Install Firefox on Ubuntu Without Package Surprises

On modern Ubuntu, “install Firefox with APT” sounds clearer than it really is. The firefox package in Ubuntu 22.04 and 24.04 is a small transition package that installs the Snap. That is perfectly reasonable for many desktops—but it is frustrating when you expected a traditional DEB and only discover the difference while debugging paths, policies, or profile access.

Snap and Mozilla DEB at a glance

• Firefox Snap: Ubuntu’s default integration, sandboxed, maintained by Mozilla, and refreshed through Snap channels.

• Mozilla DEB: installed from packages.mozilla.org, managed by APT, and prioritized with an explicit pin.

• Ubuntu `apt install firefox`: on supported modern Ubuntu releases, installs a transitional package whose result is the Firefox Snap.

• Unofficial PPA: not required for either supported path in this article and adds another trust and maintenance decision.

Before changing an existing browser installation

1. Open Firefox and allow Firefox Sync to finish if you use it, but do not treat synchronization as a complete local backup.

1. Open about:support, find Profile Directory, and record the active profile path.

1. Close Firefox completely before copying the profile directory to a protected backup location.

1. Record installed extensions, enterprise policies, certificate integrations, and the package source you currently use.

1. Keep the backup until bookmarks, passwords, extensions, downloads, and policies are verified in the new installation.

Method A: install the Ubuntu-default Firefox Snap

$ sudo snap install firefox
snap info firefox

What the Snap commands do

• snap install firefox installs the default stable channel when no channel is specified.

• The Snap Store listing identifies Mozilla as the verified publisher; confirm that identity before installation.

• snap info reports channel, publisher, tracking, and release information without changing the installed channel.

• Snap refreshes are managed separately from APT package upgrades.

If you prefer the desktop interface, Ubuntu App Center can install the same Firefox Snap. Check the source and verified publisher instead of assuming every search result is equivalent.

Why apt install may still produce a Snap

$ apt-cache policy firefox
apt show firefox

What to look for in APT metadata

• apt-cache policy shows installed and candidate versions plus their repositories.

• On Ubuntu 24.04, the Ubuntu package is described as a transition from Firefox to the Firefox Snap.

• apt show may display a warning about CLI stability, but reading package metadata is non-destructive.

• The tiny transition package is not the full browser DEB; it depends on snapd and arranges the Snap installation.

Method B: add Mozilla’s official APT repository

Mozilla currently recommends its own DEB repository for Debian- and Ubuntu-based systems when a DEB is required. The commands below modify system trust and package sources. Read the current Mozilla installation instructions and compare the published signing-key fingerprint before continuing.

$ sudo install -d -m 0755 /etc/apt/keyrings
wget -q https://packages.mozilla.org/apt/repo-signing-key.gpg -O- | sudo tee /etc/apt/keyrings/packages.mozilla.org.asc >/dev/null
gpg --show-keys --with-colons /etc/apt/keyrings/packages.mozilla.org.asc | awk -F: '$1 == "fpr" { print $10; exit }'

Trust checks before adding the repository

• install -d -m 0755 creates the keyring directory with predictable permissions if needed.

• wget -O- writes the HTTPS response to standard output and tee stores it at the explicit keyring path.

• The fingerprint printed by gpg must match Mozilla’s currently documented value: 35BAA0B33E9EB396F59CA838C0BA5CE6DC6315A3.

• Stop if the download fails, the fingerprint differs, or Mozilla changes its documented procedure; do not import an unverified replacement key.

$ printf '%s
' 'deb [signed-by=/etc/apt/keyrings/packages.mozilla.org.asc] https://packages.mozilla.org/apt mozilla main' | sudo tee /etc/apt/sources.list.d/mozilla.list >/dev/null
printf '%s
' 'Package: *' 'Pin: origin packages.mozilla.org' 'Pin-Priority: 1000' | sudo tee /etc/apt/preferences.d/mozilla >/dev/null
sudo apt update
apt-cache policy firefox

Why the candidate check comes before installation

• The signed-by option limits this repository entry to the named Mozilla key instead of trusting it globally.

• APT pin priority 1000 makes packages from packages.mozilla.org win according to Mozilla’s documented setup.

• apt update downloads metadata but does not install Firefox.

• The final policy output must show the intended Mozilla origin; otherwise fix repository or pin configuration before proceeding.

Install the DEB only after policy is correct

$ sudo apt install firefox
apt-cache policy firefox
dpkg-query -W -f='${Package}	${Version}
' firefox

What proves the DEB installation

• apt install follows the candidate chosen by repository priorities; review its transaction summary before confirming.

• apt-cache policy should still identify Mozilla’s repository as the installed and candidate source.

• dpkg-query succeeds only for a registered DEB package and prints its package name and version.

• If snap list firefox also succeeds, both package models may be installed; verify launchers and remove the unwanted one only after profile validation.

Switching an existing Snap needs an explicit migration

Do not remove a working browser before the Mozilla repository, signing key, pin, and candidate have been verified. Mozilla’s Ubuntu-specific instructions include an additional APT pin that prevents Ubuntu’s transitional Firefox package from pulling the Snap back. Follow that current sequence, close Firefox, retain the profile backup, and keep another browser available for recovery.

Verify the browser you actually launch

$ command -v firefox
firefox --version
snap list firefox 2>/dev/null || true
dpkg-query -W firefox 2>/dev/null || true

How to read mixed results

• command -v reports the executable selected by the current shell, which may be a wrapper.

• firefox --version reports the browser build reached through that launcher.

• The two package queries are diagnostic alternatives; || true keeps the sequence going when one package model is absent.

• If both models exist, inspect desktop launchers and running-process paths before deleting either installation.

Updates follow the package model

• Snap: inspect with snap refresh --list and allow Snap’s refresh mechanism to update Firefox.

• Mozilla DEB: update repository metadata and packages through normal APT maintenance.

• Pinned repository: periodically confirm the signing key, source file, and policy still match Mozilla’s published guidance.

• Enterprise deployment: test extensions, certificates, policies, file pickers, and automation against the chosen confinement model before broad rollout.

Troubleshoot the common surprises

• APT installs Snap anyway: Ubuntu’s transition package won; inspect policy and use Mozilla’s complete repository-and-pin procedure if a DEB is required.

• Two Firefox icons appear: Snap and DEB desktop entries likely coexist; identify each executable before removing anything.

• Old profile seems missing: package formats can expose different profile locations; close all Firefox processes and restore only from a verified backup.

• Repository signature fails: do not bypass verification; re-download from Mozilla and compare the documented fingerprint.

• Browser will not update: determine whether Snap or APT owns the running installation, then diagnose that update mechanism.

• Automation cannot reach files: Snap confinement and interface permissions may differ from a DEB installation; review the access requirement rather than granting broad filesystem permissions blindly.

Related browser and Ubuntu checks

• Fix a website that does not appear secure after installing TLS.

• Diagnose Firefox video playback failures on Linux.

• Understand browser caching before judging a site update.