Firefox 137 finally gets tab groups, address bar improvements, and more

Yesterday, Mozilla released Firefox version 137.0 for Windows, macOS, and Linux, introducing new features and some security fixes.

The headlining feature is the new built-in ability to organize and save tab groups. Prior to this, you had to use a third-party extension like Simple Tab Groups or Panorama View. Now, Firefox has caught up with Chromium-based browsers with native tab grouping.

Furthermore, the Firefox address bar now offers enhanced search functions, and the developers have again patched a number of security flaws. Firefox ESR and Tor Browser also got security updates.

Mozilla plans to release Firefox 138 on April 29, 2025.

What’s new in Firefox 137?

Following the introduction of vertical tabs in Firefox 136, Firefox 137 now offers the option of organizing tabs into groups. You can assign a name and color to each tab group, and you can close tab groups to be reopened again later. Both vertical tabs and tab groups have been among the most requested features for Firefox, especially as they’ve been available in other browsers like Chrome and Vivaldi for some time.

Mozilla’s developers have given the address bar a fresh makeover, too. In particular, they’ve revised the search functions. A standardized search button in the address bar now simplifies switching between search engines and search modes. Firefox recognizes whether you’re currently on a page with a search function and offers to use it and integrate it into Firefox. The address bar can now also be used as a calculator, similar to the Google search bar.

Not all new features are immediately available to all users. Some of them may only be rolled out gradually over the coming weeks.

Security updates in Firefox 137

Mozilla’s 2025-20 Security Advisory report shows at least eight fixed vulnerabilities in Firefox 137. Mozilla only gives a high risk rating for one of the entries among individual vulnerabilities reported by external researchers. For example, CVE-2025-3028 can lead to a use-after-free (UAF) vulnerability if JavaScript code runs while a page is being transformed by the XSLT processor.

There are also two summarized entries on internally discovered vulnerabilities, which also have high risk ratings. Exploitation of these vulnerabilities can lead to memory errors that can potentially be exploited to inject and execute arbitrary code. Mozilla doesn’t provide any information on the exact number of vulnerabilities covered here.

Updates for Firefox ESR and Tor Browser

Mozilla has updated its long-term versions Firefox ESR 128 and ESR 115 to patch vulnerabilities. At least three vulnerabilities have been closed in Firefox ESR 128.9.0 and exactly one in Firefox ESR 115.22.0, namely the UAF vulnerability CVE-2025-3028 mentioned above.

The updated Tor Browser 14.0.9 is based on Firefox ESR 128.9.0. An update for Tor Browser 13.5 to version 13.5.15 is also available if you’re running Windows 7 or 8.1 or macOS 10.13 or 10.14. This should make it clear that the Tor project is following Mozilla’s example and will continue to support the old operating systems at least until September.