⛐ It's the "fifty-two CVEs, nineteen of them serious" release!

[SyntaxError-PEBKAC]

🔄 Updated to Firefox ESR 153.1.0.

🗑️ Removed the now-unused tools/upx-after-package.ps1 script.

🗓️ Fixed a stale date in the PGO training corpus metadata.

⚙️ Fixed incorrect wording on the "More from Mozilla" settings page.

🏷️ Data reporting notice now correctly refers to Mozilla as "they", not ducksteps as "we".

📡 Telemetry prompts now correctly name Mozilla as the data recipient, not the maintainer.

🛡️ Addressed 52 CVEs from Mozilla Foundation Security Advisory 2026-77 (August 18, 2026). This one's mostly patching holes; 19 high, 23 moderate, and 10 low severity CVEs squashed, nothing screaming louder than the rest but the high count alone is enough to not sit on this. Update when you get a sec.

High severity:

• CVE-2026-74934 Site isolation issue in the Graphics: CanvasWebGL component
• CVE-2026-74935 Privilege escalation in the DOM: Networking component
• CVE-2026-74936 Use-after-free in the JavaScript: WebAssembly component
• CVE-2026-74937 Use-after-free in the JavaScript: GC component
• CVE-2026-74938 Mitigation bypass in the JavaScript: GC component
• CVE-2026-74939 Privilege escalation in the DOM: Navigation component
• CVE-2026-74940 Use-after-free in the Graphics: Text component
• CVE-2026-74941 Privilege escalation in the Graphics: CanvasWebGL component
• CVE-2026-74942 Privilege escalation in the Remote Settings Client component
• CVE-2026-74943 Use-after-free in the Graphics: ImageLib component
• CVE-2026-74944 Use-after-free in the DOM: Core & HTML component
• CVE-2026-74945 Information disclosure in the Graphics: Text component
• CVE-2026-74946 Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component
• CVE-2026-74947 Privilege escalation due to invalid pointer in the Graphics component
• CVE-2026-74948 Information disclosure in the Graphics component
• CVE-2026-74949 Privilege escalation due to use-after-free in the Graphics: Canvas2D component
• CVE-2026-74987 Internally found bugs fixed in Firefox ESR 140.14, Firefox ESR 153.1 and Firefox 154
• CVE-2026-74988 Internally found bugs fixed in Firefox ESR 153.1 and Firefox 154
• CVE-2026-74990 Internally found bugs fixed in Firefox ESR 115.39, Firefox ESR 140.14, Firefox ESR 153.1 and Firefox 154

Moderate severity:

• CVE-2026-74950 Privilege escalation in the Downloads API component
• CVE-2026-74953 Privilege escalation in the Networking: Cookies component
• CVE-2026-74954 Information disclosure due to side-channel in the Storage: Cache API component
• CVE-2026-74955 Privilege escalation in the Request Handling component
• CVE-2026-74956 Same-origin policy bypass in the DOM: Service Workers component
• CVE-2026-74957 Mitigation bypass in the Safe Browsing component
• CVE-2026-74958 Information disclosure in the WebRTC component
• CVE-2026-74959 Mitigation bypass in the Storage: Cache API component
• CVE-2026-74960 Site isolation issue in the WebExtensions component
• CVE-2026-74961 Side-channel in the Web Audio component
• CVE-2026-74962 Site isolation issue in the Networking: Cookies component
• CVE-2026-74963 Same-origin policy bypass in the Networking: Cookies component
• CVE-2026-74964 Integer overflow in the Graphics component
• CVE-2026-74965 Privilege escalation in the Shell Integration component
• CVE-2026-74966 Information disclosure in the Form Autofill component
• CVE-2026-74967 Same-origin policy bypass in the Audio/Video: Playback component
• CVE-2026-74968 Site isolation issue in the Graphics: WebRender component
• CVE-2026-74969 Use-after-free in the Layout: Text and Fonts component
• CVE-2026-74970 Site isolation issue in the Graphics component
• CVE-2026-74971 Information disclosure in the DOM: UI Events & Focus Handling component
• CVE-2026-74972 Information disclosure in the DOM: Push Subscriptions component
• CVE-2026-74973 Race condition, use-after-free in the Graphics component
• CVE-2026-74974 Same-origin policy bypass in the Graphics: ImageLib component

Low severity:

• CVE-2026-74976 JIT miscompilation in the JavaScript Engine: JIT component
• CVE-2026-74977 Integer overflow in the Graphics component
• CVE-2026-74978 Clickjacking issue in the Widget component
• CVE-2026-74979 Mitigation bypass in the Add-ons Manager component
• CVE-2026-74981 Site isolation issue in the Audio/Video: Web Codecs component
• CVE-2026-74982 Denial-of-service in the Widget component
• CVE-2026-74983 Mitigation bypass in the Data Loss Prevention component
• CVE-2026-74984 Race condition in the JavaScript Engine component
• CVE-2026-74985 Privilege escalation in the Enterprise Policies component
• CVE-2026-74986 Site isolation issue in the CSS Parsing and Computation component

---

✅ SHA512:

ducksteps.153.1.0.AVX512.Setup.exe
e08693e40c1aa4d9cf4f626fcd840b79fadd91ddd5e1ea6925ad1b90134699791fc10eae19594ebfbfa0c9b007561523b8e46741135b0b8d4083aae094c014b2

ducksteps.153.1.0.AVX512.Standalone.7z
381212d8aa4dcc3b23faf7a4def0a6735bdfa68c5aa0260f4a07285cc457e24c46227ba02b93d6316e3d3882dffea0ac3dd89ac6e6970bad52707b8f59eb8ed6

ducksteps.153.1.0.Legacy.Setup.exe
bd7b22623dfd7c2c59d7abac832b45497f8912dd770d7a40dde4cf9e65af168d6ce702a2a38efbb4992c9d507db3197b841efae480fbc60a3332048b6bc8d797

ducksteps.153.1.0.Legacy.Standalone.7z
1023a3300affc1c475ed431afef3d5f864a150506e5fdb78d25eca55d96f4540ba382081ac94abb189f2fa88999aa662815aadb859464e6433b478e163e0f097

---

🚨 VirusTotal Results:

ducksteps.153.1.0.AVX512.Setup.exe

ducksteps.153.1.0.AVX512.Standalone.7z

ducksteps.153.1.0.Legacy.Setup.exe

ducksteps.153.1.0.Legacy.Standalone.7z

---

This discussion was created from the release ⛐ It's the "fifty-two CVEs, nineteen of them serious" release!.