Browser engine Servo 0.0.5 released with post-quantum cryptography

Contents

The open-source browser engine Servo has been released in version 0.0.5. The monthly release brings support for modern cryptography standards: Servo states it is the first browser engine to have fully implemented the post-quantum algorithms ML-KEM (Module-Lattice-Based Key-Encapsulation Mechanism) and ML-DSA (Module-Lattice-Based Digital Signature Algorithm) in the Web Crypto API. Additionally, it includes AES-OCB and improved AES-GCM, as well as more detailed error messages for cryptographic operations.

The quantum-resistant methods protect against so-called Harvest-Now-Decrypt-Later attacks, where attackers collect encrypted data to decrypt it later with quantum computers. ML-DSA additionally hashes the public key to prevent collision and key-swapping attacks. As the Servo project announces on its blog, the engine is thus ahead of established browsers in adopting new web cryptography algorithms.

Regarding web standards, Servo 0.0.5 has received numerous improvements: the engine now supports <link rel=preload> for preloading resources, <style blocking> and <link blocking> for better control during page loading, and <img align> and <select disabled> for forms. The navigator.sendBeacon() function is now enabled by default, enabling reliable, asynchronous data transfer when leaving a page without blocking navigation. Furthermore, OGG support in the <audio> element has been reactivated after old GStreamer bugs were fixed.

CSS extensions include cursor-color, content: <image> on all elements, ::details-content and :open on <details> elements, and :active on <input type=button>. The Rust-based CSS engine Stylo has been updated to the January 2026 state, now supporting color-mix() and improved animations for borders and overflow.

Performance and Stability

Servo 0.0.5 is expected to bring noticeable performance improvements: IPC channels operate more efficiently, leading to speed advantages, especially in single-process mode. The socket timeout has been set to 15 seconds, and each instance requires four fewer threads than before. Improved caching for SVG and animated images, as well as garbage collection optimizations for Canvas and WebGPU, accelerate rendering. The processing of non-ASCII text has been optimized in terms of both time and memory usage.

Numerous fixes enhance stability in the areas of layout, WebGPU, text input, and IndexedDB. Block layout has been revised, and JavaScript support has been expanded: Cyclic Imports, Import Attributes, and JSON Modules now function correctly. The Origin API, MouseEvent.detail, and Request.keepalive are also available. IndexedDB is making progress with connection queues and request granularity but still requires activation via --pref dom_indexeddb_enabled.

Embedding and Platforms

For developers wishing to embed Servo into their applications, version 0.0.5 brings important improvements: cross-compilation from a Windows host is now possible, and SiteDataManager::clear_site_data() allows GDPR-compliant deletion of stored data per host. Git dependencies are now pinned to ensure reproducibility. The foundation for an Accessibility Tree has been laid, which will support accessibility-related technologies in the future.

Servo 0.0.5 is available for Windows, macOS (x86 and ARM, unsigned), Linux (with shared libraries), Android, and OpenHarmony. On macOS, manual approval is necessary due to the lack of a signature. The engine now also supports HTTPS_PROXY and NO_PROXY for network configurations. The complete release notes are available on GitHub.

Project Background

Servo is an experimental browser engine that Mozilla originally started in 2012 to implement modern web technologies in the Rust programming language. After a significant interruption, the project was restarted in 2023 under the Linux Foundation Europe with support from Igalia. Monthly releases have been published since October 2025, building on nightly builds and supplemented by manual tests. The engine aims to offer developers a lightweight, performant alternative for embedding web technologies into applications.

The first official release, 0.0.1, in October 2025, brought pre-compiled binaries for ARM Macs for the first time. The CSS engine Stylo, which Servo and Firefox share, has proven stable and demonstrates how Rust code can be used in productive browser environments.

(fo)