⛐ It's the "stay in the sandbox" release!

[SyntaxError-PEBKAC]

🔄 Updated to Firefox ESR 140.11.0.

🛡️ Addressed 15 CVEs from Mozilla Foundation Security Advisory 2026-48 (May 19, 2026). No critical issues, no active exploitation reported.

High severity:

• CVE-2026-8401 — sandbox escape via the Profile Backup component
• CVE-2026-8947 — use-after-free in WebIDL bindings
• CVE-2026-8388 — out-of-bounds read in the JIT compiler
• CVE-2026-8391 — issue in the JavaScript engine
• CVE-2026-8946 — out-of-bounds read in Web Codecs

Moderate severity:

• CVE-2026-8953 — sandbox escape via use-after-free in Accessibility APIs
• CVE-2026-8958 — info disclosure + sandbox escape in process sandboxing
• CVE-2026-8959 — sandbox escape via out-of-bounds read in Win32 widgets
• CVE-2026-8950 — same-origin policy bypass in HTTP networking
• CVE-2026-8949 — integer overflow in Win32 widgets
• CVE-2026-8956 — integer overflow in JAR networking
• CVE-2026-8955 — privilege escalation in DOM Workers
• CVE-2026-8957 — privilege escalation in Enterprise Policies
• CVE-2026-8954 — out-of-bounds read in audio/video processing

Low severity:

• CVE-2026-8961 — spoofing issue in Form Autofill

---

✅ SHA512:

ducksteps.140.11.0.Setup.exe
'76ba36db18131fd7e08abf17cf1a9a4047efa4b2696db02964645a54118a9d41112dde3a4dca6a545087e909f3d2ccb55b149f1f35883279ad2cb1715e434f78'

ducksteps.140.11.0.Standalone.7z
'3b03a2a77fc9bb0eb2bac263d9bc319441e1e98be9d61e51e15a10e11b71619c6e3a6dcd54da350b0122430c416b166bd2e73f48832dbb5c97307b76cbd107c8'

ducksteps.140.11.0.Legacy.Setup.exe
'2d3bc14afd983e4e4ef8da4232d7295a2a05748e024a9094d5a55573ad01d3dd9ab78be150460eca05a077381c211e0e615a397b3bec96ce650f810e8060a28e'

ducksteps.140.11.0.Legacy.Standalone.7z
'4f3f46c5ee42c0523a2ec0fe3aa06d8cbf225bd948c446ed79e03c4c0a35f9ad08520535aaeff5e9f4873bcf8edd6dc46a005fef453234bbef8cd2827e61925a'

---

🚨 VirusTotal Results:

ducksteps.140.11.0.Setup.exe

ducksteps.140.11.0.Standalone.7z

ducksteps.140.11.0.Legacy.Setup.exe

ducksteps.140.11.0.Legacy.Standalone.7z

---

This discussion was created from the release ⛐ It's the "stay in the sandbox" release!.