Firefox 158.0 — the first minute without a single click
How we tested: a clean Debian 13 in a disposable container; source — package firefox 158.0~build2 from the vendor’s repository (https://packages.mozilla.org/apt). Run as a regular user on a virtual screen, 60 seconds, nothing clicked. 17.10.2026. Every network request and every file written was recorded; the code was not decompiled. The container was deleted afterwards.
Package SHA-256: 06a608dd092b0ba2c7cb436df259025ffd006b16126bf1c0ab8121e869fdbebc
Summary
| What we checked | Result |
|---|---|
| Built-in telemetry, crash reporting, analytics, ad SDKs | Mozilla Telemetry / Glean (usage statistics), Google Analytics (analytics), Meta / Facebook SDK (advertising) |
| Network requests in the first minute | 17 server names, plus 5 unnamed |
| Known trackers among the servers | Google (сеть доставки), Google APIs (сеть доставки) |
| Files written in the first minute | 300+ |
| The program ran the whole time | yes — process alive at the end |
What is built in
62 files (325 MB) were checked.
| SDK | Purpose | Found in |
|---|---|---|
| Mozilla Telemetry / Glean | usage statistics | usr/lib/firefox/crashreporter |
| Google Analytics | analytics | usr/lib/firefox/browser/omni.ja |
| Meta / Facebook SDK | advertising | usr/lib/firefox/browser/omni.ja |
Addresses of known trackers in the program’s files — addresses in code, not requests:
| Tracker | Addresses | Mentions |
|---|---|---|
sb-ssl.google.com, www.google.com, lens.google.com, safebrowsing.google.com | 94 | |
| Cxense | comcluster.cxense.com, adserver.cxad.cxense.com, s-adserver.cxad.cxense.com, adserver.sandbox.cxad.cxense.com | 20 |
| Microsoft Bing Ads | www.bing.com, bing.com | 16 |
| YouTube | www.youtube.com, mochitest.youtube.com | 13 |
www.reddit.com, reddit.com | 12 | |
| Google APIs | www.googleapis.com, safebrowsing.googleapis.com, update.googleapis.com, storage.googleapis.com | 8 |
www.instagram.com, platform.instagram.com | 8 | |
| TikTok | www.tiktok.com | 8 |
| Twitter/X | twitter.com, developer.twitter.com, platform.twitter.com | 6 |
www.facebook.com, developers.facebook.com | 6 | |
| Mail.ru | win.mail.ru, e.mail.ru | 5 |
| Google Static | www.gstatic.com, fonts.gstatic.com | 4 |
Where it connected
| Server | How | From second | Times | Known tracker |
|---|---|---|---|---|
accounts.firefox.com | connection | 12.6 | 2 | — |
aus5.mozilla.org | connection | 27.7 | 2 | — |
ciscobinary.openh264.org | connection | 30.3 | 1 | — |
classify-client.services.mozilla.com | connection | 13.1 | 3 | — |
cloudflare-dns.com | DNS lookup only | 8.7 | 1 | — |
content-signature-2.cdn.mozilla.net | connection | 9.5 | 1 | — |
example.org | DNS lookup only | 8.7 | 3 | — |
firefox-portal-detection.com | DNS lookup only | 7.5 | 3 | — |
firefox-settings-attachments.cdn.mozilla.net | connection | 8.3 | 13 | — |
firefox.settings.services.mozilla.com | connection | 7.2 | 3 | — |
ipv4only.arpa | DNS lookup only | 8.7 | 2 | — |
location.services.mozilla.com | connection | 6.5 | 1 | — |
normandy.cdn.mozilla.net | connection | 12.7 | 1 | — |
push.services.mozilla.com | connection | 9.3 | 2 | — |
services.addons.mozilla.org | connection | 36.3 | 1 | — |
update.googleapis.com | connection | 29.0 | 1 | Google APIs (сеть доставки) |
www.google.com | connection | 29.7 | 1 | Google (сеть доставки) |
151.101.129.91:80 | connection without a name (TCP) | 7.6 | 2 | — |
[2a04:4e42:600::347]:80 | connection without a name (TCP) | 8.7 | 1 | — |
[2a04:4e42::347]:80 | connection without a name (TCP) | 8.7 | 1 | — |
[2a04:4e42:400::347]:80 | connection without a name (TCP) | 8.7 | 2 | — |
[2a04:4e42:200::347]:80 | connection without a name (TCP) | 8.7 | 1 | — |
A DNS lookup is not yet a connection: the program looked up the server’s address. But the lookup itself is visible to the ISP and the DNS server.
What it wrote to disk
Folders the program wrote files to during the minute:
| Folder | Files |
|---|---|
~/.cache/mozilla | 195 |
~/.cache/mesa_shader_cache_db | 102 |
~/.cache/fontconfig | 2 |
~/.cache/dconf | 1 |
How to read this card
- This is the first minute after launch with no action at all: what the program does on its own. Normal use may involve more requests.
- A “built-in SDK” means the library’s code was found. It does not prove data transfer, and an address in the code is not a request.
- The review was made automatically using a single method. You can check any program yourself here.