Expired certificate caused Firefox add-ons to stop working on Friday; Mozilla has issued a fix for most issues, advises others not to try any workarounds
A small number of add-ons may be listed … Victoria Song / Gizmodo : Firefox Fixes Borked Extensions for Everyone but Legacy Users Catalin Cimpanu / ZDNet : Mozilla releases Firefox 66.0.4 with fix disabled add-ons issue Tara Seals / Threatpost : Tor Security Add-On Abruptly Killed by Mozilla Bug Venkat / Techdows : Firefox 66.0.4 update expected to release today, will re-enable disabled extensions Paul Ducklin / Naked Security : Mozilla bug throws Tor Browser users into chaos Malcolm Owen / AppleInsider : Mozilla issues Firefox fix following weekend of extension woes Ryan Maskell / WinBuzzer : Firefox 66.0.4 Releases with a Permanent Fix for Extension Issues Holly Brockwell / Engadget : Firefox pushes another update to fix its broken add-ons Ravie Lakshmanan / The Next Web : How this annoying, tiny glitch broke every Firefox extension Paul Hill / Neowin : Mozilla releases Firefox 66.0.4 which re-enables user extensions after muck-up Firstpost Tech : Mozilla rolls out fix for Firefox bug that disables all extensions without reason Mark Wyciślik-Wilson / BetaNews : Mozilla issues new Firefox update to fix add-ons problems and warns users not to try dubious workarounds Surur / MSPoweruser : Firefox 66.0.4 to fix Add-ons issue Marius Nestor / Softpedia News : Mozilla Releases Firefox 66.0.4 for PCs and Android to Fix Major Add-Ons Issue Ewdison Then / SlashGear : Firefox broke add-ons because it let a security certificate expire Catalin Cimpanu / ZDNet : Firefox add-ons disabled en masse after Mozilla certificate issue Lawrence Abrams / BleepingComputer : Firefox 66.0.4 Released With Fix for Disabled Addons Stephen Shankland / CNET : Second Firefox fix repairs broken browser extensions for more people EditorDavid / Slashdot : Second Firefox Fix Repairs Broken Browser Extensions For More People James Miller / TechSpot : Expired certificate broke all Firefox add-ons Kate O'Flaherty / Forbes : Firefox Extensions Are Broken — Here's What To Do (Updated) Tweets: @firefox : We're releasing an update to repair the add-ons, search engines & language packs that had been disabled! There are some issues we're still working on, but we wanted to get this release out and get your add-ons back up & running before Monday. @mozamo : We released Firefox 66.0.4 for Desktop and Android, as well as Firefox 60.6.2 ESR that re-enables extensions. For more information, please read the update on https://blog.mozilla.org/... Thank you for being patient with us! Thanks to everyone working on it! Ruben van Staveren / @rvstaveren : This is bad, if not just outrageous dangerous for people relying on the tor browser for their safety. https://twitter.com/... Stephen Shankland / @stshank : Mozilla released a new batch of @firefox fixes today to try to repair broken extensions. This fix is broader, helping Android and ESR versions of Firefox, too. https://www.cnet.com/... Chris Palmer / @fugueish : Hug ops to all the @firefox crew who had an un-fun firedrill on a weekend. https://blog.mozilla.org/... Kiran Pal / @kiranpal : I am struggling with my ad block add-on since morning today. In frustration I deleted it and now it's not getting reinstalled. Feeling sick of ads and more ads. https://twitter.com/... @torproject : Due to a mistake in Mozilla's signing infrastructure, NoScript and all other Firefox extensions signed by Mozilla have been disabled in Tor Browser. Because they use NoScript, higher security levels are currently broken for Tor Browser users. http://blog.torproject.org/... Artem Russakovskii / @artemr : You: broke prod and had to revert some code. @firefox: hold my beer, everyone's add-ons are now auto disabled. https://twitter.com/... @firefox : We're rolling out a fix for the issues with add-ons right now! It will automatically be applied, so you don't need to take any steps to make add-ons work again & all your data should be unaffected. Again, we're really sorry. More to come soon. https://blog.mozilla.org/... Jason Scott / @textfiles : Wait until you find out what the fix does to work. I will re tweet the best metaphors https://twitter.com/...
Context & Ripple Effects
This follows the initial disclosure of the outage on Sunday, when Mozilla confirmed that its own signing certificate expiring had switched off every add-on at once and told users to sit tight rather than attempt manual fixes. The new wrinkle is the shipping of Firefox 66.0.4 as the official remedy — plus the confirmation that the fix does not reach everyone.
The blast radius extended beyond mainstream Firefox: the Tor Project reported that NoScript and other extensions died inside Tor Browser too, because both depend on Mozilla's signing infrastructure. That matters given researchers showed back in 2016 how popular add-ons like NoScript can be hijacked to run malicious code — a privacy browser losing its script-blocking layer is not a cosmetic bug.
First-order effects
- Desktop and Android Firefox users who install the 66.0.4 update get their extensions re-enabled automatically, ending a weekend where core add-ons silently stopped working.
- Legacy-extension users are left out of the fix entirely, and Mozilla explicitly warns everyone else against trying unofficial workarounds that could make things worse.
Second-order effects
- Tor Browser users spent days without NoScript and other protections, degrading the security posture of the highest-stakes user base until they inherit Mozilla's repair.
- The episode hands every Firefox fork and derivative a dependency risk they don't control: one expired credential at Mozilla disables their ecosystems in lockstep.
Third-order effects
- Centralized code-signing and update infrastructure is revealed as a single point of failure for the whole browser ecosystem built on it, pushing vendors toward redundancy and faster emergency-release playbooks — a cadence Mozilla repeated years later with its emergency zero-day updates.
The trend: Browser platforms are consolidating security-critical functions behind vendor-operated signing and update systems whose failures now cascade instantly across independent browsers and privacy forks.