Firefox keeps updating in the background

Unattended Upgrades

The default settings of Ubuntu have Unattended Upgrades enabled for new packages that are pushed by the Ubuntu Security Team (the "-security" pocket of the Ubuntu Repositories).

New releases of web browsers usually include many security fixes, so the Ubuntu Security Team pushes the new browser. Generally, new releases ONLY go into the next release of Ubuntu and are NOT backported. Web browsers, for various reasons, are a very rare exception to that practice: All supported releases of Ubuntu always get the newest web browser.

The easy way to check if Unattended Upgrades has recently upgraded your web browser is to check the log: /var/log/unattended-upgrades/unattended-upgrades.log

Adding Firefox to Unattended-Upgrade::Package-Blacklist in apt configuration avoids undesired forced restarts:

cat <<EOF | sudo tee /etc/apt/apt.conf.d/99unattended-upgrades-firefox
Unattended-Upgrade::Package-Blacklist {
    // Disable unattended firefox upgrades to avoid undesired forced restarts
    "firefox";
};
EOF