Is it in general a security problem not to update your browser. Firefox constantly prompts me to update my browser, but how dangerous is it to not update?
As part of this question, I would like to know what that problem exactly is. What are the risks of not updating your browser? What exactly could happen?
Because there are security vulnerabilities found in software all the time. These vulnerabilities are sometimes publicly disclosed, sometimes not. Either way, as developers find or find out about them they patch them. Running old versions of browsers leaves you vulnerable to malicious websites trying to infect your computer.
Below are links to web pages listing vulnerabilities that have been fixed in relatively recent versions of the 3 most popular browsers.
All browsers are going to have bugs, and all of them will have vulnerabilities. But staying on top of known vulnerabilities can help prevent attackers from gaining access to your system.
Edit
Thanks to kirb for these extra links to up-to-date blogs of browser security updates
I'm really just repeating other answers but let's try to explain it using a metaphor. A computer program is a long description of how the computer must behave, based on what information it is given. A browser program is given some instructions by a Web server program and draws a Web page for you to use. It then tells the Web server which next page it would like to visit, and so on.
We developers make many mistakes when writing programs. We sometimes forget some edge cases, in which case our programs will behave erratically and possibly cause damage. Sometimes, specific instructions allow to bypass a verification we make, for instance allowing someone to modify settings in your browser or to cause a download without you approving. In short, mistakes are exploited in any imaginable way.
In other cases, programs behave so erratically that they start writing garbage on top of their own list of instructions (like a child would draw on top of your shopping list). Attackers are very good at finding those cases (which we call exploits), and guiding the browsers to write very specific things (the payload) on top of the original instructions rather than garbage.
When this happens, developers figure it out sooner or later (often months/years later), and they improve the program's source code by removing the ambiguities or errors that allowed exploitation. They then release a new version that is no longer vulnerable.
When you use an old version of some software, it means that it is vulnerable to known and well-documented exploits, so anyone with a bit of wit can exploit your software and damage your computer and your data. In particular, Web browsers are constantly exposed to information from unknown third parties which may be malicious.
Web servers can be owned by mafias seeking to make money by installing malware on any computer passing by (that tracks your online banking, steals files that look like they contain financial information or passwords, track you online to serve you ads, make you solve CAPTCHAs on behalf of spamming bots or use your computer's resources to send spam).
Other attackers even break into legitimate servers and then add malware onto them, so even visiting a perfectly reputable website such as YouTube or Facebook can lead to malware. The very best defense you have against this is to not be vulnerable to the well-known ways in which your browser can be exploited, by updating it.
Well the whole point of updating/patching anything is to fix known vulnerabilities. Any bugs/vulnerabilities found in the version of firefox you're running could be exploitable. Updating your browser will modify how the browser works and result in those vulnerabilities being no longer exploitable. It's really as simple as that.
Updating can also introduce new vulnerabilities, but being a new version knowledge of new vulnerabilities is likely low, until it's been out for a while and people find some, then developers release a new patch and the cycle repeats its self.
Updates also often include performance increases as well, so faster operation, sleeker design, or various other user experience enhancements.
There are two main reasons for creating a new version of a program: (in this case a browser)
Some changes are a bit harder to classify (improving performance is a bugfix or a feature?)
Most of the big issues are security issues solving some kind of vulnerability. A modern browser is as complex as an OS, it's extremely hard not to have errors.
There are also new features improving security that don't involve a vulnerability (but you should try to adopt).
Some programs (eg. a postcard creator) it's not so critical to have the latest version. Mainly because you only use it with trusted files (those you have created) so the risk of getting infected through it is quite low.
On the other hand, web browsers are used everyday to visit lots of untrusted sites. And by untrusted I really mean it. If you are a heavy internet user, it's very strange that you don't visit a website that could compromised for a few weeks. The online newspaper you read? Guess what can be done within its ad network. When you searched X on Google? That search result could have been an exploit, etc, etc.
There are many evil guys trying to infect you (and mainly through your browser or one of its plugins). Sometimes they attempt a single vuulnerability, others they try as much as they can (an exploit kit), attempting whatever that could allow them to control your machine.
As the web browsers are updated as soon as they know about the bug -and succeed on fixing it- (sometimes they discover it first, sometimes it had been abused for a long time before that), if you keep it updated it's much harder to compromise you, as an attacker would need a bug without a fix (called a 0-day). However, using an old version means that you are also vulnerable to all the problems fixed after that version, for which the exploit in most cases was not even written before it was solved! (cf. Microsoft Security Intelligence Report 16, page 24 and MSIR 15) Non-updated systems are many times more likely to get infected.
Mozilla Firefox releases a new version every six weeks (plus whenever a security problem forces a new one). If you want to keep the browser updated but are not interested in less important changes (such as toolbar changes), you can run an Extended Support Release, which is supported for 54 weeks (although you can still get a new version with minor fixes every six weeks, plus the when-needed security updates).
Many other vendors also provide LTS (Long Term Support) versions of their programs, to which they apply security fixes (only), even though it's not the latest one. For instance Debian supports (ie. fixes the old versions they are shipping) their packages -although they are a distributor- for ~3 years, and Red Hat Enterprise Linux provides support for 13 years.
However, although you phrased the question in a generic way, you were probably wondering however why Firefox had to update to Firefox 32.0.1 (12 September 2014) just a few days after installing Firefox 32.0 (2 September 2014). This is not constantly, though as last update was on July.
The explanation is -as always- in the release notes https://www.mozilla.org/en-US/firefox/32.0.1/releasenotes/ where we can that although Firefox 32 fixed some security issues, Firefox 32.0.1 was not due to discovery of new vulnerabilities, but because Firefox 32 "failed" on computers with multiple graphics cards (one of those non-security major issues).
32.0.1 - Stability issues for computers with multiple graphics cards
32.0.1 - Mixed content icon may be incorrectly displayed instead of lock icon for SSL sites
32.0.1 - WebRTC: setRemoteDescription() silently fails if no success callback is specified
So, as an exception to the general advice, updating to Firefox 32.0.1 if you are running Firefox 32.0 is not a pressing issue unless you use multiple graphic cards (or using Android). But when 32.0.2 appears, updating to it may be. You must be very careful each time about what exactly changed if you want to keep running non-latest versions of your browser (and safe).
If you are dealing with a single computer, updating probably takes less time than figuring it out ☺ (and we should be grateful to the last generation of auto-updaters for making them so seamless)
Here is a link to Firefox's security update notes:
You can see by the number of fixes, and especially those marked "critical," that by not updating you would invite significant risk.
Shortest answer, read the Firefox changelog for a release and witness why. You can find it @
https://www.mozilla.org/en-US/firefox/releases/
For all the specific releases. Just click on one of the release numbers.
All software has bugs. Updates help to resolve those bugs.
When it comes to browsers, bugs can mean that malware can infect your browser, or even your machine. Worst case? An attacker can learn your banking details and empty your account.
It's because of a category of vulnerabilities known as client-side vulnerabilities. Over the period of time, servers have got more secure, so cyber crooks, instead of focussing on servers these days, focus on client-side security bugs. When it comes to browsers, these bugs are mostly used after free bugs (specially in Internet Explorer which has changed recently thanks to incorporation of more protections against these bugs).
There is software known as "exploit kits" (for example, Blackhole, Sweet Orange, and Stuxnet) which have a multiple of client-side exploits ready to fire hosted on a website. Once you visit the website with your not updated browser (or Java :D), boom they have access to all your credentials.
