (thanks fatboy for reporting)

NoScript 11.4.8

Thu, 11 Aug 2022 14:39:41 +0000

x Cross-tab identity leak protection ("TabGuard", see
  tor-browser#41071, thanks barbaz and fatboy for testing)
x [TabGuard] Better request lifecycle management
x [L10n] Updated de, it, nl, ru, sq
x [l10n] Automatic pull for 100% completed translations only

NoScript 11.4.7

Mon, 08 Aug 2022 11:04:57 +0000

x [XSS] Fixed regression in invalid characters optimization
  causing false negatives (thanks Tsubasa for reporting)
x Minor build script enhancement

NoScript 11.4.6

Mon, 30 May 2022 10:51:33 +0000

x [nscl] Copy NOSCRIPT elements' attribute in emulated
  replacements (issue #238)
x [XSS] Correct for concurrency in timeout checks
x [UI] Flatter preset appearance
x [UI] Focus visual feedback adjustments
x Inclusion-time TLD updates
x Updated HTML events
x [L10n] Updated pl
x Opaque white for vintage lock icons
x [L10n] Updated is

NoScript 11.4.5

Tue, 19 Apr 2022 14:43:49 +0000

x Improved preset sizing
x Reduce toolbar bottom shaded line tickness
x [L10n] Updated he
x Various user-driven visual tweaks
x Fixed vintage icon brightness in automatic light mode
x Minor icon tweaks