How the Firefox Browser Stops Cryptomining Scripts

This article explains how the Mozilla Firefox web browser protects users from unauthorized cryptomining, a practice commonly known as cryptojacking. By utilizing its built-in Enhanced Tracking Protection and relying on an updated blocklist from the privacy firm Disconnect, Firefox identifies and blocks network requests to known cryptocurrency mining domains. This preventative approach stops malicious scripts from ever downloading and executing in your browser, thereby preserving your computer's CPU resources and battery life.

Understanding Browser-Based Cryptomining

When you visit a compromised or malicious website, the site can silently run scripts written in JavaScript or WebAssembly in the background. Unlike traditional malware that installs files onto your hard drive, these scripts operate entirely within the web browser. They hijack your computer's central processing unit (CPU) to solve complex mathematical calculations to mine cryptocurrencies. This causes your device to slow down, overheat, and consume massive amounts of electricity without your consent.

The Core Mechanism: The Disconnect Blocklist

Firefox does not monitor your CPU usage to guess if a script is mining cryptocurrency. Instead, it prevents the scripts from loading in the first place using a domain-based blocking method.

Mozilla partners with Disconnect, a company that maintains a heavily vetted, continuously updated list of known trackers, malware, and cryptomining servers. Disconnect identifies the specific servers and domains that host cryptomining code and compiles them into a master blocklist, which is built directly into the Firefox browser.

How Firefox Intercepts the Scripts

When you load a webpage, that page makes multiple network requests to various servers to fetch text, stylesheets, and scripts. The cryptomining blocker operates at this network request level through the following steps:

  1. Request Inspection: As a webpage loads, Firefox inspects every outgoing network request to third-party domains before the connection is established.
  2. List Comparison: Firefox cross-references the destination URL of these requests against its internal Disconnect cryptomining blocklist.
  3. Connection Termination: If a webpage attempts to fetch a script from a domain flagged as a cryptominer, Firefox immediately blocks the network request.

Because the connection is severed before the server can respond, the cryptomining code is never downloaded to your browser. Consequently, the script cannot execute, and your CPU resources remain completely unaffected.

Automatic Protection via Enhanced Tracking Protection

Firefox integrates this cryptomining blocker into its Enhanced Tracking Protection (ETP) suite. Users do not need to install third-party extensions or configure complex firewalls to stay safe.

By default, Firefox is set to the "Standard" protection level, which automatically enables the cryptomining blocker. If a cryptominer is blocked on a site you are visiting, you can view the blocked attempt by clicking the shield icon located to the left of the address bar. Users who prefer granular control can also manage this feature manually by navigating to the Firefox Privacy & Security settings and selecting the "Custom" protection mode, where the "Cryptominers" checkbox can be toggled independently.