Changes since 11.0.9:

• Fixed CapsCSP bug allowing data: URLs to bypass font blocking (thanks dcent and skriptimaahinen)
• [XSS] Prevent DOS detection from being triggered for already aborted requests (thanks barbaz)
• [L10n] Updated es and added bn
• [XSS] More accurate base64 checks on hash
• Updated TLDs
• Minor adjustments for Firefox Preview (Fenix) compatibility
• Refactored XSS filter into an asynchronous worker to better handle DOS attempts
• [XSS] Abort on InjectionChecker timeouts
• [XSS] Updated recognized HTML events
• Unrestricted tab support for service workers and their included 3rd party scripts
• Record document origins in TabStatus
• Support for reporting service workers and their imported scripts in UI
• Cross-browser request properties normalization
• Fixed initial requst URL lost across redirections
• Updated copyright statement
• Fixed UNTRUSTED domains accidentally set in "match HTTPS only" mode (issue #126)
• [L10n] Updated da, de, fr, he, it, mk, nl, ru, sq, tr, zh_TW
• Fixed UI not working on pages were sessionStorage is disabled
• Added "ping" (beacon/ping) capability control
• Order change in html5 events source
• Removed unused "privacy" permission
• Fixed shortcut and context menu doing nothing unless browserAction icon is visible on Firefox (issue 58)
• Fix minor typo regarding appearance redundancy (issue 61)
• Fixed scripts could not be enabled on file: SVG documents