⛐ It's the "thirteen versions of catching up" release!

[SyntaxError-PEBKAC]

🔄 Updated to Firefox ESR 153.0. About dialog wordmark no longer overlaps the version text on the new line; Stub installer stylesheets resynced with ESR 153's markup; Installer wizard bitmap artifacts fixed; About dialog credits Mozilla and SyntaxError-PEBKAC, with What's New pointing at the changelog.

🆕 What ESR 153 brings over ESR 140 (thirteen Firefox versions at once):

• Profiles and windows - a proper profile manager (separate work / school / personal profiles with their own names, avatars and themes), Split View for two pages side by side, and Containers for staying signed into different accounts in one window.
• Tabs and navigation - reworked vertical tabs and tab groups, multi-tab copying and sharing, QR codes for sending a tab to your phone, and passwords reachable from the sidebar.
• Address bar - unit and time zone conversion, quick actions such as muting all audio, a colour picker, and copying a link straight to highlighted text on a page.
• Media and graphics - HDR video playback on Windows, better access to video actions from context menus, and experimental JPEG XL support behind Firefox Labs.
• PDFs - merge documents by dragging them into the sidebar, and add images as new pages from the built-in editor.
• Privacy and security - Fingerprinting Protection extended to Standard mode, stronger bounce-tracking protection, Safe Browsing V5, AES-256 for stored logins, a red location icon whenever a site is using your location, local network access now behind a permission prompt, and extensions no longer reading local files by default.
• Translations and accessibility - wider on-device translation, a dedicated translations page, and improved assistive technology support.
• Settings - redesigned, with some long-obsolete cookie options finally removed.

⚙️ Build and automation work this round:

• Release automation - the whole thing now runs from a script: it watches Mozilla for a new ESR tag, rebases the patch stack, builds both variants, smoke-tests them, packages, submits to VirusTotal, resolves the CVE list from Mozilla's advisory data and drafts these notes. Two approval gates (build, publish) are the only manual steps, both from a phone.
• ESR 153 migration - the ducksteps patch stack was rebased across 72,880 upstream commits. Two old upstream lint commits were dropped as obsolete, and the hand-written Rust lifetime workarounds went with them, since upstream now silences that lint itself.
• Toolchain refresh - ESR 153 needs newer tooling than 140 did: MSVC 14.50 (for the STL hardening ESR 153 enables by default), cbindgen 0.29, windows-rs 0.62, the Windows App SDK, DirectX Shader Compiler, and 7zz.
• PGO - both variants are still trained on the custom 88-site corpus rather than Mozilla's default workload, roughly 134 minutes of scripted real browsing per variant.
• Optimisation - unchanged and still the point of this build: Zen5 gets -march=znver5 -mtune=znver5 with target-cpu=znver5, Legacy gets -march=x86-64-v3 with target-cpu=haswell, and both get full LTO on top of PGO.
• Packaging - LZMA2 with a 384 MB dictionary and solid compression for the standalone archives. UPX stays off the installer stub, which keeps the antivirus false positives away.

🛡️ Addressed 60 CVEs from Mozilla Foundation Security Advisory 2026-68 (July 21, 2026). This one's a bigger deal than usual: it's the first build on the new ESR line, so it's dragging thirteen versions of upstream Firefox work along behind it instead of the usual trickle. You get an actual profile manager for keeping work and personal browsing apart, Split View for two pages side by side, Containers for juggling multiple accounts in one window, and vertical tabs plus tab groups that got a real rework this time. Windows users get HDR video playback, there's PDF merging and image insertion now, the address bar can convert units and timezones and pick colours, Fingerprinting Protection is on by default in Standard mode, saved logins get AES-256 encryption, and there's experimental JPEG XL support for the handful of people who care (like me!). Somewhere in all that, the usual pile of security fixes also rode along (20 high, 33 moderate, 7 low this round), but they're the less interesting part this time.

High severity:

• CVE-2026-16349 Same-origin policy bypass in the DOM: Navigation component
• CVE-2026-16350 Incorrect boundary conditions in the Audio/Video: cubeb component
• CVE-2026-16362 Use-after-free in the WebRTC: Audio/Video component
• CVE-2026-16351 Sandbox escape due to use-after-free in the DOM: Navigation component
• CVE-2026-16352 Sandbox escape due to use-after-free in the Disability Access APIs component
• CVE-2026-16363 JIT miscompilation in the JavaScript: WebAssembly component
• CVE-2026-16364 Incorrect boundary conditions in the Audio/Video: Playback component
• CVE-2026-16365 Privilege escalation in the DOM: Workers component
• CVE-2026-16366 Privilege escalation in the DOM: Navigation component
• CVE-2026-16353 Invalid pointer in the DOM: Bindings (WebIDL) component
• CVE-2026-16354 Information disclosure in the Graphics: ImageLib component
• CVE-2026-16367 Sandbox escape due to invalid pointer in the Disability Access APIs component
• CVE-2026-16368 Incorrect boundary conditions in the JavaScript: WebAssembly component
• CVE-2026-16369 Integer overflow in the JavaScript: WebAssembly component
• CVE-2026-16355 JIT miscompilation in the JavaScript Engine: JIT component
• CVE-2026-16356 Sandbox escape due to use-after-free in the Disability Access APIs component
• CVE-2026-16357 Incorrect boundary conditions in the Graphics component
• CVE-2026-16411 Memory safety bugs fixed in Firefox 153
• CVE-2026-16412 Memory safety bugs fixed in Firefox ESR 140.13 and Firefox 153
• CVE-2026-16360 Memory safety bugs fixed in Firefox ESR 115.38, Firefox ESR 140.13 and Firefox 153

Moderate severity:

• CVE-2026-16370 Mitigation bypass in the DOM: Networking component
• CVE-2026-16371 Privilege escalation in the DOM: Navigation component
• CVE-2026-16372 Privilege escalation in the DOM: Content Processes component
• CVE-2026-16374 Information disclosure in the Framework component in DevTools
• CVE-2026-16375 Site isolation issue in the Networking: HTTP component
• CVE-2026-16376 Denial-of-service in the Graphics: WebGPU component
• CVE-2026-16377 Mitigation bypass in the PDF Viewer component
• CVE-2026-16378 Other issue in the DOM: Copy & Paste and Drag & Drop component
• CVE-2026-16379 Privilege escalation in the DOM: Content Processes component
• CVE-2026-16358 Site isolation issue in the Graphics: WebRender component
• CVE-2026-16380 Mitigation bypass in the Networking component
• CVE-2026-16381 Same-origin policy bypass in the Networking: DNS component
• CVE-2026-16382 Mitigation bypass in the DOM: Service Workers component
• CVE-2026-16383 Mitigation bypass in the DOM: Networking component
• CVE-2026-16384 Information disclosure due to uninitialized memory in the Graphics: WebGPU component
• CVE-2026-16385 Information disclosure due to uninitialized memory in the Graphics: WebGPU component
• CVE-2026-16386 Information disclosure due to uninitialized memory in the Graphics: WebGPU component
• CVE-2026-16387 Site isolation issue in the Networking component
• CVE-2026-16388 Sandbox escape in the DOM: Networking component
• CVE-2026-16389 Incorrect boundary conditions, integer overflow in the Libraries component in NSS
• CVE-2026-16390 Mitigation bypass in the Enterprise Policies component
• CVE-2026-16391 Information disclosure in the Storage: IndexedDB component
• CVE-2026-16392 JIT miscompilation in the JavaScript Engine: JIT component
• CVE-2026-16393 Incorrect boundary conditions in the Graphics: WebGPU component
• CVE-2026-16359 Incorrect boundary conditions in the Audio/Video: GMP component
• CVE-2026-16394 Mitigation bypass in the DOM: Security component
• CVE-2026-16395 Integer overflow in the Audio/Video component
• CVE-2026-16396 Privilege escalation in WebExtensions
• CVE-2026-16398 Site isolation issue in the Graphics component
• CVE-2026-16399 Site isolation issue in the DOM: Navigation component
• CVE-2026-16400 Information disclosure in the DOM: Security component
• CVE-2026-16401 Privilege escalation in the Data Loss Prevention component
• CVE-2026-16402 Integer overflow in the Graphics: ImageLib component

Low severity:

• CVE-2026-16403 Spoofing issue in the Address Bar component
• CVE-2026-16405 Information disclosure in the Networking: WebSockets component
• CVE-2026-16406 Mitigation bypass in the Networking component
• CVE-2026-16407 Mitigation bypass in the DOM: Service Workers component
• CVE-2026-16408 Integer overflow in the Audio/Video: Playback component
• CVE-2026-16409 Invalid pointer in the Security: PSM component
• CVE-2026-16410 JIT miscompilation in the JavaScript Engine: JIT component

---

✅ SHA512:

ducksteps.153.0.Legacy.Setup.exe
aaa934b7c963a0a8c2af0b1066139c4f2b70fbf92fa2b97815819e9547276ccab760ae3273e3bbb9de0c2fe833336a51a40597d64a6f88c674697dd1258f813b

ducksteps.153.0.Legacy.Standalone.7z
1744de45fb1b35fe816978e2e06def28d1d59204218ea94e0974b253d65031bdce87fc2dc3102bcd7ee5acef57c1891375983477caf999e0542947136ba13eff

ducksteps.153.0.Setup.exe
882efb179a7e1ec9cbb45ab8653c415ff1d9d7570d817e3422df1106730d6a468855efde7d6bceff9f107f4065348929247707f5dfe68d785ca6080ac5f9c7a0

ducksteps.153.0.Standalone.7z
70e64f6b8da0ddf03d7a7b589c00cbc61e822433f8d11cfe8e5cae71eecca24cb621250855258ea6a9e4eb6c12caaba721684aa6e1ee247354d0357620ff3b4e

---

🚨 VirusTotal Results:

ducksteps.153.0.Legacy.Setup.exe

ducksteps.153.0.Legacy.Standalone.7z

ducksteps.153.0.Setup.exe

ducksteps.153.0.Standalone.7z

---

This discussion was created from the release ⛐ It's the "thirteen versions of catching up" release!.