Firefox Just Gave Every User a Free VPN — And the Browser Wars Will Never Be the Same

="">

Mozilla dropped a quiet bombshell this week. Starting with Firefox 140, every user of the browser now has access to a built-in, free VPN — no subscription required, no extension to install, no hoops to jump through. Just open the browser and flip a switch.

The feature, which Mozilla calls its “Free VPN,” is baked directly into Firefox and provides encrypted browsing through a single-server proxy arrangement. It’s not the full-featured Mozilla VPN product that the company has sold as a standalone subscription since 2020. But it doesn’t need to be. For the vast majority of users who simply want a layer of privacy on public Wi-Fi or a basic shield against network-level snooping, this is more than enough. And it costs nothing.

According to OMG! Ubuntu!, the free VPN became available as Firefox 140 rolled out to users in late April 2026. The feature had been spotted in earlier beta builds and Nightly releases, but its arrival in the stable channel marks a significant escalation in Mozilla’s strategy to differentiate Firefox from its Chromium-based competitors. The implementation routes browser traffic through Mullvad’s network infrastructure — the same Swedish privacy-focused provider that underpins the paid Mozilla VPN service.

There are limitations. Meaningful ones.

The free tier restricts users to a single server location, which Mozilla selects automatically based on proximity. There’s no ability to choose a specific country or city, which means this isn’t a tool for bypassing geo-restrictions on streaming services. Bandwidth is reportedly throttled compared to the paid tier, and the protection applies only to traffic within the Firefox browser itself — not system-wide, not for other applications. Mozilla has been transparent about these constraints, positioning the free VPN as an on-ramp to the full subscription product rather than a replacement for it.

That positioning matters. Mozilla has struggled for years to find sustainable revenue beyond its long-standing search engine deals with Google, which account for the overwhelming majority of the organization’s income. The paid Mozilla VPN, launched in 2020, was one of several attempts to diversify. A free tier that lives inside the browser could serve as a powerful funnel, converting casual users into paying subscribers who want server selection, faster speeds, and device-wide coverage.

The timing isn’t accidental either. Google’s Chrome browser, which commands roughly 65% of the global desktop browser market according to StatCounter, has been tightening its grip on the web standards process while simultaneously rolling out features that privacy advocates view with suspicion. Manifest V3, Google’s controversial extension platform overhaul, has already limited the effectiveness of third-party ad blockers and privacy tools on Chrome. Firefox, which still uses its own Gecko rendering engine independent of Google’s Chromium project, has positioned itself as the principled alternative. A free, built-in VPN sharpens that pitch considerably.

So how does it actually work?

When a user enables the free VPN through Firefox’s settings panel, the browser establishes an encrypted tunnel to a Mullvad proxy server. DNS queries are routed through the tunnel as well, preventing the user’s ISP from seeing which domains they visit. The connection uses WireGuard, the modern VPN protocol that has become the industry standard for its combination of speed, simplicity, and strong cryptography. According to OMG! Ubuntu!, the feature can be toggled on and off with a single click from a new shield icon in the browser toolbar, making activation trivial even for non-technical users.

Privacy researchers have offered cautiously positive assessments. The use of Mullvad’s infrastructure is a strong signal — Mullvad has a well-established reputation in the privacy community, has undergone multiple independent security audits, and operates under Swedish jurisdiction, which offers stronger privacy protections than many alternatives. The company famously doesn’t even require an email address to create an account for its own standalone VPN service.

But a browser-only VPN is not the same as a system-wide VPN, and security professionals have been quick to note the distinction. Traffic from other applications on the same device — email clients, messaging apps, system update processes — remains unprotected. And because the free tier uses a single server location, sophisticated adversaries could potentially correlate traffic patterns more easily than they could against a user bouncing between multiple exit nodes. For journalists, activists, or anyone facing serious threats, this is not a substitute for a proper VPN configuration or Tor.

Still. For the average person browsing on airport Wi-Fi? It’s a genuine improvement over the status quo, which for most people is no VPN at all.

The competitive implications extend beyond Chrome. Apple has been building out its own privacy infrastructure with iCloud Private Relay, which provides a similar single-hop proxy for Safari users who pay for iCloud+. Microsoft’s Edge browser, built on Chromium, briefly offered a free VPN through a partnership with Cloudflare but limited it to a meager 15 GB per month and has not significantly expanded the offering. Opera has included a free browser VPN for years, though its implementation has drawn criticism from privacy advocates who note that Opera’s parent company, Kunlun Tech, is based in China.

Firefox’s entry into this space is different because of who’s behind it. Mozilla is a nonprofit-backed organization with a stated mission to keep the internet open and accessible. Its track record on privacy — from pioneering Enhanced Tracking Protection to refusing to adopt Google’s now-abandoned FLoC advertising proposal — gives it credibility that commercial browser vendors struggle to match. When Mozilla says the free VPN doesn’t log user activity, that claim carries weight in a way it might not from a company whose primary business model depends on advertising surveillance.

The Linux community has been particularly enthusiastic. Firefox remains the default browser on most major Linux distributions, and the addition of a built-in VPN eliminates a pain point for users who previously had to configure VPN connections at the system level or rely on browser extensions of varying quality and trustworthiness. As OMG! Ubuntu! noted, the feature works identically across Linux, Windows, and macOS, with no platform-specific limitations.

There’s a broader strategic question here about what a browser should be. Chrome has evolved into something closer to an operating system, with its own task manager, process isolation model, and deep integration with Google’s cloud services. Firefox has historically taken a more conservative approach, focusing on rendering web pages well and staying out of the user’s way. A built-in VPN represents a philosophical shift — an acknowledgment that in 2026, a web browser’s responsibilities extend beyond just displaying HTML. Users expect their browser to actively protect them.

Mozilla’s finances make this move both bold and necessary. The organization’s most recent public financial filings showed total revenue of approximately $593 million in 2023, with roughly 86% coming from search royalties — overwhelmingly from Google. That dependency has long been Mozilla’s central vulnerability. If Google ever decided to stop paying, or significantly reduced the deal, Mozilla’s ability to fund Firefox development would be immediately threatened. Every new revenue stream, even a modest one like VPN subscriptions, reduces that existential risk.

And the VPN market is enormous. Grand View Research estimated the global VPN market at over $50 billion in 2024, with consumer VPN services representing a fast-growing segment. Mozilla doesn’t need to capture a large share of that market to meaningfully diversify its revenue. If even 2% to 3% of Firefox’s roughly 170 million monthly active users convert from the free VPN tier to a paid subscription, the financial impact would be substantial.

The reaction on social media has been broadly positive, though not without skepticism. Some users on X questioned whether a browser-only VPN provides meaningful security or merely creates a false sense of protection. Others pointed out that routing all browser traffic through a single provider — even one as reputable as Mullvad — creates a new point of trust that didn’t previously exist. These are legitimate concerns. But they apply to every VPN service, and Mozilla’s transparency about the arrangement’s limitations has blunted the sharpest critiques.

One thing is clear: the bar for what users expect from a free browser just moved. Chrome offers speed and ubiquity. Safari offers Apple’s hardware integration. Edge offers Microsoft 365 tie-ins. Firefox now offers something none of them match — a free, no-strings-attached privacy tool from an organization that doesn’t profit from collecting user data.

Whether that’s enough to reverse Firefox’s long, slow decline in market share remains an open question. The browser has lost ground steadily for over a decade, falling from a peak of roughly 30% market share to somewhere around 3% to 6% depending on the measurement methodology. A free VPN won’t single-handedly reverse that trajectory. But it gives Firefox a concrete, tangible feature that users can point to when someone asks why they don’t just use Chrome.

Sometimes that’s all you need. A reason.

Firefox 140 is available now through Mozilla’s standard update channels. The free VPN can be enabled in the browser’s privacy settings. No account creation is required for the basic tier, though users who want to upgrade to the full Mozilla VPN — with multi-device support, server selection across more than 30 countries, and uncapped speeds — will need a Mozilla account and a subscription starting at $4.99 per month.

Mozilla has said additional details about the free VPN’s infrastructure, privacy policy, and future development plans will be published on its official blog in the coming weeks. For now, the feature speaks for itself. Open Firefox. Click the shield. Browse privately.

It really is that simple.