Adding upstream version 115.7.0esr.upstream/115.7.0esrupstream

Signed-off-by: Daniel Baumann <daniel.baumann@progress-linux.org>

54 files changed, 10035 insertions, 0 deletions

diff --git a/browser/app/BrowserDefines.h b/browser/app/BrowserDefines.h
new file mode 100644
index 0000000000..6bffd584ff
--- /dev/null
+++ b/browser/app/BrowserDefines.h
@@ -0,0 +1,32 @@
+/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* vim: set ts=8 sts=2 et sw=2 tw=80: */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at https://mozilla.org/MPL/2.0/. */
+
+#ifndef mozilla_BrowserDefines_h
+#define mozilla_BrowserDefines_h
+
+#include <cstddef>
+#include "mozilla/CmdLineAndEnvUtils.h"
+
+namespace mozilla {
+namespace browser {
+constexpr static const char* kRequiredArguments[] = {"url", "private-window"};
+#ifdef XP_WIN
+#  define ATTEMPTING_DEELEVATION_FLAG "attempting-deelevation"
+constexpr static const char* kOptionalArguments[] = {
+    ATTEMPTING_DEELEVATION_FLAG};
+#else
+constexpr static auto kOptionalArguments = nullptr;
+#endif
+}  // namespace browser
+
+template <typename CharT>
+inline void EnsureBrowserCommandlineSafe(int aArgc, CharT** aArgv) {
+  mozilla::EnsureCommandlineSafe(aArgc, aArgv, browser::kRequiredArguments,
+                                 browser::kOptionalArguments);
+}
+}  // namespace mozilla
+
+#endif
diff --git a/browser/app/Makefile.in b/browser/app/Makefile.in
new file mode 100644
index 0000000000..54d6b43fe1
--- /dev/null
+++ b/browser/app/Makefile.in
@@ -0,0 +1,106 @@
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at http://mozilla.org/MPL/2.0/.
+
+dist_dest   = $(DIST)/$(MOZ_MACBUNDLE_NAME)
+
+# hardcode en-US for the moment
+AB_CD = en-US
+
+# Build a binary bootstrapping with XRE_main
+
+ifndef MOZ_WINCONSOLE
+ifneq (,$(MOZ_DEBUG)$(MOZ_ASAN))
+MOZ_WINCONSOLE = 1
+else
+MOZ_WINCONSOLE = 0
+endif
+endif
+
+include $(topsrcdir)/config/config.mk
+
+# If we are trying to show an error dialog about the lack of SSE2 support,
+# make sure that code itself doesn't use SSE2.
+ifdef MOZ_LINUX_32_SSE2_STARTUP_ERROR
+CXX := $(filter-out -march=% -msse -msse2 -mfpmath=sse,$(CXX))
+CXX += -march=pentiumpro
+endif
+
+ifeq ($(OS_ARCH),WINNT)
+# Rebuild firefox.exe if the manifest changes - it's included by splash.rc.
+# (this dependency should really be just for firefox.exe, not other targets)
+# Note the manifest file exists in the tree, so we use the explicit filename
+# here.
+EXTRA_DEPS += $(srcdir)/firefox.exe.manifest
+endif
+
+PROGRAMS_DEST = $(DIST)/bin
+objdir = $(topobjdir)/browser/app
+
+include $(topsrcdir)/config/rules.mk
+
+ifneq (,$(filter-out WINNT,$(OS_ARCH)))
+
+ifdef COMPILE_ENVIRONMENT
+ifndef MOZ_NO_PIE_COMPAT
+libs::
+	cp -p $(DIST)/bin/$(MOZ_APP_NAME)$(BIN_SUFFIX) $(DIST)/bin/$(MOZ_APP_NAME)-bin$(BIN_SUFFIX)
+endif
+endif
+
+endif
+
+# channel-prefs.js is handled separate from other prefs due to bug 756325
+# DO NOT change the content of channel-prefs.js without taking the appropriate
+# steps. See bug 1431342.
+libs:: $(srcdir)/profile/channel-prefs.js
+	$(NSINSTALL) -D $(DIST)/bin/defaults/pref
+	$(call py_action,preprocessor,-Fsubstitution $(PREF_PPFLAGS) $(ACDEFINES) $^ -o $(DIST)/bin/defaults/pref/channel-prefs.js)
+
+ifeq (cocoa,$(MOZ_WIDGET_TOOLKIT))
+
+MAC_APP_NAME = $(MOZ_APP_DISPLAYNAME)
+
+ifdef MOZ_DEBUG
+MAC_APP_NAME := $(MAC_APP_NAME)Debug
+endif
+
+AB_CD = $(MOZ_UI_LOCALE)
+
+ifeq (zh-TW,$(AB_CD))
+LPROJ_ROOT := $(subst -,_,$(AB_CD))
+else
+LPROJ_ROOT := $(firstword $(subst -, ,$(AB_CD)))
+endif
+LPROJ := Contents/Resources/$(LPROJ_ROOT).lproj
+
+repackage::
+	$(RM) -r $(dist_dest)
+
+MAC_BUNDLE_VERSION = $(shell $(PYTHON3) $(srcdir)/macversion.py --version=$(MOZ_APP_VERSION) --buildid=$(DEPTH)/buildid.h)
+
+.PHONY: repackage
+tools repackage:: $(DIST)/bin/$(MOZ_APP_NAME) $(objdir)/macbuild/Contents/MacOS-files.txt
+	rm -rf $(dist_dest)
+	$(MKDIR) -p '$(dist_dest)/Contents/MacOS'
+	$(MKDIR) -p '$(dist_dest)/$(LPROJ)'
+	rsync -a --exclude '*.in' $(srcdir)/macbuild/Contents '$(dist_dest)' --exclude English.lproj
+	rsync -a --exclude '*.in' $(srcdir)/macbuild/Contents/Resources/English.lproj/ '$(dist_dest)/$(LPROJ)'
+	$(call py_action,preprocessor,-Fsubstitution -DAPP_VERSION='$(MOZ_APP_VERSION)' -DMOZ_APP_NAME='$(MOZ_APP_NAME)' -DMAC_APP_NAME='$(MAC_APP_NAME)' -DMOZ_MACBUNDLE_ID='$(MOZ_MACBUNDLE_ID)' -DMAC_BUNDLE_VERSION='$(MAC_BUNDLE_VERSION)' -DMOZ_DEVELOPER_REPO_PATH='$(topsrcdir)' -DMOZ_DEVELOPER_OBJ_PATH='$(topobjdir)' $(srcdir)/macbuild/Contents/Info.plist.in -o '$(dist_dest)/Contents/Info.plist')
+	$(call py_action,preprocessor,-Fsubstitution --output-encoding utf-16 -DMAC_APP_NAME='$(MAC_APP_NAME)' $(srcdir)/macbuild/Contents/Resources/English.lproj/InfoPlist.strings.in -o '$(dist_dest)/$(LPROJ)/InfoPlist.strings')
+	rsync -a --exclude-from='$(objdir)/macbuild/Contents/MacOS-files.txt' $(DIST)/bin/ '$(dist_dest)/Contents/Resources'
+	rsync -a --include-from='$(objdir)/macbuild/Contents/MacOS-files.txt' --exclude '*' $(DIST)/bin/ '$(dist_dest)/Contents/MacOS'
+	# MacOS-files-copy.in is a list of files that should be copies rather
+	# than symlinks and placed in .app/Contents/MacOS.
+	rsync -aL --include-from='$(srcdir)/macbuild/Contents/MacOS-files-copy.in' --exclude '*' $(DIST)/bin/ '$(dist_dest)/Contents/MacOS'
+	$(RM) '$(dist_dest)/Contents/MacOS/$(MOZ_APP_NAME)'
+	rsync -aL $(DIST)/bin/$(MOZ_APP_NAME) '$(dist_dest)/Contents/MacOS'
+	cp -RL $(topsrcdir)/$(MOZ_BRANDING_DIRECTORY)/firefox.icns '$(dist_dest)/Contents/Resources/firefox.icns'
+	cp -RL $(topsrcdir)/$(MOZ_BRANDING_DIRECTORY)/document.icns '$(dist_dest)/Contents/Resources/document.icns'
+	$(MKDIR) -p '$(dist_dest)/Contents/Library/LaunchServices'
+ifdef MOZ_UPDATER
+	mv -f '$(dist_dest)/Contents/MacOS/updater.app/Contents/MacOS/org.mozilla.updater' '$(dist_dest)/Contents/Library/LaunchServices'
+	ln -s ../../../../Library/LaunchServices/org.mozilla.updater '$(dist_dest)/Contents/MacOS/updater.app/Contents/MacOS/org.mozilla.updater'
+endif
+	printf APPLMOZB > '$(dist_dest)/Contents/PkgInfo'
+endif
diff --git a/browser/app/firefox.exe.manifest b/browser/app/firefox.exe.manifest
new file mode 100644
index 0000000000..995b2fc869
--- /dev/null
+++ b/browser/app/firefox.exe.manifest
@@ -0,0 +1,47 @@
+<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
+<assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0">
+<assemblyIdentity
+        version="1.0.0.0"
+        processorArchitecture="*"
+        name="Firefox"
+        type="win32"
+/>
+<description>Firefox</description>
+<dependency>
+        <dependentAssembly>
+                <assemblyIdentity
+                        type="win32"
+                        name="Microsoft.Windows.Common-Controls"
+                        version="6.0.0.0"
+                        processorArchitecture="*"
+                        publicKeyToken="6595b64144ccf1df"
+                        language="*"
+                />
+        </dependentAssembly>
+</dependency>
+<dependency>
+        <dependentAssembly>
+                <assemblyIdentity
+                        type="win32"
+                        name="mozglue"
+                        version="1.0.0.0"
+                        language="*"
+                />
+        </dependentAssembly>
+</dependency>
+<ms_asmv3:trustInfo xmlns:ms_asmv3="urn:schemas-microsoft-com:asm.v3">
+  <ms_asmv3:security>
+    <ms_asmv3:requestedPrivileges>
+      <ms_asmv3:requestedExecutionLevel level="asInvoker" uiAccess="false" />
+    </ms_asmv3:requestedPrivileges>
+  </ms_asmv3:security>
+</ms_asmv3:trustInfo>
+  <compatibility xmlns="urn:schemas-microsoft-com:compatibility.v1">
+    <application>
+      <supportedOS Id="{8e0f7a12-bfb3-4fe8-b9a5-48fd50a15a9a}"/>
+      <supportedOS Id="{1f676c76-80e1-4239-95bb-83d0f6d0da78}"/>
+      <supportedOS Id="{4a2f28e3-53b9-4441-ba9c-d69d4a4a6e38}"/>
+      <supportedOS Id="{35138b9a-5d96-4fbd-8e2d-a2440225f93a}"/>
+    </application>
+  </compatibility>
+</assembly>
diff --git a/browser/app/macbuild/Contents/Info.plist.in b/browser/app/macbuild/Contents/Info.plist.in
new file mode 100644
index 0000000000..99849c6f06
--- /dev/null
+++ b/browser/app/macbuild/Contents/Info.plist.in
@@ -0,0 +1,279 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple Computer//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0">
+<dict>
+	<key>CFBundleDevelopmentRegion</key>
+	<string>English</string>
+	<key>CFBundleDocumentTypes</key>
+	<array>
+		<dict>
+			<key>CFBundleTypeExtensions</key>
+			<array>
+				<string>html</string>
+				<string>htm</string>
+				<string>shtml</string>
+				<string>xht</string>
+				<string>xhtml</string>
+			</array>
+			<key>CFBundleTypeIconFile</key>
+			<string>document.icns</string>
+			<key>CFBundleTypeName</key>
+			<string>HTML Document</string>
+			<key>CFBundleTypeOSTypes</key>
+			<array>
+				<string>HTML</string>
+			</array>
+			<key>CFBundleTypeRole</key>
+			<string>Viewer</string>
+		</dict>
+		<dict>
+			<key>CFBundleTypeExtensions</key>
+			<array>
+				<string>json</string>
+			</array>
+			<key>CFBundleTypeIconFile</key>
+			<string>document.icns</string>
+			<key>CFBundleTypeMIMETypes</key>
+			<array>
+				<string>application/json</string>
+			</array>
+			<key>CFBundleTypeName</key>
+			<string>JSON File</string>
+			<key>CFBundleTypeOSTypes</key>
+			<array>
+				<string>TEXT</string>
+			</array>
+			<key>CFBundleTypeRole</key>
+			<string>Viewer</string>
+		</dict>
+		<dict>
+			<key>CFBundleTypeExtensions</key>
+			<array>
+				<string>pdf</string>
+			</array>
+			<key>CFBundleTypeIconFile</key>
+			<string>document.icns</string>
+			<key>CFBundleTypeMIMETypes</key>
+			<array>
+				<string>application/pdf</string>
+			</array>
+			<key>CFBundleTypeName</key>
+			<string>PDF document</string>
+			<key>CFBundleTypeOSTypes</key>
+			<array>
+				<string>TEXT</string>
+			</array>
+			<key>CFBundleTypeRole</key>
+			<string>Viewer</string>
+			<key>LSHandlerRank</key>
+			<string>Alternate</string>
+		</dict>
+		<dict>
+			<key>CFBundleTypeExtensions</key>
+			<array>
+				<string>svg</string>
+			</array>
+			<key>CFBundleTypeIconFile</key>
+			<string>document.icns</string>
+			<key>CFBundleTypeMIMETypes</key>
+			<array>
+				<string>image/svg+xml</string>
+			</array>
+			<key>CFBundleTypeName</key>
+			<string>SVG document</string>
+			<key>CFBundleTypeOSTypes</key>
+			<array>
+				<string>TEXT</string>
+			</array>
+			<key>CFBundleTypeRole</key>
+			<string>Viewer</string>
+			<key>NSDocumentClass</key>
+			<string>BrowserDocument</string>
+		</dict>
+		<dict>
+			<key>CFBundleTypeExtensions</key>
+			<array>
+			    <string>text</string>
+				<string>txt</string>
+				<string>js</string>
+				<string>log</string>
+				<string>css</string>
+				<string>xul</string>
+				<string>rdf</string>
+			</array>
+			<key>CFBundleTypeIconFile</key>
+			<string>document.icns</string>
+			<key>CFBundleTypeName</key>
+			<string>Text Document</string>
+			<key>CFBundleTypeOSTypes</key>
+			<array>
+				<string>TEXT</string>
+				<string>utxt</string>
+			</array>
+			<key>CFBundleTypeRole</key>
+			<string>Viewer</string>
+		</dict>
+		<dict>
+			<key>CFBundleTypeExtensions</key>
+			<array>
+				<string>jpeg</string>
+				<string>jpg</string>
+				<string>png</string>
+				<string>gif</string>
+			</array>
+			<key>CFBundleTypeIconFile</key>
+			<string>fileBookmark.icns</string>
+			<key>CFBundleTypeName</key>
+			<string>document.icns</string>
+			<key>CFBundleTypeOSTypes</key>
+			<array>
+				<string>GIFf</string>
+				<string>JPEG</string>
+				<string>PNGf</string>
+			</array>
+			<key>CFBundleTypeRole</key>
+			<string>Viewer</string>
+		</dict>
+		<dict>
+			<key>CFBundleTypeExtensions</key>
+			<array>
+				<string>oga</string>
+				<string>ogg</string>
+			</array>
+			<key>CFBundleTypeIconFile</key>
+			<string>document.icns</string>
+			<key>CFBundleTypeMIMETypes</key>
+			<array>
+				<string>audio/ogg</string>
+			</array>
+			<key>CFBundleTypeName</key>
+			<string>HTML5 Audio (Ogg)</string>
+			<key>CFBundleTypeRole</key>
+			<string>Viewer</string>
+		</dict>
+		<dict>
+			<key>CFBundleTypeExtensions</key>
+			<array>
+				<string>ogv</string>
+			</array>
+			<key>CFBundleTypeIconFile</key>
+			<string>document.icns</string>
+			<key>CFBundleTypeMIMETypes</key>
+			<array>
+				<string>video/ogg</string>
+			</array>
+			<key>CFBundleTypeName</key>
+			<string>HTML5 Video (Ogg)</string>
+			<key>CFBundleTypeRole</key>
+			<string>Viewer</string>
+		</dict>
+		<dict>
+			<key>CFBundleTypeExtensions</key>
+			<array>
+				<string>webm</string>
+			</array>
+			<key>CFBundleTypeIconFile</key>
+			<string>document.icns</string>
+			<key>CFBundleTypeMIMETypes</key>
+			<array>
+				<string>video/webm</string>
+			</array>
+			<key>CFBundleTypeName</key>
+			<string>HTML5 Video (WebM)</string>
+			<key>CFBundleTypeRole</key>
+			<string>Viewer</string>
+		</dict>
+	</array>
+	<key>CFBundleExecutable</key>
+	<string>@MOZ_APP_NAME@</string>
+	<key>CFBundleGetInfoString</key>
+	<string>@MAC_APP_NAME@ @APP_VERSION@</string>
+	<key>CFBundleIconFile</key>
+	<string>firefox.icns</string>
+	<key>CFBundleIdentifier</key>
+	<string>@MOZ_MACBUNDLE_ID@</string>
+	<key>CFBundleInfoDictionaryVersion</key>
+	<string>6.0</string>
+	<key>CFBundleName</key>
+	<string>@MAC_APP_NAME@</string>
+	<key>CFBundlePackageType</key>
+	<string>APPL</string>
+	<key>CFBundleShortVersionString</key>
+	<string>@APP_VERSION@</string>
+	<key>CFBundleSignature</key>
+	<string>MOZB</string>
+	<key>CFBundleURLTypes</key>
+	<array>
+		<dict>
+			<key>CFBundleURLIconFile</key>
+			<string>document.icns</string>
+			<key>CFBundleURLName</key>
+			<string>http URL</string>
+			<key>CFBundleURLSchemes</key>
+			<array>
+				<string>http</string>
+			</array>
+		</dict>
+		<dict>
+			<key>CFBundleURLIconFile</key>
+			<string>document.icns</string>
+			<key>CFBundleURLName</key>
+			<string>https URL</string>
+			<key>CFBundleURLSchemes</key>
+			<array>
+				<string>https</string>
+			</array>
+		</dict>
+		<dict>
+			<key>CFBundleURLName</key>
+			<string>file URL</string>
+			<key>CFBundleURLSchemes</key>
+			<array>
+				<string>file</string>
+			</array>
+		</dict>
+	</array>
+	<key>CFBundleVersion</key>
+	<string>@MAC_BUNDLE_VERSION@</string>
+	<key>NSUserActivityTypes</key>
+	<array>
+		<string>NSUserActivityTypeBrowsingWeb</string>
+	</array>
+	<key>NSAppleScriptEnabled</key>
+	<true/>
+	<key>LSApplicationCategoryType</key>
+	<string>public.app-category.productivity</string>
+	<key>LSEnvironment</key>
+	<dict>
+		<key>MallocNanoZone</key>
+		<string>0</string>
+		<key>SYSTEM_VERSION_COMPAT</key>
+		<string>0</string>
+	</dict>
+	<key>LSFileQuarantineEnabled</key>
+	<true/>
+	<key>LSMinimumSystemVersion</key>
+	<string>10.12.0</string>
+  <key>NSSupportsAutomaticGraphicsSwitching</key>
+  <true/>
+  <key>NSRequiresAquaSystemAppearance</key>
+  <false/>
+  <key>NSPrincipalClass</key>
+  <string>GeckoNSApplication</string>
+	<key>SMPrivilegedExecutables</key>
+	<dict>
+		<key>org.mozilla.updater</key>
+		<string>identifier "org.mozilla.updater" and ((anchor apple generic and certificate leaf[field.1.2.840.113635.100.6.1.9]) or (anchor apple generic and certificate 1[field.1.2.840.113635.100.6.2.6] and certificate leaf[field.1.2.840.113635.100.6.1.13] and certificate leaf[subject.OU] = "43AQ936H96"))</string>
+	</dict>
+  <key>MozillaDeveloperRepoPath</key>
+  <string>@MOZ_DEVELOPER_REPO_PATH@</string>
+  <key>MozillaDeveloperObjPath</key>
+  <string>@MOZ_DEVELOPER_OBJ_PATH@</string>
+
+  <key>NSCameraUsageDescription</key>
+  <string>Only sites you allow within @MAC_APP_NAME@ will be able to use the camera.</string>
+
+  <key>NSMicrophoneUsageDescription</key>
+  <string>Only sites you allow within @MAC_APP_NAME@ will be able to use the microphone.</string>
+</dict>
+</plist>
diff --git a/browser/app/macbuild/Contents/MacOS-files-copy.in b/browser/app/macbuild/Contents/MacOS-files-copy.in
new file mode 100644
index 0000000000..e9d0f0efb9
--- /dev/null
+++ b/browser/app/macbuild/Contents/MacOS-files-copy.in
@@ -0,0 +1,11 @@
+# Specifies files that should be copied (via deep copy, resolving symlinks)
+# from dist/bin to the .app/Contents/MacOS directory. Linking is preferred to
+# reduce disk I/O during builds, so just include dylibs which need to be in the
+# same directory as returned by dladddr(3).
+#
+# Some of these dylibs load other dylibs which are assumed to be siblings in
+# the same directory obtained from dladdr(3). With macOS 10.15, dladdr returns
+# absolute resolved paths which breaks this assumption if symlinks are used
+# because the symlink targets are in different directories. Hence the need for
+# them to be copied to the same directory.
+/*.dylib
diff --git a/browser/app/macbuild/Contents/MacOS-files.in b/browser/app/macbuild/Contents/MacOS-files.in
new file mode 100644
index 0000000000..6f0b448147
--- /dev/null
+++ b/browser/app/macbuild/Contents/MacOS-files.in
@@ -0,0 +1,24 @@
+#if 0
+; Specifies files that should be copied (preserving symlinks) from dist/bin
+; to the .app/Contents/MacOS directory.
+#endif
+#filter substitution
+/*.app/***
+/certutil
+/@MOZ_APP_NAME@-bin
+#if defined(MOZ_GECKODRIVER)
+/geckodriver
+#endif
+/gtest/***
+/http3server
+#if defined(MOZ_ASAN) || defined(MOZ_TSAN)
+/llvm-symbolizer
+#endif
+#if defined(MOZ_CRASHREPORTER)
+/minidump-analyzer
+#endif
+/pingsender
+/pk12util
+/ssltunnel
+/xpcshell
+/XUL
diff --git a/browser/app/macbuild/Contents/Resources/English.lproj/InfoPlist.strings.in b/browser/app/macbuild/Contents/Resources/English.lproj/InfoPlist.strings.in
new file mode 100644
index 0000000000..c84535de6a
--- /dev/null
+++ b/browser/app/macbuild/Contents/Resources/English.lproj/InfoPlist.strings.in
@@ -0,0 +1,5 @@
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+CFBundleName = "@MAC_APP_NAME@";
diff --git a/browser/app/macbuild/Contents/moz.build b/browser/app/macbuild/Contents/moz.build
new file mode 100644
index 0000000000..b8b28926de
--- /dev/null
+++ b/browser/app/macbuild/Contents/moz.build
@@ -0,0 +1,25 @@
+# -*- Mode: python; indent-tabs-mode: nil; tab-width: 40 -*-
+# vim: set filetype=python:
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at http://mozilla.org/MPL/2.0/.
+
+defs = []
+
+for s in (
+    "MOZ_GECKODRIVER",
+    "MOZ_ASAN",
+    "MOZ_TSAN",
+    "MOZ_CRASHREPORTER",
+    "MOZ_APP_NAME",
+):
+    if CONFIG[s]:
+        defs.append("-D%s=%s" % (s, "1" if CONFIG[s] is True else CONFIG[s]))
+
+GeneratedFile(
+    "MacOS-files.txt",
+    script="/python/mozbuild/mozbuild/action/preprocessor.py",
+    entry_point="generate",
+    inputs=["MacOS-files.in"],
+    flags=defs,
+)
diff --git a/browser/app/macversion.py b/browser/app/macversion.py
new file mode 100644
index 0000000000..878fb09640
--- /dev/null
+++ b/browser/app/macversion.py
@@ -0,0 +1,46 @@
+#!/usr/bin/python
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at http://mozilla.org/MPL/2.0/.
+
+import io
+import re
+import sys
+from optparse import OptionParser
+
+o = OptionParser()
+o.add_option("--buildid", dest="buildid")
+o.add_option("--version", dest="version")
+
+(options, args) = o.parse_args()
+
+if not options.buildid:
+    print("--buildid is required", file=sys.stderr)
+    sys.exit(1)
+
+if not options.version:
+    print("--version is required", file=sys.stderr)
+    sys.exit(1)
+
+# We want to build a version number that matches the format allowed for
+# CFBundleVersion (nnnnn[.nn[.nn]]). We'll incorporate both the version
+# number as well as the date, so that it changes at least daily (for nightly
+# builds), but also so that newly-built older versions (e.g. beta build) aren't
+# considered "newer" than previously-built newer versions (e.g. a trunk nightly)
+
+define, MOZ_BUILDID, buildid = (
+    io.open(options.buildid, "r", encoding="utf-8").read().split()
+)
+
+# extract only the major version (i.e. "14" from "14.0b1")
+majorVersion = re.match(r"^(\d+)[^\d].*", options.version).group(1)
+# last two digits of the year
+twodigityear = buildid[2:4]
+month = buildid[4:6]
+if month[0] == "0":
+    month = month[1]
+day = buildid[6:8]
+if day[0] == "0":
+    day = day[1]
+
+print("%s.%s.%s" % (majorVersion + twodigityear, month, day))
diff --git a/browser/app/module.ver b/browser/app/module.ver
new file mode 100644
index 0000000000..5ef8d2a02a
--- /dev/null
+++ b/browser/app/module.ver
@@ -0,0 +1,8 @@
+WIN32_MODULE_COMPANYNAME=Mozilla Corporation
+WIN32_MODULE_COPYRIGHT=©Firefox and Mozilla Developers; available under the MPL 2 license.
+WIN32_MODULE_PRODUCTVERSION=@MOZ_APP_WINVERSION@
+WIN32_MODULE_PRODUCTVERSION_STRING=@MOZ_APP_VERSION@
+WIN32_MODULE_TRADEMARKS=Firefox is a Trademark of The Mozilla Foundation.
+WIN32_MODULE_DESCRIPTION=@MOZ_APP_DISPLAYNAME@
+WIN32_MODULE_PRODUCTNAME=@MOZ_APP_DISPLAYNAME@
+WIN32_MODULE_NAME=@MOZ_APP_DISPLAYNAME@
diff --git a/browser/app/moz.build b/browser/app/moz.build
new file mode 100644
index 0000000000..fcf98d6d48
--- /dev/null
+++ b/browser/app/moz.build
@@ -0,0 +1,167 @@
+# -*- Mode: python; indent-tabs-mode: nil; tab-width: 40 -*-
+# vim: set filetype=python:
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at http://mozilla.org/MPL/2.0/.
+
+with Files("**"):
+    BUG_COMPONENT = ("Firefox", "General")
+
+with Files("firefox.exe.manifest"):
+    BUG_COMPONENT = ("Core", "Widget: Win32")
+with Files("module.ver"):
+    BUG_COMPONENT = ("Core", "Widget: Win32")
+with Files("splash.rc"):
+    BUG_COMPONENT = ("Core", "Widget: Win32")
+
+with Files("macversion.py"):
+    BUG_COMPONENT = ("Core", "Widget: Cocoa")
+with Files("macbuild/**"):
+    BUG_COMPONENT = ("Core", "Widget: Cocoa")
+
+with Files("moz.build"):
+    BUG_COMPONENT = ("Firefox Build System", "General")
+with Files("Makefile.in"):
+    BUG_COMPONENT = ("Firefox Build System", "General")
+
+with Files("profile/channel-prefs.js"):
+    BUG_COMPONENT = ("Firefox", "Installer")
+with Files("profile/firefox.js"):
+    BUG_COMPONENT = ("Firefox", "General")
+
+if CONFIG["MOZ_MACBUNDLE_NAME"]:
+    DIRS += ["macbuild/Contents"]
+
+if CONFIG["MOZ_NO_PIE_COMPAT"]:
+    GeckoProgram(CONFIG["MOZ_APP_NAME"] + "-bin")
+
+    DIRS += ["no-pie"]
+else:
+    GeckoProgram(CONFIG["MOZ_APP_NAME"])
+
+SOURCES += [
+    "nsBrowserApp.cpp",
+]
+
+# Neither channel-prefs.js nor firefox.exe want to end up in dist/bin/browser.
+DIST_SUBDIR = ""
+
+LOCAL_INCLUDES += [
+    "!/build",
+    "/toolkit/xre",
+    "/xpcom/base",
+    "/xpcom/build",
+]
+
+if CONFIG["LIBFUZZER"]:
+    USE_LIBS += ["fuzzer"]
+    LOCAL_INCLUDES += [
+        "/tools/fuzzing/libfuzzer",
+    ]
+
+if CONFIG["MOZ_GECKODRIVER"]:
+    DEFINES["MOZ_GECKODRIVER"] = True
+
+if CONFIG["CC_TYPE"] == "clang-cl":
+    # Always enter a Windows program through wmain, whether or not we're
+    # a console application.
+    WIN32_EXE_LDFLAGS += ["-ENTRY:wmainCRTStartup"]
+
+if CONFIG["OS_ARCH"] == "WINNT":
+    RCINCLUDE = "splash.rc"
+    DIRS += [
+        "pbproxy",
+        "winlauncher",
+    ]
+    USE_LIBS += [
+        "winlauncher",
+    ]
+    LOCAL_INCLUDES += [
+        "/browser/app/winlauncher",
+    ]
+    OS_LIBS += [
+        "advapi32",
+        "shell32",
+        "uuid",
+    ]
+    DELAYLOAD_DLLS += [
+        "advapi32.dll",
+        "oleaut32.dll",
+        "ole32.dll",
+        "rpcrt4.dll",
+        "shell32.dll",
+        "version.dll",
+    ]
+
+    if CONFIG["CC_TYPE"] == "clang-cl":
+        libpath_flag = "-LIBPATH:"
+    else:
+        libpath_flag = "-L"
+
+    WIN32_EXE_LDFLAGS += [
+        libpath_flag + OBJDIR + "/winlauncher/freestanding",
+    ]
+
+    # Don't build firefox.exe with CETCOMPAT, because we need to be able to
+    # only enable it for processes that are not using JIT in xul.dll.
+    LINK_FLAGS["CETCOMPAT"] = []
+
+if CONFIG["OS_ARCH"] == "Darwin":
+    OS_LIBS += [
+        "-framework CoreFoundation",
+    ]
+
+if CONFIG["MOZ_SANDBOX"] and CONFIG["OS_ARCH"] == "WINNT":
+    # For sandbox includes and the include dependencies those have
+    LOCAL_INCLUDES += [
+        "/security/sandbox/chromium",
+        "/security/sandbox/chromium-shim",
+    ]
+
+    USE_LIBS += [
+        "sandbox_s",
+    ]
+
+    OS_LIBS += [
+        "winmm",
+    ]
+    DELAYLOAD_DLLS += [
+        "winmm.dll",
+        "user32.dll",
+        "usp10.dll",
+    ]
+
+# Control the default heap size.
+# This is the heap returned by GetProcessHeap().
+# As we use the CRT heap, the default size is too large and wastes VM.
+#
+# The default heap size is 1MB on Win32.
+# The heap will grow if need be.
+#
+# Set it to 256k.  See bug 127069.
+if CONFIG["OS_ARCH"] == "WINNT" and CONFIG["CC_TYPE"] not in ("clang", "gcc"):
+    LDFLAGS += ["/HEAP:0x40000"]
+
+DisableStlWrapping()
+
+if CONFIG["HAVE_CLOCK_MONOTONIC"]:
+    OS_LIBS += CONFIG["REALTIME_LIBS"]
+
+if CONFIG["MOZ_LINUX_32_SSE2_STARTUP_ERROR"]:
+    DEFINES["MOZ_LINUX_32_SSE2_STARTUP_ERROR"] = True
+    COMPILE_FLAGS["OS_CXXFLAGS"] = [
+        f
+        for f in COMPILE_FLAGS.get("OS_CXXFLAGS", [])
+        if not f.startswith("-march=") and f not in ("-msse", "-msse2", "-mfpmath=sse")
+    ] + [
+        "-mno-sse",
+        "-mno-sse2",
+        "-mfpmath=387",
+    ]
+
+for icon in ("firefox", "document", "newwindow", "newtab", "pbmode", "document_pdf"):
+    DEFINES[icon.upper() + "_ICO"] = '"%s/%s/%s.ico"' % (
+        TOPSRCDIR,
+        CONFIG["MOZ_BRANDING_DIRECTORY"],
+        icon,
+    )
diff --git a/browser/app/no-pie/NoPie.c b/browser/app/no-pie/NoPie.c
new file mode 100644
index 0000000000..39b206e0af
--- /dev/null
+++ b/browser/app/no-pie/NoPie.c
@@ -0,0 +1,26 @@
+/* -*- Mode: C++; tab-width: 2; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#include <errno.h>
+#include <limits.h>
+#include <stdio.h>
+#include <string.h>
+#include <unistd.h>
+
+int main(int argc, char* argv[]) {
+  // Ideally, we'd use mozilla::BinaryPath, but that pulls in stdc++compat,
+  // and further causes trouble linking with LTO.
+  char path[PATH_MAX + 4];
+  ssize_t len = readlink("/proc/self/exe", path, PATH_MAX - 1);
+  if (len < 0) {
+    fprintf(stderr, "Couldn't find the application directory.\n");
+    return 255;
+  }
+  strcpy(path + len, "-bin");
+  execv(path, argv);
+  // execv never returns. If it did, there was an error.
+  fprintf(stderr, "Exec failed with error: %s\n", strerror(errno));
+  return 255;
+}
diff --git a/browser/app/no-pie/moz.build b/browser/app/no-pie/moz.build
new file mode 100644
index 0000000000..74aa89409d
--- /dev/null
+++ b/browser/app/no-pie/moz.build
@@ -0,0 +1,24 @@
+# -*- Mode: python; indent-tabs-mode: nil; tab-width: 40 -*-
+# vim: set filetype=python:
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at http://mozilla.org/MPL/2.0/.
+
+Program(CONFIG["MOZ_APP_NAME"])
+
+SOURCES += [
+    "NoPie.c",
+]
+
+# For some reason, LTO messes things up. We don't care anyways.
+CFLAGS += [
+    "-fno-lto",
+]
+
+# Use OS_LIBS instead of LDFLAGS to "force" the flag to come after -pie
+# from MOZ_PROGRAM_LDFLAGS.
+if CONFIG["CC_TYPE"] == "clang":
+    # clang < 5.0 doesn't support -no-pie.
+    OS_LIBS += ["-nopie"]
+else:
+    OS_LIBS += ["-no-pie"]
diff --git a/browser/app/nsBrowserApp.cpp b/browser/app/nsBrowserApp.cpp
new file mode 100644
index 0000000000..3145342155
--- /dev/null
+++ b/browser/app/nsBrowserApp.cpp
@@ -0,0 +1,469 @@
+/* -*- Mode: C++; tab-width: 2; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#include "nsXULAppAPI.h"
+#include "mozilla/XREAppData.h"
+#include "XREShellData.h"
+#include "application.ini.h"
+#include "mozilla/Bootstrap.h"
+#include "mozilla/ProcessType.h"
+#include "mozilla/RuntimeExceptionModule.h"
+#include "mozilla/ScopeExit.h"
+#include "BrowserDefines.h"
+#if defined(XP_WIN)
+#  include <windows.h>
+#  include <stdlib.h>
+#elif defined(XP_UNIX)
+#  include <sys/resource.h>
+#  include <unistd.h>
+#  include <fcntl.h>
+#endif
+
+#include <stdio.h>
+#include <stdarg.h>
+#include <time.h>
+
+#include "nsCOMPtr.h"
+
+#ifdef XP_WIN
+#  include "mozilla/PreXULSkeletonUI.h"
+#  include "freestanding/SharedSection.h"
+#  include "LauncherProcessWin.h"
+#  include "mozilla/GeckoArgs.h"
+#  include "mozilla/mscom/ProcessRuntime.h"
+#  include "mozilla/WindowsDllBlocklist.h"
+#  include "mozilla/WindowsDpiInitialization.h"
+#  include "mozilla/WindowsProcessMitigations.h"
+
+#  define XRE_WANT_ENVIRON
+#  define strcasecmp _stricmp
+#  ifdef MOZ_SANDBOX
+#    include "mozilla/sandboxing/SandboxInitialization.h"
+#  endif
+#endif
+#include "BinaryPath.h"
+
+#include "nsXPCOMPrivate.h"  // for MAXPATHLEN and XPCOM_DLL
+
+#include "mozilla/Sprintf.h"
+#include "mozilla/StartupTimeline.h"
+#include "BaseProfiler.h"
+
+#ifdef LIBFUZZER
+#  include "FuzzerDefs.h"
+#endif
+
+#ifdef MOZ_LINUX_32_SSE2_STARTUP_ERROR
+#  include <cpuid.h>
+#  include "mozilla/Unused.h"
+
+static bool IsSSE2Available() {
+  // The rest of the app has been compiled to assume that SSE2 is present
+  // unconditionally, so we can't use the normal copy of SSE.cpp here.
+  // Since SSE.cpp caches the results and we need them only transiently,
+  // instead of #including SSE.cpp here, let's just inline the specific check
+  // that's needed.
+  unsigned int level = 1u;
+  unsigned int eax, ebx, ecx, edx;
+  unsigned int bits = (1u << 26);
+  unsigned int max = __get_cpuid_max(0, nullptr);
+  if (level > max) {
+    return false;
+  }
+  __cpuid_count(level, 0, eax, ebx, ecx, edx);
+  return (edx & bits) == bits;
+}
+
+static const char sSSE2Message[] =
+    "This browser version requires a processor with the SSE2 instruction "
+    "set extension.\nYou may be able to obtain a version that does not "
+    "require SSE2 from your Linux distribution.\n";
+
+__attribute__((constructor)) static void SSE2Check() {
+  if (IsSSE2Available()) {
+    return;
+  }
+  // Using write() in order to avoid jemalloc-based buffering. Ignoring return
+  // values, since there isn't much we could do on failure and there is no
+  // point in trying to recover from errors.
+  MOZ_UNUSED(
+      write(STDERR_FILENO, sSSE2Message, MOZ_ARRAY_LENGTH(sSSE2Message) - 1));
+  // _exit() instead of exit() to avoid running the usual "at exit" code.
+  _exit(255);
+}
+#endif
+
+#if !defined(MOZ_WIDGET_COCOA) && !defined(MOZ_WIDGET_ANDROID)
+#  define MOZ_BROWSER_CAN_BE_CONTENTPROC
+#  include "../../ipc/contentproc/plugin-container.cpp"
+#endif
+
+using namespace mozilla;
+
+#ifdef XP_MACOSX
+#  define kOSXResourcesFolder "Resources"
+#endif
+#define kDesktopFolder "browser"
+
+static MOZ_FORMAT_PRINTF(1, 2) void Output(const char* fmt, ...) {
+  va_list ap;
+  va_start(ap, fmt);
+
+#ifndef XP_WIN
+  vfprintf(stderr, fmt, ap);
+#else
+  char msg[2048];
+  vsnprintf_s(msg, _countof(msg), _TRUNCATE, fmt, ap);
+
+  wchar_t wide_msg[2048];
+  MultiByteToWideChar(CP_UTF8, 0, msg, -1, wide_msg, _countof(wide_msg));
+#  if MOZ_WINCONSOLE
+  fwprintf_s(stderr, wide_msg);
+#  else
+  // Linking user32 at load-time interferes with the DLL blocklist (bug 932100).
+  // This is a rare codepath, so we can load user32 at run-time instead.
+  HMODULE user32 = LoadLibraryW(L"user32.dll");
+  if (user32) {
+    decltype(MessageBoxW)* messageBoxW =
+        (decltype(MessageBoxW)*)GetProcAddress(user32, "MessageBoxW");
+    if (messageBoxW) {
+      messageBoxW(nullptr, wide_msg, L"Firefox",
+                  MB_OK | MB_ICONERROR | MB_SETFOREGROUND);
+    }
+    FreeLibrary(user32);
+  }
+#  endif
+#endif
+
+  va_end(ap);
+}
+
+/**
+ * Return true if |arg| matches the given argument name.
+ */
+static bool IsArg(const char* arg, const char* s) {
+  if (*arg == '-') {
+    if (*++arg == '-') ++arg;
+    return !strcasecmp(arg, s);
+  }
+
+#if defined(XP_WIN)
+  if (*arg == '/') return !strcasecmp(++arg, s);
+#endif
+
+  return false;
+}
+
+Bootstrap::UniquePtr gBootstrap;
+
+static int do_main(int argc, char* argv[], char* envp[]) {
+  // Allow firefox.exe to launch XULRunner apps via -app <application.ini>
+  // Note that -app must be the *first* argument.
+  const char* appDataFile = getenv("XUL_APP_FILE");
+  if ((!appDataFile || !*appDataFile) && (argc > 1 && IsArg(argv[1], "app"))) {
+    if (argc == 2) {
+      Output("Incorrect number of arguments passed to -app");
+      return 255;
+    }
+    appDataFile = argv[2];
+
+    char appEnv[MAXPATHLEN];
+    SprintfLiteral(appEnv, "XUL_APP_FILE=%s", argv[2]);
+    if (putenv(strdup(appEnv))) {
+      Output("Couldn't set %s.\n", appEnv);
+      return 255;
+    }
+    argv[2] = argv[0];
+    argv += 2;
+    argc -= 2;
+  } else if (argc > 1 && IsArg(argv[1], "xpcshell")) {
+    for (int i = 1; i < argc; i++) {
+      argv[i] = argv[i + 1];
+    }
+
+    XREShellData shellData;
+#if defined(XP_WIN) && defined(MOZ_SANDBOX)
+    shellData.sandboxBrokerServices =
+        sandboxing::GetInitializedBrokerServices();
+#endif
+
+#ifdef LIBFUZZER
+    shellData.fuzzerDriver = fuzzer::FuzzerDriver;
+#endif
+
+    return gBootstrap->XRE_XPCShellMain(--argc, argv, envp, &shellData);
+  }
+
+  BootstrapConfig config;
+
+  if (appDataFile && *appDataFile) {
+    config.appData = nullptr;
+    config.appDataPath = appDataFile;
+  } else {
+    // no -app flag so we use the compiled-in app data
+    config.appData = &sAppData;
+    config.appDataPath = kDesktopFolder;
+  }
+
+#if defined(XP_WIN) && defined(MOZ_SANDBOX)
+  sandbox::BrokerServices* brokerServices =
+      sandboxing::GetInitializedBrokerServices();
+  if (!brokerServices) {
+    Output("Couldn't initialize the broker services.\n");
+    return 255;
+  }
+  config.sandboxBrokerServices = brokerServices;
+#endif
+
+#ifdef LIBFUZZER
+  if (getenv("FUZZER"))
+    gBootstrap->XRE_LibFuzzerSetDriver(fuzzer::FuzzerDriver);
+#endif
+
+  EnsureBrowserCommandlineSafe(argc, argv);
+
+  return gBootstrap->XRE_main(argc, argv, config);
+}
+
+static nsresult InitXPCOMGlue(LibLoadingStrategy aLibLoadingStrategy) {
+  if (gBootstrap) {
+    return NS_OK;
+  }
+
+  UniqueFreePtr<char> exePath = BinaryPath::Get();
+  if (!exePath) {
+    Output("Couldn't find the application directory.\n");
+    return NS_ERROR_FAILURE;
+  }
+
+  auto bootstrapResult =
+      mozilla::GetBootstrap(exePath.get(), aLibLoadingStrategy);
+  if (bootstrapResult.isErr()) {
+    Output("Couldn't load XPCOM.\n");
+    return NS_ERROR_FAILURE;
+  }
+
+  gBootstrap = bootstrapResult.unwrap();
+
+  // This will set this thread as the main thread.
+  gBootstrap->NS_LogInit();
+
+  return NS_OK;
+}
+
+#ifdef HAS_DLL_BLOCKLIST
+// NB: This must be extern, as this value is checked elsewhere
+uint32_t gBlocklistInitFlags = eDllBlocklistInitFlagDefault;
+#endif
+
+#if defined(XP_UNIX)
+static void ReserveDefaultFileDescriptors() {
+  // Reserve the lower positions of the file descriptors to make sure
+  // we don't reuse stdin/stdout/stderr in case they we closed
+  // before launch.
+  // Otherwise code explicitly writing to fd 1 or 2 might accidentally
+  // write to something else, like in bug 1820896 where FD 1 is
+  // reused for the X server display connection.
+  int fd = open("/dev/null", O_RDONLY);
+  for (int i = 0; i < 2; i++) {
+    mozilla::Unused << dup(fd);
+  }
+}
+#endif
+
+int main(int argc, char* argv[], char* envp[]) {
+#if defined(XP_UNIX)
+  ReserveDefaultFileDescriptors();
+#endif
+#if defined(MOZ_ENABLE_FORKSERVER)
+  if (strcmp(argv[argc - 1], "forkserver") == 0) {
+    nsresult rv = InitXPCOMGlue(LibLoadingStrategy::NoReadAhead);
+    if (NS_FAILED(rv)) {
+      return 255;
+    }
+
+    // Run a fork server in this process, single thread.  When it
+    // returns, it means the fork server have been stopped or a new
+    // content process is created.
+    //
+    // For the later case, XRE_ForkServer() will return false, running
+    // in a content process just forked from the fork server process.
+    // argc & argv will be updated with the values passing from the
+    // chrome process.  With the new values, this function
+    // continues the reset of the code acting as a content process.
+    if (gBootstrap->XRE_ForkServer(&argc, &argv)) {
+      // Return from the fork server in the fork server process.
+      // Stop the fork server.
+      gBootstrap->NS_LogTerm();
+      return 0;
+    }
+    // In a content process forked from the fork server.
+    // Start acting as a content process.
+  }
+#endif
+
+  mozilla::TimeStamp start = mozilla::TimeStamp::Now();
+
+  AUTO_BASE_PROFILER_INIT;
+  AUTO_BASE_PROFILER_LABEL("nsBrowserApp main", OTHER);
+
+  // Make sure we unregister the runtime exception module before returning.
+  // We do this here to cover both registers for child and main processes.
+  auto unregisterRuntimeExceptionModule =
+      MakeScopeExit([] { CrashReporter::UnregisterRuntimeExceptionModule(); });
+
+#ifdef MOZ_BROWSER_CAN_BE_CONTENTPROC
+  // We are launching as a content process, delegate to the appropriate
+  // main
+  if (argc > 1 && IsArg(argv[1], "contentproc")) {
+    // Set the process type. We don't remove the arg here as that will be done
+    // later in common code.
+    SetGeckoProcessType(argv[argc - 1]);
+
+    // Register an external module to report on otherwise uncatchable
+    // exceptions. Note that in child processes this must be called after Gecko
+    // process type has been set.
+    CrashReporter::RegisterRuntimeExceptionModule();
+
+#  if defined(XP_WIN) && defined(MOZ_SANDBOX)
+    // We need to set whether our process is supposed to have win32k locked down
+    // from the command line setting before DllBlocklist_Initialize,
+    // GetInitializedTargetServices and WindowsDpiInitialization.
+    Maybe<bool> win32kLockedDown =
+        mozilla::geckoargs::sWin32kLockedDown.Get(argc, argv);
+    if (win32kLockedDown.isSome() && *win32kLockedDown) {
+      mozilla::SetWin32kLockedDownInPolicy();
+    }
+#  endif
+
+#  ifdef HAS_DLL_BLOCKLIST
+    uint32_t initFlags =
+        gBlocklistInitFlags | eDllBlocklistInitFlagIsChildProcess;
+    SetDllBlocklistProcessTypeFlags(initFlags, GetGeckoProcessType());
+    DllBlocklist_Initialize(initFlags);
+#  endif  // HAS_DLL_BLOCKLIST
+
+#  if defined(XP_WIN) && defined(MOZ_SANDBOX)
+    // We need to initialize the sandbox TargetServices before InitXPCOMGlue
+    // because we might need the sandbox broker to give access to some files.
+    if (IsSandboxedProcess() && !sandboxing::GetInitializedTargetServices()) {
+      Output("Failed to initialize the sandbox target services.");
+      return 255;
+    }
+#  endif
+#  if defined(XP_WIN)
+    // Ideally, we would be able to set our DPI awareness in
+    // firefox.exe.manifest Unfortunately, that would cause Win32k calls when
+    // user32.dll gets loaded, which would be incompatible with Win32k Lockdown
+    //
+    // MSDN says that it's allowed-but-not-recommended to initialize DPI
+    // programatically, as long as it's done before any HWNDs are created.
+    // Thus, we do it almost as soon as we possibly can
+    {
+      auto result = mozilla::WindowsDpiInitialization();
+      (void)result;  // Ignore errors since some tools block DPI calls
+    }
+#  endif
+
+    nsresult rv = InitXPCOMGlue(LibLoadingStrategy::NoReadAhead);
+    if (NS_FAILED(rv)) {
+      return 255;
+    }
+
+    int result = content_process_main(gBootstrap.get(), argc, argv);
+
+#  if defined(DEBUG) && defined(HAS_DLL_BLOCKLIST)
+    DllBlocklist_Shutdown();
+#  endif
+
+    // InitXPCOMGlue calls NS_LogInit, so we need to balance it here.
+    gBootstrap->NS_LogTerm();
+
+    return result;
+  }
+#endif
+
+  // Register an external module to report on otherwise uncatchable exceptions.
+  CrashReporter::RegisterRuntimeExceptionModule();
+
+#ifdef HAS_DLL_BLOCKLIST
+  DllBlocklist_Initialize(gBlocklistInitFlags);
+#endif
+
+// We will likely only ever support this as a command line argument on Windows
+// and OSX, so we're ifdefing here just to not create any expectations.
+#if defined(XP_WIN) || defined(XP_MACOSX)
+  if (argc > 1 && IsArg(argv[1], "silentmode")) {
+    ::putenv(const_cast<char*>("MOZ_APP_SILENT_START=1"));
+#  if defined(XP_WIN)
+    // On windows We also want to set a separate variable, which we want to
+    // persist across restarts, which will let us keep the process alive
+    // even if the last window is closed.
+    ::putenv(const_cast<char*>("MOZ_APP_ALLOW_WINDOWLESS=1"));
+#  endif
+#  if defined(XP_MACOSX)
+    ::putenv(const_cast<char*>("MOZ_APP_NO_DOCK=1"));
+#  endif
+  }
+#endif
+
+#if defined(XP_WIN)
+
+  // Ideally, we would be able to set our DPI awareness in firefox.exe.manifest
+  // Unfortunately, that would cause Win32k calls when user32.dll gets loaded,
+  // which would be incompatible with Win32k Lockdown
+  //
+  // MSDN says that it's allowed-but-not-recommended to initialize DPI
+  // programatically, as long as it's done before any HWNDs are created.
+  // Thus, we do it almost as soon as we possibly can
+  {
+    auto result = mozilla::WindowsDpiInitialization();
+    (void)result;  // Ignore errors since some tools block DPI calls
+  }
+
+  // Once the browser process hits the main function, we no longer need
+  // a writable section handle because all dependent modules have been
+  // loaded.
+  mozilla::freestanding::gSharedSection.ConvertToReadOnly();
+
+  mozilla::CreateAndStorePreXULSkeletonUI(GetModuleHandle(nullptr), argc, argv);
+#endif
+
+  nsresult rv = InitXPCOMGlue(LibLoadingStrategy::ReadAhead);
+  if (NS_FAILED(rv)) {
+    return 255;
+  }
+
+  gBootstrap->XRE_StartupTimelineRecord(mozilla::StartupTimeline::START, start);
+
+#ifdef MOZ_BROWSER_CAN_BE_CONTENTPROC
+  gBootstrap->XRE_EnableSameExecutableForContentProc();
+#endif
+
+  int result = do_main(argc, argv, envp);
+
+#if defined(XP_WIN)
+  CleanupProcessRuntime();
+#endif
+
+  gBootstrap->NS_LogTerm();
+
+#if defined(DEBUG) && defined(HAS_DLL_BLOCKLIST)
+  DllBlocklist_Shutdown();
+#endif
+
+#ifdef XP_MACOSX
+  // Allow writes again. While we would like to catch writes from static
+  // destructors to allow early exits to use _exit, we know that there is
+  // at least one such write that we don't control (see bug 826029). For
+  // now we enable writes again and early exits will have to use exit instead
+  // of _exit.
+  gBootstrap->XRE_StopLateWriteChecks();
+#endif
+
+  gBootstrap.reset();
+
+  return result;
+}
diff --git a/browser/app/pbproxy/Makefile.in b/browser/app/pbproxy/Makefile.in
new file mode 100644
index 0000000000..f58f09bec1
--- /dev/null
+++ b/browser/app/pbproxy/Makefile.in
@@ -0,0 +1,2 @@
+# To make sure this process doesn't show a taskbar icon
+MOZ_WINCONSOLE = 0
diff --git a/browser/app/pbproxy/docs/index.rst b/browser/app/pbproxy/docs/index.rst
new file mode 100644
index 0000000000..b7d0b60467
--- /dev/null
+++ b/browser/app/pbproxy/docs/index.rst
@@ -0,0 +1,15 @@
+======================
+Private Browsing Proxy
+======================
+
+On Windows, Firefox ships with a small binary that always launches
+``firefox.exe`` in Private Browsing mode (``private_browsing.exe``). Its sole
+purpose for existing is to allow Private Browsing shortcuts to have their own
+Visual Elements. This is most notably seen when pinning a Private Browsing
+shortcut to the Start Menu -- Visual Elements are used for the icon there
+rather than the shortcut's icon.
+
+In addition to always passing ``-private-window``, ``private_browsing.exe``
+will forward any other command line arguments given to it to ``firefox.exe``.
+It will also forward shortcut information from the Windows ``STARTUPINFOW``
+structure to ensure that Firefox knows how it was started.
diff --git a/browser/app/pbproxy/module.ver b/browser/app/pbproxy/module.ver
new file mode 100644
index 0000000000..5ef8d2a02a
--- /dev/null
+++ b/browser/app/pbproxy/module.ver
@@ -0,0 +1,8 @@
+WIN32_MODULE_COMPANYNAME=Mozilla Corporation
+WIN32_MODULE_COPYRIGHT=©Firefox and Mozilla Developers; available under the MPL 2 license.
+WIN32_MODULE_PRODUCTVERSION=@MOZ_APP_WINVERSION@
+WIN32_MODULE_PRODUCTVERSION_STRING=@MOZ_APP_VERSION@
+WIN32_MODULE_TRADEMARKS=Firefox is a Trademark of The Mozilla Foundation.
+WIN32_MODULE_DESCRIPTION=@MOZ_APP_DISPLAYNAME@
+WIN32_MODULE_PRODUCTNAME=@MOZ_APP_DISPLAYNAME@
+WIN32_MODULE_NAME=@MOZ_APP_DISPLAYNAME@
diff --git a/browser/app/pbproxy/moz.build b/browser/app/pbproxy/moz.build
new file mode 100644
index 0000000000..bf9e0125e0
--- /dev/null
+++ b/browser/app/pbproxy/moz.build
@@ -0,0 +1,29 @@
+SPHINX_TREES["private-browsing-proxy"] = "docs"
+
+SOURCES += ["pbproxy.cpp"]
+
+# For nsNativeAppSupportWin.h icon definitions
+LOCAL_INCLUDES += ["/toolkit/xre"]
+
+if CONFIG["OS_TARGET"] == "WINNT" and CONFIG["CC_TYPE"] in ("gcc", "clang"):
+    # This allows us to use wmain as the entry point on mingw
+    LDFLAGS += [
+        "-municode",
+    ]
+
+RCINCLUDE = "pbproxy.rc"
+DEFINES["UNICODE"] = 1
+DEFINES["MOZ_APP_NAME"] = 'L"{}"'.format(CONFIG["MOZ_APP_NAME"])
+Program("private_browsing")
+
+OS_LIBS += ["shlwapi", "user32"]
+
+DEFINES["PBMODE_ICO"] = '"{}/{}/pbmode.ico"'.format(
+    TOPSRCDIR,
+    CONFIG["MOZ_BRANDING_DIRECTORY"],
+)
+
+DisableStlWrapping()
+
+with Files("**"):
+    BUG_COMPONENT = ("Firefox", "Shell Integration")
diff --git a/browser/app/pbproxy/pbproxy.cpp b/browser/app/pbproxy/pbproxy.cpp
new file mode 100644
index 0000000000..841cd654a1
--- /dev/null
+++ b/browser/app/pbproxy/pbproxy.cpp
@@ -0,0 +1,94 @@
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#include <windows.h>
+#include <processthreadsapi.h>
+#include <winbase.h>
+#include <winuser.h>
+#include <shlwapi.h>
+#include <string>
+
+// Max command line length, per CreateProcessW docs
+#define MAX_CMD_LENGTH 32767
+#define EXTRA_ERR_MSG_LENGTH 39
+#define ERR_GET_OUR_PATH L"844fa30e-0860-11ed-898b-373276936058"
+#define ERR_GET_APP_DIR L"811237de-0904-11ed-8745-c7c269742323"
+#define ERR_GET_APP_EXE L"8964fd30-0860-11ed-8374-576505ba4488"
+#define ERR_LAUNCHING_APP L"89d2ca2c-0860-11ed-883c-bf345b8391bc"
+
+void raiseError(DWORD err, std::wstring uuid) {
+  LPWSTR winerr;
+  if (err && ::FormatMessageW(FORMAT_MESSAGE_ALLOCATE_BUFFER |
+                                  FORMAT_MESSAGE_FROM_SYSTEM |
+                                  FORMAT_MESSAGE_IGNORE_INSERTS,
+                              nullptr, err, 0, (LPWSTR)&winerr, 0, nullptr)) {
+    std::wstring errmsg(winerr);
+    errmsg += L"\n\n" + uuid;
+    ::MessageBoxW(nullptr, errmsg.c_str(), MOZ_APP_NAME " private_browsing.exe",
+                  MB_OK | MB_ICONERROR | MB_SETFOREGROUND);
+  } else {
+    ::MessageBoxW(nullptr, uuid.c_str(), MOZ_APP_NAME " private_browsing.exe",
+                  MB_OK | MB_ICONERROR | MB_SETFOREGROUND);
+  }
+}
+
+/*
+ * A very simple wrapper that always launches Firefox in Private Browsing
+ * mode. Any arguments given to this program will be forwarded to Firefox,
+ * as well the information provided by GetStartupInfoW() (the latter is mainly
+ * done to ensure that Firefox's `launch_method` Telemetry works, which
+ * depends on shortcut information).
+ *
+ * Any errors that happen during this process will pop up a MessageBox
+ * with a Windows error (if present) and a unique UUID for debugability --
+ * but these are very unlikely to be seen in practice.
+ */
+int WINAPI wWinMain(HINSTANCE, HINSTANCE, LPWSTR aCmdLine, int) {
+  wchar_t app[MAX_PATH];
+  DWORD ret = GetModuleFileNameW(nullptr, app, MAX_PATH);
+  if (!ret ||
+      (ret == MAX_PATH && ::GetLastError() == ERROR_INSUFFICIENT_BUFFER)) {
+    ret = ::GetLastError();
+    raiseError(ret, ERR_GET_OUR_PATH);
+    return ret;
+  }
+  if (!PathRemoveFileSpecW(app)) {
+    raiseError(0, ERR_GET_APP_DIR);
+    return 1;
+  }
+  if (!PathAppendW(app, MOZ_APP_NAME L".exe")) {
+    raiseError(0, ERR_GET_APP_EXE);
+    return 1;
+  }
+
+  std::wstring cmdLine(L"\"");
+  cmdLine += app;
+  cmdLine += L"\" -private-window";
+  if (wcslen(aCmdLine) > 0) {
+    cmdLine += L" ";
+    cmdLine += aCmdLine;
+  }
+  DWORD creationFlags = CREATE_UNICODE_ENVIRONMENT;
+  // Mainly used to pass along shortcut information to ensure
+  // launch_method Telemetry will be accurate.
+  STARTUPINFOW startupInfo = {0};
+  startupInfo.cb = sizeof(STARTUPINFOW);
+  GetStartupInfoW(&startupInfo);
+  PROCESS_INFORMATION pi;
+
+  bool rv =
+      ::CreateProcessW(app, cmdLine.data(), nullptr, nullptr, FALSE,
+                       creationFlags, nullptr, nullptr, &startupInfo, &pi);
+
+  if (!rv) {
+    ret = ::GetLastError();
+    raiseError(ret, ERR_LAUNCHING_APP);
+    return ret;
+  }
+
+  ::CloseHandle(pi.hProcess);
+  ::CloseHandle(pi.hThread);
+
+  return 0;
+}
diff --git a/browser/app/pbproxy/pbproxy.rc b/browser/app/pbproxy/pbproxy.rc
new file mode 100644
index 0000000000..bb7489d03c
--- /dev/null
+++ b/browser/app/pbproxy/pbproxy.rc
@@ -0,0 +1,9 @@
+/* -*- Mode: C++; tab-width: 2; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#include <windows.h>
+#include "nsNativeAppSupportWin.h"
+
+IDI_APPICON ICON PBMODE_ICO
diff --git a/browser/app/permissions b/browser/app/permissions
new file mode 100644
index 0000000000..f44ede0cb3
--- /dev/null
+++ b/browser/app/permissions
@@ -0,0 +1,31 @@
+# This file has default permissions for the permission manager.
+# The file-format is strict:
+# * matchtype \t type \t permission \t host
+# * "origin" should be used for matchtype, "host" is supported for legacy reasons
+# * type is a string that identifies the type of permission (e.g. "cookie")
+# * permission is an integer between 1 and 15
+# Permissions defined here will also be set for private browsing.
+# See PermissionManager.cpp for more...
+
+# UITour
+# Bug 1557153: www.mozilla.org gets a special workaround in UITourChild.sys.mjs
+# Bug 1837407: support.mozilla.org gets a special workaround for similar reasons.
+origin	uitour	1	https://www.mozilla.org
+origin	uitour	1	https://monitor.firefox.com
+origin	uitour	1	https://screenshots.firefox.com
+origin	uitour	1	https://support.mozilla.org
+origin	uitour	1	https://truecolors.firefox.com
+origin	uitour	1	about:home
+origin	uitour	1	about:newtab
+
+# XPInstall
+origin	install	1	https://addons.mozilla.org
+
+# Remote troubleshooting
+origin	remote-troubleshooting	1	https://support.mozilla.org
+
+# addon install
+origin	install	1	https://fpn.firefox.com
+
+# autoplay video/audio
+origin	autoplay-media	1	about:welcome
diff --git a/browser/app/profile/channel-prefs.js b/browser/app/profile/channel-prefs.js
new file mode 100644
index 0000000000..eed6e634c2
--- /dev/null
+++ b/browser/app/profile/channel-prefs.js
@@ -0,0 +1,9 @@
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+//
+// This pref is in its own file for complex reasons. See the comment in
+// browser/app/Makefile.in, bug 756325, and bug 1431342 for details. Do not add
+// other prefs to this file.
+
+pref("app.update.channel", "@MOZ_UPDATE_CHANNEL@");
diff --git a/browser/app/profile/firefox.js b/browser/app/profile/firefox.js
new file mode 100644
index 0000000000..621900f90f
--- /dev/null
+++ b/browser/app/profile/firefox.js
@@ -0,0 +1,2881 @@
+#filter dumbComments emptyLines substitution
+
+// -*- indent-tabs-mode: nil; js-indent-level: 2 -*-
+// This Source Code Form is subject to the terms of the Mozilla Public
+// License, v. 2.0. If a copy of the MPL was not distributed with this
+// file, You can obtain one at http://mozilla.org/MPL/2.0/.
+
+// Non-static prefs that are specific to desktop Firefox belong in this file
+// (unless there is a compelling and documented reason for them to belong in
+// another file).
+//
+// Please indent all prefs defined within #ifdef/#ifndef conditions. This
+// improves readability, particular for conditional blocks that exceed a single
+// screen.
+
+#ifdef XP_UNIX
+  #ifndef XP_MACOSX
+    #define UNIX_BUT_NOT_MAC
+  #endif
+#endif
+
+pref("browser.hiddenWindowChromeURL", "chrome://browser/content/hiddenWindowMac.xhtml");
+
+// Enables some extra Extension System Logging (can reduce performance)
+pref("extensions.logging.enabled", false);
+
+// Disables strict compatibility, making addons compatible-by-default.
+pref("extensions.strictCompatibility", false);
+
+// Temporary preference to forcibly make themes more safe with Australis even if
+// extensions.checkCompatibility=false has been set.
+pref("extensions.checkCompatibility.temporaryThemeOverride_minAppVersion", "29.0a1");
+
+pref("extensions.webextOptionalPermissionPrompts", true);
+// If enabled, install origin permission verification happens after addons are downloaded.
+pref("extensions.postDownloadThirdPartyPrompt", true);
+
+// Preferences for AMO integration
+pref("extensions.getAddons.cache.enabled", true);
+pref("extensions.getAddons.get.url", "https://services.addons.mozilla.org/api/v4/addons/search/?guid=%IDS%&lang=%LOCALE%");
+pref("extensions.getAddons.search.browseURL", "https://addons.mozilla.org/%LOCALE%/firefox/search?q=%TERMS%&platform=%OS%&appver=%VERSION%");
+pref("extensions.getAddons.link.url", "https://addons.mozilla.org/%LOCALE%/firefox/");
+pref("extensions.getAddons.langpacks.url", "https://services.addons.mozilla.org/api/v4/addons/language-tools/?app=firefox&type=language&appversion=%VERSION%");
+pref("extensions.getAddons.discovery.api_url", "https://services.addons.mozilla.org/api/v4/discovery/?lang=%LOCALE%&edition=%DISTRIBUTION%");
+
+// The URL for the privacy policy related to recommended extensions.
+pref("extensions.recommendations.privacyPolicyUrl", "https://www.mozilla.org/privacy/firefox/?utm_source=firefox-browser&utm_medium=firefox-browser&utm_content=privacy-policy-link#addons");
+// The URL for Firefox Color, recommended on the theme page in about:addons.
+pref("extensions.recommendations.themeRecommendationUrl", "https://color.firefox.com/?utm_source=firefox-browser&utm_medium=firefox-browser&utm_content=theme-footer-link");
+
+pref("extensions.update.autoUpdateDefault", true);
+
+// Check AUS for system add-on updates.
+pref("extensions.systemAddon.update.url", "https://aus5.mozilla.org/update/3/SystemAddons/%VERSION%/%BUILD_ID%/%BUILD_TARGET%/%LOCALE%/%CHANNEL%/%OS_VERSION%/%DISTRIBUTION%/%DISTRIBUTION_VERSION%/update.xml");
+pref("extensions.systemAddon.update.enabled", true);
+
+// Disable add-ons that are not installed by the user in all scopes by default.
+// See the SCOPE constants in AddonManager.jsm for values to use here.
+pref("extensions.autoDisableScopes", 15);
+// Scopes to scan for changes at startup.
+pref("extensions.startupScanScopes", 0);
+
+pref("extensions.geckoProfiler.acceptedExtensionIds", "geckoprofiler@mozilla.com,quantum-foxfooding@mozilla.com,raptor@mozilla.org");
+
+
+pref("extensions.webextensions.remote", true);
+
+// Require signed add-ons by default
+pref("extensions.langpacks.signatures.required", true);
+pref("xpinstall.signatures.required", true);
+pref("xpinstall.signatures.devInfoURL", "https://wiki.mozilla.org/Addons/Extension_Signing");
+
+// Dictionary download preference
+pref("browser.dictionaries.download.url", "https://addons.mozilla.org/%LOCALE%/firefox/language-tools/");
+
+// At startup, should we check to see if the installation
+// date is older than some threshold
+pref("app.update.checkInstallTime", true);
+
+// The number of days a binary is permitted to be old without checking is defined in
+// firefox-branding.js (app.update.checkInstallTime.days)
+
+// The minimum delay in seconds for the timer to fire between the notification
+// of each consumer of the timer manager.
+// minimum=30 seconds, default=120 seconds, and maximum=300 seconds
+pref("app.update.timerMinimumDelay", 120);
+
+// The minimum delay in milliseconds for the first firing after startup of the timer
+// to notify consumers of the timer manager.
+// minimum=10 seconds, default=30 seconds, and maximum=120 seconds
+pref("app.update.timerFirstInterval", 30000);
+
+// App-specific update preferences
+
+// The interval to check for updates (app.update.interval) is defined in
+// firefox-branding.js
+
+// Enables some extra Application Update Logging (can reduce performance)
+pref("app.update.log", false);
+// Causes Application Update Logging to be sent to a file in the profile
+// directory. This preference is automatically disabled on application start to
+// prevent it from being left on accidentally. Turning this pref on enables
+// logging, even if app.update.log is false.
+pref("app.update.log.file", false);
+
+// The number of general background check failures to allow before notifying the
+// user of the failure. User initiated update checks always notify the user of
+// the failure.
+pref("app.update.backgroundMaxErrors", 10);
+
+// Ids of the links to the "What's new" update documentation
+pref("app.update.link.updateAvailableWhatsNew", "update-available-whats-new");
+pref("app.update.link.updateManualWhatsNew", "update-manual-whats-new");
+
+// How many times we should let downloads fail before prompting the user to
+// download a fresh installer.
+pref("app.update.download.promptMaxAttempts", 2);
+
+// How many times we should let an elevation prompt fail before prompting the user to
+// download a fresh installer.
+pref("app.update.elevation.promptMaxAttempts", 2);
+
+#ifdef NIGHTLY_BUILD
+  // Whether to delay popup notifications when an update is available and
+  // suppress them when an update is installed and waiting for user to restart.
+  // If set to true, these notifications will immediately be shown as banners in
+  // the app menu and as badges on the app menu button. Update available
+  // notifications will not create popup prompts until a week has passed without
+  // the user installing the update. Update restart notifications will not
+  // create popup prompts at all. This doesn't affect update notifications
+  // triggered by errors/failures or manual install prompts.
+  pref("app.update.suppressPrompts", false);
+#endif
+
+// If set to true, a message will be displayed in the hamburger menu while
+// an update is being downloaded.
+pref("app.update.notifyDuringDownload", false);
+
+// If set to true, the Update Service will automatically download updates if the
+// user can apply updates. This pref is no longer used on Windows, except as the
+// default value to migrate to the new location that this data is now stored
+// (which is in a file in the update directory). Because of this, this pref
+// should no longer be used directly. Instead, getAppUpdateAutoEnabled and
+// getAppUpdateAutoEnabled from UpdateUtils.sys.mjs should be used.
+#ifndef XP_WIN
+  pref("app.update.auto", true);
+#endif
+
+// If set to true, the Update Service will apply updates in the background
+// when it finishes downloading them.
+pref("app.update.staging.enabled", true);
+
+// Update service URL:
+// app.update.url was removed in Bug 1568994
+// app.update.url.manual is in branding section
+// app.update.url.details is in branding section
+
+// app.update.badgeWaitTime is in branding section
+// app.update.interval is in branding section
+// app.update.promptWaitTime is in branding section
+
+// Whether or not to attempt using the service for updates.
+#ifdef MOZ_MAINTENANCE_SERVICE
+  pref("app.update.service.enabled", true);
+#endif
+
+#ifdef MOZ_BITS_DOWNLOAD
+  // If set to true, the Update Service will attempt to use Windows BITS to
+  // download updates and will fallback to downloading internally if that fails.
+  pref("app.update.BITS.enabled", true);
+#endif
+
+pref("app.update.langpack.enabled", true);
+
+#if defined(MOZ_UPDATE_AGENT)
+  pref("app.update.background.loglevel", "error");
+  pref("app.update.background.timeoutSec", 600);
+  // By default, check for updates when the browser is not running every 7 hours.
+  pref("app.update.background.interval", 25200);
+  // By default, snapshot Firefox Messaging System targeting for use by the
+  // background update task every 60 minutes.
+  pref("app.update.background.messaging.targeting.snapshot.intervalSec", 3600);
+#endif
+
+#ifdef XP_MACOSX
+  // If set to true, Firefox will automatically restart if it is left running
+  // with no browser windows open.
+  pref("app.update.noWindowAutoRestart.enabled", true);
+  // How long to wait after all browser windows are closed before restarting,
+  // in milliseconds. 5 min = 300000 ms
+  pref("app.update.noWindowAutoRestart.delayMs", 300000);
+#endif
+
+#if defined(MOZ_BACKGROUNDTASKS)
+  // The amount of time, in seconds, before background tasks time out and exit.
+  // Tasks can override this default (10 minutes).
+  pref("toolkit.backgroundtasks.defaultTimeoutSec", 600);
+#endif
+
+// Symmetric (can be overridden by individual extensions) update preferences.
+// e.g.
+//  extensions.{GUID}.update.enabled
+//  extensions.{GUID}.update.url
+//  .. etc ..
+//
+pref("extensions.update.enabled", true);
+pref("extensions.update.url", "https://versioncheck.addons.mozilla.org/update/VersionCheck.php?reqVersion=%REQ_VERSION%&id=%ITEM_ID%&version=%ITEM_VERSION%&maxAppVersion=%ITEM_MAXAPPVERSION%&status=%ITEM_STATUS%&appID=%APP_ID%&appVersion=%APP_VERSION%&appOS=%APP_OS%&appABI=%APP_ABI%&locale=%APP_LOCALE%&currentAppVersion=%CURRENT_APP_VERSION%&updateType=%UPDATE_TYPE%&compatMode=%COMPATIBILITY_MODE%");
+pref("extensions.update.background.url", "https://versioncheck-bg.addons.mozilla.org/update/VersionCheck.php?reqVersion=%REQ_VERSION%&id=%ITEM_ID%&version=%ITEM_VERSION%&maxAppVersion=%ITEM_MAXAPPVERSION%&status=%ITEM_STATUS%&appID=%APP_ID%&appVersion=%APP_VERSION%&appOS=%APP_OS%&appABI=%APP_ABI%&locale=%APP_LOCALE%&currentAppVersion=%CURRENT_APP_VERSION%&updateType=%UPDATE_TYPE%&compatMode=%COMPATIBILITY_MODE%");
+pref("extensions.update.interval", 86400);  // Check for updates to Extensions and
+                                            // Themes every day
+
+pref("lightweightThemes.getMoreURL", "https://addons.mozilla.org/%LOCALE%/firefox/themes");
+
+#if defined(MOZ_WIDEVINE_EME)
+  pref("browser.eme.ui.enabled", true);
+#else
+  pref("browser.eme.ui.enabled", false);
+#endif
+
+// UI tour experience.
+pref("browser.uitour.enabled", true);
+pref("browser.uitour.loglevel", "Error");
+pref("browser.uitour.requireSecure", true);
+pref("browser.uitour.themeOrigin", "https://addons.mozilla.org/%LOCALE%/firefox/themes/");
+pref("browser.uitour.url", "https://www.mozilla.org/%LOCALE%/firefox/%VERSION%/tour/");
+// How long to show a Hearbeat survey (two hours, in seconds)
+pref("browser.uitour.surveyDuration", 7200);
+
+pref("keyword.enabled", true);
+
+// Fixup whitelists, the urlbar won't try to search for these words, but will
+// instead consider them valid TLDs. Don't check these directly, use
+// Services.uriFixup.isDomainKnown() instead.
+pref("browser.fixup.domainwhitelist.localhost", true);
+// https://tools.ietf.org/html/rfc2606
+pref("browser.fixup.domainsuffixwhitelist.test", true);
+pref("browser.fixup.domainsuffixwhitelist.example", true);
+pref("browser.fixup.domainsuffixwhitelist.invalid", true);
+pref("browser.fixup.domainsuffixwhitelist.localhost", true);
+// https://tools.ietf.org/html/draft-wkumari-dnsop-internal-00
+pref("browser.fixup.domainsuffixwhitelist.internal", true);
+// https://tools.ietf.org/html/rfc6762
+pref("browser.fixup.domainsuffixwhitelist.local", true);
+
+// Whether to always go through the DNS server before sending a single word
+// search string, that may contain a valid host, to a search engine.
+pref("browser.fixup.dns_first_for_single_words", false);
+
+#ifdef UNIX_BUT_NOT_MAC
+  pref("general.autoScroll", false);
+#else
+  pref("general.autoScroll", true);
+#endif
+
+// UI density of the browser chrome. This mostly affects toolbarbutton
+// and urlbar spacing. The possible values are 0=normal, 1=compact, 2=touch.
+pref("browser.uidensity", 0);
+// Whether Firefox will automatically override the uidensity to "touch"
+// while the user is in a touch environment (such as Windows tablet mode).
+pref("browser.touchmode.auto", true);
+// Whether Firefox will show the Compact Mode UIDensity option.
+pref("browser.compactmode.show", false);
+
+// At startup, check if we're the default browser and prompt user if not.
+pref("browser.shell.checkDefaultBrowser", true);
+pref("browser.shell.shortcutFavicons",true);
+pref("browser.shell.mostRecentDateSetAsDefault", "");
+pref("browser.shell.skipDefaultBrowserCheckOnFirstRun", true);
+pref("browser.shell.didSkipDefaultBrowserCheckOnFirstRun", false);
+pref("browser.shell.defaultBrowserCheckCount", 0);
+#if defined(XP_WIN)
+// Attempt to set the default browser on Windows 10 using the UserChoice registry keys,
+// before falling back to launching the modern Settings dialog.
+pref("browser.shell.setDefaultBrowserUserChoice", true);
+// When setting the default browser on Windows 10 using the UserChoice
+// registry keys, also try to set Firefox as the default PDF handler.
+pref("browser.shell.setDefaultPDFHandler", true);
+// When setting Firefox as the default PDF handler (subject to conditions
+// above), only set Firefox as the default PDF handler when the existing handler
+// is a known browser, and not when existing handler is another PDF handler such
+// as Acrobat Reader or Nitro PDF.
+pref("browser.shell.setDefaultPDFHandler.onlyReplaceBrowsers", true);
+// URL to navigate to when launching Firefox after accepting the Windows Default
+// Browser Agent "Set Firefox as default" call to action.
+pref("browser.shell.defaultBrowserAgent.thanksURL", "https://www.mozilla.org/%LOCALE%/firefox/set-as-default/thanks/");
+#endif
+
+
+// 0 = blank, 1 = home (browser.startup.homepage), 2 = last visited page, 3 = resume previous browser session
+// The behavior of option 3 is detailed at: http://wiki.mozilla.org/Session_Restore
+pref("browser.startup.page",                1);
+pref("browser.startup.homepage",            "about:home");
+pref("browser.startup.homepage.abouthome_cache.enabled", true);
+pref("browser.startup.homepage.abouthome_cache.loglevel", "Warn");
+
+// Whether we should skip the homepage when opening the first-run page
+pref("browser.startup.firstrunSkipsHomepage", true);
+
+// Whether we should show the session-restore infobar on startup
+pref("browser.startup.couldRestoreSession.count", 0);
+
+// Show an about:blank window as early as possible for quick startup feedback.
+// Held to nightly on Linux due to bug 1450626.
+// Disabled on Mac because the bouncing dock icon already provides feedback.
+#if defined(XP_WIN) || defined(MOZ_WIDGET_GTK) && defined(NIGHTLY_BUILD)
+  pref("browser.startup.blankWindow", true);
+#else
+  pref("browser.startup.blankWindow", false);
+#endif
+
+// Show a skeleton UI window prior to loading libxul. Only visible for windows
+// users as it is not implemented anywhere else.
+#if defined(XP_WIN)
+pref("browser.startup.preXulSkeletonUI", true);
+#endif
+
+// Show an upgrade dialog on major upgrades.
+pref("browser.startup.upgradeDialog.enabled", true);
+
+// Don't create the hidden window during startup on
+// platforms that don't always need it (Win/Linux).
+pref("toolkit.lazyHiddenWindow", true);
+
+pref("browser.chrome.site_icons", true);
+// browser.warnOnQuit == false will override all other possible prompts when quitting or restarting
+pref("browser.warnOnQuit", true);
+
+// Whether to warn when quitting when using the shortcut key.
+#if defined(XP_WIN)
+  pref("browser.warnOnQuitShortcut", false);
+#else
+  pref("browser.warnOnQuitShortcut", true);
+#endif
+
+// TODO bug 1702563: Renable fullscreen autohide by default on macOS.
+#ifdef XP_MACOSX
+  pref("browser.fullscreen.autohide", false);
+#else
+  pref("browser.fullscreen.autohide", true);
+#endif
+
+pref("browser.overlink-delay", 80);
+
+pref("browser.theme.colorway-closet", true);
+
+// Whether expired built-in colorways themes that are active or retained
+// should be allowed to check for updates and be updated to an AMO hosted
+// theme with the same id (as part of preparing to remove from mozilla-central
+// all the expired built-in colorways themes, after existing users have been
+// migrated to colorways themes hosted on AMO).
+pref("browser.theme.colorway-migration", true);
+
+// Whether using `ctrl` when hitting return/enter in the URL bar
+// (or clicking 'go') should prefix 'www.' and suffix
+// browser.fixup.alternate.suffix to the URL bar value prior to
+// navigating.
+pref("browser.urlbar.ctrlCanonizesURLs", true);
+
+// Whether we announce to screen readers when tab-to-search results are
+// inserted.
+pref("browser.urlbar.accessibility.tabToSearch.announceResults", true);
+
+// Control autoFill behavior
+pref("browser.urlbar.autoFill", true);
+
+// Whether enabling adaptive history autofill.
+pref("browser.urlbar.autoFill.adaptiveHistory.enabled", false);
+
+// Minimum char length of the user's search string to enable adaptive history
+// autofill.
+pref("browser.urlbar.autoFill.adaptiveHistory.minCharsThreshold", 0);
+
+// Whether to warm up network connections for autofill or search results.
+pref("browser.urlbar.speculativeConnect.enabled", true);
+
+// Whether bookmarklets should be filtered out of Address Bar matches.
+// This is enabled for security reasons, when true it is still possible to
+// search for bookmarklets typing "javascript: " followed by the actual query.
+pref("browser.urlbar.filter.javascript", true);
+
+// Enable a certain level of urlbar logging to the Browser Console. See Log.jsm.
+pref("browser.urlbar.loglevel", "Error");
+
+// the maximum number of results to show in autocomplete when doing richResults
+pref("browser.urlbar.maxRichResults", 10);
+
+// The maximum number of historical search results to show.
+pref("browser.urlbar.maxHistoricalSearchSuggestions", 2);
+
+// The default behavior for the urlbar can be configured to use any combination
+// of the match filters with each additional filter adding more results (union).
+pref("browser.urlbar.suggest.bookmark",             true);
+pref("browser.urlbar.suggest.history",              true);
+pref("browser.urlbar.suggest.openpage",             true);
+pref("browser.urlbar.suggest.remotetab",            true);
+pref("browser.urlbar.suggest.searches",             true);
+pref("browser.urlbar.suggest.topsites",             true);
+pref("browser.urlbar.suggest.engines",              true);
+pref("browser.urlbar.suggest.calculator",           false);
+
+#if defined(EARLY_BETA_OR_EARLIER)
+  // Enable QuickActions and its urlbar search mode button.
+  pref("browser.urlbar.quickactions.enabled", true);
+  pref("browser.urlbar.suggest.quickactions", true);
+  pref("browser.urlbar.shortcuts.quickactions", true);
+  pref("browser.urlbar.quickactions.showPrefs", true);
+#endif
+
+#if defined(EARLY_BETA_OR_EARLIER)
+  // Enable Trending suggestions.
+  pref("browser.urlbar.trending.featureGate", true);
+#endif
+
+// Feature gate pref for weather suggestions in the urlbar.
+pref("browser.urlbar.weather.featureGate", false);
+
+// When false, the weather suggestion will not be fetched when a VPN is
+// detected. When true, it will be fetched anyway.
+pref("browser.urlbar.weather.ignoreVPN", false);
+
+// The minimum prefix length of a weather keyword the user must type to trigger
+// the suggestion. 0 means the min length should be taken from Nimbus or remote
+// settings.
+pref("browser.urlbar.weather.minKeywordLength", 0);
+
+// If `browser.urlbar.weather.featureGate` is true, this controls whether
+// weather suggestions are turned on.
+pref("browser.urlbar.suggest.weather", true);
+
+// When `browser.urlbar.bestMatch.enabled` is true, this controls whether best
+// match results are shown in the urlbar. This pref is exposed to the user in
+// the UI, and it's sticky so that its user-branch value persists regardless of
+// whatever Firefox Suggest experiments or rollouts the user is enrolled in over
+// time.
+pref("browser.urlbar.suggest.bestmatch", true, sticky);
+
+// Whether non-sponsored quick suggest results are shown in the urlbar. This
+// pref is exposed to the user in the UI, and it's sticky so that its
+// user-branch value persists regardless of whatever Firefox Suggest scenarios,
+// with their various default-branch values, the user is enrolled in over time.
+pref("browser.urlbar.suggest.quicksuggest.nonsponsored", false, sticky);
+
+// Whether sponsored quick suggest results are shown in the urlbar. This pref is
+// exposed to the user in the UI, and it's sticky so that its user-branch value
+// persists regardless of whatever Firefox Suggest scenarios, with their various
+// default-branch values, the user is enrolled in over time.
+pref("browser.urlbar.suggest.quicksuggest.sponsored", false, sticky);
+
+// Whether data collection is enabled for quick suggest results in the urlbar.
+// This pref is exposed to the user in the UI, and it's sticky so that its
+// user-branch value persists regardless of whatever Firefox Suggest scenarios,
+// with their various default-branch values, the user is enrolled in over time.
+pref("browser.urlbar.quicksuggest.dataCollection.enabled", false, sticky);
+
+// Whether the quick suggest feature in the urlbar is enabled.
+pref("browser.urlbar.quicksuggest.enabled", false);
+
+// Whether to show the QuickSuggest onboarding dialog.
+pref("browser.urlbar.quicksuggest.shouldShowOnboardingDialog", true);
+
+// Show QuickSuggest onboarding dialog on the nth browser restarts.
+pref("browser.urlbar.quicksuggest.showOnboardingDialogAfterNRestarts", 0);
+
+// The indexes of the sponsored and non-sponsored quick suggest results within
+// the general results group.
+pref("browser.urlbar.quicksuggest.sponsoredIndex", -1);
+pref("browser.urlbar.quicksuggest.nonSponsoredIndex", -1);
+
+// Whether Remote Settings is enabled as a quick suggest source.
+pref("browser.urlbar.quicksuggest.remoteSettings.enabled", true);
+
+// Whether quick suggest results can be shown in position specified in the
+// suggestions.
+pref("browser.urlbar.quicksuggest.allowPositionInSuggestions", true);
+
+// Whether non-sponsored quick suggest results are subject to impression
+// frequency caps.
+pref("browser.urlbar.quicksuggest.impressionCaps.nonSponsoredEnabled", false);
+
+// Whether sponsored quick suggest results are subject to impression frequency
+// caps.
+pref("browser.urlbar.quicksuggest.impressionCaps.sponsoredEnabled", false);
+
+// Whether the usual non-best-match quick suggest results can be blocked. This
+// pref is a fallback for the Nimbus variable `quickSuggestBlockingEnabled`.
+pref("browser.urlbar.quicksuggest.blockingEnabled", true);
+
+// Whether unit conversion is enabled.
+#ifdef NIGHTLY_BUILD
+pref("browser.urlbar.unitConversion.enabled", true);
+#else
+pref("browser.urlbar.unitConversion.enabled", false);
+#endif
+
+// Whether to show search suggestions before general results like history and
+// bookmarks.
+pref("browser.urlbar.showSearchSuggestionsFirst", true);
+
+// As a user privacy measure, don't fetch search suggestions if a pasted string
+// is longer than this.
+pref("browser.urlbar.maxCharsForSearchSuggestions", 100);
+
+pref("browser.urlbar.trimURLs", true);
+
+// If changed to true, copying the entire URL from the location bar will put the
+// human readable (percent-decoded) URL on the clipboard.
+pref("browser.urlbar.decodeURLsOnCopy", false);
+
+// Whether or not to move tabs into the active window when using the "Switch to
+// Tab" feature of the awesomebar.
+pref("browser.urlbar.switchTabs.adoptIntoActiveWindow", false);
+
+// Whether addresses and search results typed into the address bar
+// should be opened in new tabs by default.
+pref("browser.urlbar.openintab", false);
+
+// Enable three-dot options button and menu for eligible results.
+pref("browser.urlbar.resultMenu", true);
+// Allow the result menu button to be reached with the Tab key.
+pref("browser.urlbar.resultMenu.keyboardAccessible", true);
+
+// If true, we show tail suggestions when available.
+pref("browser.urlbar.richSuggestions.tail", true);
+
+// If true, top sites may include sponsored ones.
+pref("browser.urlbar.sponsoredTopSites", false);
+
+// Global toggle for whether the show search terms feature
+// can be used at all, and enabled/disabled by the user.
+#if defined(EARLY_BETA_OR_EARLIER)
+pref("browser.urlbar.showSearchTerms.featureGate", true);
+#else
+pref("browser.urlbar.showSearchTerms.featureGate", false);
+#endif
+
+// If true, show the search term in the Urlbar while on
+// a default search engine results page.
+pref("browser.urlbar.showSearchTerms.enabled", true);
+
+// Controls the empty search behavior in Search Mode:
+//  0 - Show nothing
+//  1 - Show search history
+//  2 - Show search and browsing history
+pref("browser.urlbar.update2.emptySearchBehavior", 0);
+
+// Whether the urlbar displays one-offs to filter searches to history,
+// bookmarks, or tabs.
+pref("browser.urlbar.shortcuts.bookmarks", true);
+pref("browser.urlbar.shortcuts.tabs", true);
+pref("browser.urlbar.shortcuts.history", true);
+
+pref("browser.urlbar.eventTelemetry.enabled", false);
+
+// When we send events to Urlbar extensions, we wait this amount of time in
+// milliseconds for them to respond before timing out.
+pref("browser.urlbar.extension.timeout", 400);
+
+// Controls when to DNS resolve single word search strings, after they were
+// searched for. If the string is resolved as a valid host, show a
+// "Did you mean to go to 'host'" prompt.
+// 0 - never resolve; 1 - use heuristics (default); 2 - always resolve
+pref("browser.urlbar.dnsResolveSingleWordsAfterSearch", 0);
+
+// Whether the results panel should be kept open during IME composition.
+// The default value is false because some IME open a picker panel, and we end
+// up with two panels on top of each other. Since for now we can't detect that
+// we leave this choice to the user, hopefully in the future this can be flipped
+// for everyone.
+pref("browser.urlbar.keepPanelOpenDuringImeComposition", false);
+
+// Whether Firefox Suggest group labels are shown in the urlbar view.
+pref("browser.urlbar.groupLabels.enabled", true);
+
+// Whether Merino is enabled as a quick suggest source in the urlbar.
+pref("browser.urlbar.merino.enabled", true);
+
+// The Merino endpoint URL, not including parameters.
+pref("browser.urlbar.merino.endpointURL", "https://merino.services.mozilla.com/api/v1/suggest");
+
+// Timeout for Merino fetches (ms).
+pref("browser.urlbar.merino.timeoutMs", 200);
+
+// Comma-separated list of providers to request from Merino
+pref("browser.urlbar.merino.providers", "");
+
+// Comma-separated list of client variants to send to Merino
+pref("browser.urlbar.merino.clientVariants", "");
+
+// Whether the best match feature in the urlbar is enabled.
+pref("browser.urlbar.bestMatch.enabled", false);
+
+// Whether best match results can be blocked. This pref is a fallback for the
+// Nimbus variable `bestMatchBlockingEnabled`.
+pref("browser.urlbar.bestMatch.blockingEnabled", true);
+
+// Enable site specific search result.
+pref("browser.urlbar.contextualSearch.enabled", false);
+
+// Feature gate pref for addon suggestions in the urlbar.
+pref("browser.urlbar.addons.featureGate", false);
+
+// If `browser.urlbar.addons.featureGate` is true, this controls whether
+// addons suggestions are turned on.
+pref("browser.urlbar.suggest.addons", true);
+
+// The minimum prefix length of addons keyword the user must type to trigger
+// the suggestion. 0 means the min length should be taken from Nimbus.
+pref("browser.urlbar.addons.minKeywordLength", 0);
+
+pref("browser.altClickSave", false);
+
+// Enable logging downloads operations to the Console.
+pref("browser.download.loglevel", "Error");
+
+// Number of milliseconds to wait for the http headers (and thus
+// the Content-Disposition filename) before giving up and falling back to
+// picking a filename without that info in hand so that the user sees some
+// feedback from their action.
+pref("browser.download.saveLinkAsFilenameTimeout", 4000);
+
+pref("browser.download.useDownloadDir", true);
+pref("browser.download.folderList", 1);
+pref("browser.download.manager.addToRecentDocs", true);
+pref("browser.download.manager.resumeOnWakeDelay", 10000);
+
+// This records whether or not the panel has been shown at least once.
+pref("browser.download.panel.shown", false);
+
+// This records whether or not to show the 'Open in system viewer' context menu item when appropriate
+pref("browser.download.openInSystemViewerContextMenuItem", true);
+
+// This records whether or not to show the 'Always open...' context menu item when appropriate
+pref("browser.download.alwaysOpenInSystemViewerContextMenuItem", true);
+
+// Open downloaded file types internally for the given types.
+// This is a comma-separated list, the empty string ("") means no types are
+// viewable internally.
+pref("browser.download.viewableInternally.enabledTypes", "xml,svg,webp,avif,jxl");
+
+
+// This controls whether the button is automatically shown/hidden depending
+// on whether there are downloads to show.
+pref("browser.download.autohideButton", true);
+
+// Controls whether to open the downloads panel every time a download begins.
+// The first download ever run in a new profile will still open the panel.
+pref("browser.download.alwaysOpenPanel", true);
+
+// Determines the behavior of the "Delete" item in the downloads context menu.
+// Valid values are 0, 1, and 2.
+//   0 - Don't remove the download from session list or history.
+//   1 - Remove the download from session list, but not history.
+//   2 - Remove the download from both session list and history.
+pref("browser.download.clearHistoryOnDelete", 0);
+
+#ifndef XP_MACOSX
+  pref("browser.helperApps.deleteTempFileOnExit", true);
+#endif
+
+// This controls the visibility of the radio button in the
+// Unknown Content Type (Helper App) dialog that will open
+// the content in the browser for PDF and for other
+// Viewable Internally types
+// (see browser.download.viewableInternally.enabledTypes)
+pref("browser.helperApps.showOpenOptionForPdfJS", true);
+pref("browser.helperApps.showOpenOptionForViewableInternally", true);
+
+// search engine removal URL
+pref("browser.search.searchEngineRemoval", "https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/search-engine-removal");
+
+// search engines URL
+pref("browser.search.searchEnginesURL",      "https://addons.mozilla.org/%LOCALE%/firefox/search-engines/");
+
+// search bar results always open in a new tab
+pref("browser.search.openintab", false);
+
+// context menu searches open in the foreground
+pref("browser.search.context.loadInBackground", false);
+
+// comma separated list of of engines to hide in the search panel.
+pref("browser.search.hiddenOneOffs", "");
+
+// Mirrors whether the search-container widget is in the navigation toolbar.
+pref("browser.search.widget.inNavBar", false);
+
+// Enables display of the options for the user using a separate default search
+// engine in private browsing mode.
+pref("browser.search.separatePrivateDefault.ui.enabled", false);
+// The maximum amount of times the private default banner is shown.
+pref("browser.search.separatePrivateDefault.ui.banner.max", 0);
+
+// Enables search SERP telemetry (impressions, engagements and abandonment)
+pref("browser.search.serpEventTelemetry.enabled", false);
+
+// Enables the display of the Mozilla VPN banner in private browsing windows
+pref("browser.privatebrowsing.vpnpromourl", "https://vpn.mozilla.org/?utm_source=firefox-browser&utm_medium=firefox-%CHANNEL%-browser&utm_campaign=private-browsing-vpn-link");
+
+// Enables the new private browsing indicator.
+pref("browser.privatebrowsing.enable-new-indicator", true);
+
+// Enables the new about:privatebrowsing logo.
+pref("browser.privatebrowsing.enable-new-logo", true);
+
+// Whether the user has opted-in to recommended settings for data features.
+pref("browser.dataFeatureRecommendations.enabled", false);
+
+// Temporary pref to control whether or not Private Browsing windows show up
+// as separate icons in the Windows taskbar.
+pref("browser.privateWindowSeparation.enabled", true);
+
+// Use dark theme variant for PBM windows. This is only supported if the theme
+// sets darkTheme data.
+pref("browser.theme.dark-private-windows", true);
+
+// Controls visibility of the privacy segmentation preferences section.
+pref("browser.privacySegmentation.preferences.show", false);
+
+pref("browser.sessionhistory.max_entries", 50);
+
+// Built-in default permissions.
+pref("permissions.manager.defaultsUrl", "resource://app/defaults/permissions");
+
+// Set default fallback values for site permissions we want
+// the user to be able to globally change.
+pref("permissions.default.camera", 0);
+pref("permissions.default.microphone", 0);
+pref("permissions.default.geo", 0);
+pref("permissions.default.xr", 0);
+pref("permissions.default.desktop-notification", 0);
+pref("permissions.default.shortcuts", 0);
+
+pref("permissions.desktop-notification.postPrompt.enabled", true);
+pref("permissions.desktop-notification.notNow.enabled", false);
+
+pref("permissions.fullscreen.allowed", false);
+
+// handle links targeting new windows
+// 1=current window/tab, 2=new window, 3=new tab in most recent window
+pref("browser.link.open_newwindow", 3);
+
+// handle external links (i.e. links opened from a different application)
+// default: use browser.link.open_newwindow
+// 1-3: see browser.link.open_newwindow for interpretation
+pref("browser.link.open_newwindow.override.external", -1);
+
+// 0: no restrictions - divert everything
+// 1: don't divert window.open at all
+// 2: don't divert window.open with features
+pref("browser.link.open_newwindow.restriction", 2);
+
+// If true, this pref causes windows opened by window.open to be forced into new
+// tabs (rather than potentially opening separate windows, depending on
+// window.open arguments) when the browser is in fullscreen mode.
+// We set this differently on Mac because the fullscreen implementation there is
+// different.
+#ifdef XP_MACOSX
+  pref("browser.link.open_newwindow.disabled_in_fullscreen", true);
+#else
+  pref("browser.link.open_newwindow.disabled_in_fullscreen", false);
+#endif
+
+// Tabbed browser
+pref("browser.tabs.closeTabByDblclick", false);
+pref("browser.tabs.closeWindowWithLastTab", true);
+pref("browser.tabs.allowTabDetach", true);
+// Open related links to a tab, e.g., link in current tab, at next to the
+// current tab if |insertRelatedAfterCurrent| is true.  Otherwise, always
+// append new tab to the end.
+pref("browser.tabs.insertRelatedAfterCurrent", true);
+// Open all links, e.g., bookmarks, history items at next to current tab
+// if |insertAfterCurrent| is true.  Otherwise, append new tab to the end
+// for non-related links. Note that if this is set to true, it will trump
+// the value of browser.tabs.insertRelatedAfterCurrent.
+pref("browser.tabs.insertAfterCurrent", false);
+pref("browser.tabs.warnOnClose", false);
+pref("browser.tabs.warnOnCloseOtherTabs", true);
+pref("browser.tabs.warnOnOpen", true);
+pref("browser.tabs.maxOpenBeforeWarn", 15);
+pref("browser.tabs.loadInBackground", true);
+pref("browser.tabs.opentabfor.middleclick", true);
+pref("browser.tabs.loadDivertedInBackground", false);
+pref("browser.tabs.loadBookmarksInBackground", false);
+pref("browser.tabs.loadBookmarksInTabs", false);
+pref("browser.tabs.tabClipWidth", 140);
+pref("browser.tabs.tabMinWidth", 76);
+// Users running in any of the following language codes will have the
+// secondary text on tabs hidden due to size constraints and readability
+// of the text at small font sizes.
+pref("browser.tabs.secondaryTextUnsupportedLocales", "ar,bn,bo,ckb,fa,gu,he,hi,ja,km,kn,ko,lo,mr,my,ne,pa,si,ta,te,th,ur,zh");
+
+//Control the visibility of Tab Manager Menu.
+pref("browser.tabs.tabmanager.enabled", true);
+
+// When tabs opened by links in other tabs via a combination of
+// browser.link.open_newwindow being set to 3 and target="_blank" etc are
+// closed:
+// true   return to the tab that opened this tab (its owner)
+// false  return to the adjacent tab (old default)
+pref("browser.tabs.selectOwnerOnClose", true);
+
+// This should match Chromium's audio indicator delay.
+pref("browser.tabs.delayHidingAudioPlayingIconMS", 3000);
+
+// Pref to control whether we use a separate privileged content process
+// for about: pages. This pref name did not age well: we will have multiple
+// types of privileged content processes, each with different privileges.
+// types of privleged content processes, each with different privleges.
+pref("browser.tabs.remote.separatePrivilegedContentProcess", true);
+
+#if defined(NIGHTLY_BUILD) && !defined(MOZ_ASAN)
+  // This pref will cause assertions when a remoteType triggers a process switch
+  // to a new remoteType it should not be able to trigger.
+  pref("browser.tabs.remote.enforceRemoteTypeRestrictions", true);
+#endif
+
+// Pref to control whether we use a separate privileged content process
+// for certain mozilla webpages (which are listed in the pref
+// browser.tabs.remote.separatedMozillaDomains).
+pref("browser.tabs.remote.separatePrivilegedMozillaWebContentProcess", true);
+
+#ifdef NIGHTLY_BUILD
+pref("browser.tabs.tooltipsShowPidAndActiveness", true);
+#else
+pref("browser.tabs.tooltipsShowPidAndActiveness", false);
+#endif
+
+pref("browser.tabs.firefox-view", true);
+pref("browser.tabs.firefox-view.logLevel", "Warn");
+pref("browser.tabs.firefox-view.notify-for-tabs", false);
+
+// allow_eval_* is enabled on Firefox Desktop only at this
+// point in time
+pref("security.allow_eval_with_system_principal", false);
+pref("security.allow_eval_in_parent_process", false);
+
+pref("security.allow_parent_unrestricted_js_loads", false);
+
+// Unload tabs when available memory is running low
+#if defined(XP_MACOSX) || defined(XP_WIN)
+    pref("browser.tabs.unloadOnLowMemory", true);
+#else
+    pref("browser.tabs.unloadOnLowMemory", false);
+#endif
+
+// Tab Unloader does not unload tabs whose last inactive period is longer than
+// this value (in milliseconds).
+pref("browser.tabs.min_inactive_duration_before_unload", 600000);
+
+// Does middleclick paste of clipboard to new tab button
+#ifdef UNIX_BUT_NOT_MAC
+pref("browser.tabs.searchclipboardfor.middleclick", true);
+#else
+pref("browser.tabs.searchclipboardfor.middleclick", false);
+#endif
+
+#if defined(XP_MACOSX)
+  // During low memory periods, poll with this frequency (milliseconds)
+  // until memory is no longer low. Changes to the pref take effect immediately.
+  // Browser restart not required. Chosen to be consistent with the windows
+  // implementation, but otherwise the 10s value is arbitrary.
+  pref("browser.lowMemoryPollingIntervalMS", 10000);
+
+  // Pref to control the reponse taken on macOS when the OS is under memory
+  // pressure. Changes to the pref take effect immediately. Browser restart not
+  // required. The pref value is a bitmask:
+  // 0x0: No response (other than recording for telemetry, crash reporting)
+  // 0x1: Use the tab unloading feature to reduce memory use. Requires that
+  //      the above "browser.tabs.unloadOnLowMemory" pref be set to true for tab
+  //      unloading to occur.
+  // 0x2: Issue the internal "memory-pressure" notification to reduce memory use
+  // 0x3: Both 0x1 and 0x2.
+  #if defined(NIGHTLY_BUILD)
+  pref("browser.lowMemoryResponseMask", 3);
+  #else
+  pref("browser.lowMemoryResponseMask", 0);
+  #endif
+
+  // Controls which macOS memory-pressure level triggers the browser low memory
+  // response. Changes to the pref take effect immediately. Browser restart not
+  // required. By default, use the "critical" level as that occurs after "warn"
+  // and we only want to trigger the low memory reponse when necessary.
+  // The macOS system memory-pressure level is either none, "warn", or
+  // "critical". The OS notifies the browser when the level changes. A false
+  // value for the pref indicates the low memory response should occur when
+  // reaching the "critical" level. A true value indicates the response should
+  // occur when reaching the "warn" level.
+  pref("browser.lowMemoryResponseOnWarn", false);
+#endif
+
+pref("browser.ctrlTab.sortByRecentlyUsed", false);
+
+// By default, do not export HTML at shutdown.
+// If true, at shutdown the bookmarks in your menu and toolbar will
+// be exported as HTML to the bookmarks.html file.
+pref("browser.bookmarks.autoExportHTML",          false);
+
+// The maximum number of daily bookmark backups to
+// keep in {PROFILEDIR}/bookmarkbackups. Special values:
+// -1: unlimited
+//  0: no backups created (and deletes all existing backups)
+pref("browser.bookmarks.max_backups",             15);
+
+// Whether menu should close after Ctrl-click, middle-click, etc.
+pref("browser.bookmarks.openInTabClosesMenu", true);
+
+// Where new bookmarks go by default.
+// Use PlacesUIUtils.defaultParentGuid to read this; do NOT read the pref
+// directly.
+// The value is one of:
+// - a bookmarks guid
+// - "toolbar", "menu" or "unfiled" for those folders.
+// If we use the pref but the value isn't any of these, we'll fall back to
+// the bookmarks toolbar as a default.
+pref("browser.bookmarks.defaultLocation", "toolbar");
+
+// Scripts & Windows prefs
+pref("dom.disable_open_during_load",              true);
+
+// allow JS to move and resize existing windows
+pref("dom.disable_window_move_resize",            false);
+// prevent JS from monkeying with window focus, etc
+pref("dom.disable_window_flip",                   true);
+
+// popups.policy 1=allow,2=reject
+pref("privacy.popups.policy",               1);
+pref("privacy.popups.usecustom",            true);
+pref("privacy.popups.showBrowserMessage",   true);
+
+pref("privacy.item.cookies",                false);
+
+pref("privacy.clearOnShutdown.history",     true);
+pref("privacy.clearOnShutdown.formdata",    true);
+pref("privacy.clearOnShutdown.downloads",   true);
+pref("privacy.clearOnShutdown.cookies",     true);
+pref("privacy.clearOnShutdown.cache",       true);
+pref("privacy.clearOnShutdown.sessions",    true);
+pref("privacy.clearOnShutdown.offlineApps", false);
+pref("privacy.clearOnShutdown.siteSettings", false);
+pref("privacy.clearOnShutdown.openWindows", false);
+
+pref("privacy.cpd.history",                 true);
+pref("privacy.cpd.formdata",                true);
+pref("privacy.cpd.passwords",               false);
+pref("privacy.cpd.downloads",               true);
+pref("privacy.cpd.cookies",                 true);
+pref("privacy.cpd.cache",                   true);
+pref("privacy.cpd.sessions",                true);
+pref("privacy.cpd.offlineApps",             false);
+pref("privacy.cpd.siteSettings",            false);
+pref("privacy.cpd.openWindows",             false);
+
+pref("privacy.history.custom",              false);
+
+// What default should we use for the time span in the sanitizer:
+// 0 - Clear everything
+// 1 - Last Hour
+// 2 - Last 2 Hours
+// 3 - Last 4 Hours
+// 4 - Today
+// 5 - Last 5 minutes
+// 6 - Last 24 hours
+pref("privacy.sanitize.timeSpan", 1);
+
+pref("privacy.sanitize.migrateFx3Prefs",    false);
+
+pref("privacy.panicButton.enabled",         true);
+
+// Time until temporary permissions expire, in ms
+pref("privacy.temporary_permission_expire_time_ms",  3600000);
+
+// Enables protection mechanism against password spoofing for cross domain auh requests
+// See bug 791594
+pref("privacy.authPromptSpoofingProtection",         true);
+
+pref("network.proxy.share_proxy_settings",  false); // use the same proxy settings for all protocols
+
+// simple gestures support
+pref("browser.gesture.swipe.left", "Browser:BackOrBackDuplicate");
+pref("browser.gesture.swipe.right", "Browser:ForwardOrForwardDuplicate");
+pref("browser.gesture.swipe.up", "cmd_scrollTop");
+pref("browser.gesture.swipe.down", "cmd_scrollBottom");
+pref("browser.gesture.pinch.latched", false);
+pref("browser.gesture.pinch.threshold", 25);
+#if defined(XP_WIN) || defined(MOZ_WIDGET_GTK)
+  // Enabled for touch input display zoom.
+  pref("browser.gesture.pinch.out", "cmd_fullZoomEnlarge");
+  pref("browser.gesture.pinch.in", "cmd_fullZoomReduce");
+  pref("browser.gesture.pinch.out.shift", "cmd_fullZoomReset");
+  pref("browser.gesture.pinch.in.shift", "cmd_fullZoomReset");
+#else
+  // Disabled by default due to issues with track pad input.
+  pref("browser.gesture.pinch.out", "");
+  pref("browser.gesture.pinch.in", "");
+  pref("browser.gesture.pinch.out.shift", "");
+  pref("browser.gesture.pinch.in.shift", "");
+#endif
+pref("browser.gesture.twist.latched", false);
+pref("browser.gesture.twist.threshold", 0);
+pref("browser.gesture.twist.right", "cmd_gestureRotateRight");
+pref("browser.gesture.twist.left", "cmd_gestureRotateLeft");
+pref("browser.gesture.twist.end", "cmd_gestureRotateEnd");
+#if defined(XP_WIN) || defined(MOZ_WIDGET_GTK)
+  pref("browser.gesture.tap", "cmd_fullZoomReset");
+#else
+  pref("browser.gesture.tap", "");
+#endif
+
+pref("browser.history_swipe_animation.disabled", false);
+
+// 0: Nothing happens
+// 1: Scrolling contents
+// 2: Go back or go forward, in your history
+// 3: Zoom in or out (reflowing zoom).
+// 4: Treat vertical wheel as horizontal scroll
+// 5: Zoom in or out (pinch zoom).
+#ifdef XP_MACOSX
+  // On macOS, if the wheel has one axis only, shift+wheel comes through as a
+  // horizontal scroll event. Thus, we can't assign anything other than normal
+  // scrolling to shift+wheel.
+  pref("mousewheel.with_shift.action", 1);
+  pref("mousewheel.with_alt.action", 2);
+  pref("mousewheel.with_control.action", 1);
+#else
+  // On the other platforms (non-macOS), user may use legacy mouse which
+  // supports only vertical wheel but want to scroll horizontally.  For such
+  // users, we should provide horizontal scroll with shift+wheel (same as
+  // Chrome). However, shift+wheel was used for navigating history.  For users
+  // who want to keep using this feature, let's enable it with alt+wheel.  This
+  // is better for consistency with macOS users.
+  pref("mousewheel.with_shift.action", 4);
+  pref("mousewheel.with_alt.action", 2);
+#endif
+
+pref("mousewheel.with_win.action", 1);
+
+pref("browser.xul.error_pages.expert_bad_cert", false);
+pref("browser.xul.error_pages.show_safe_browsing_details_on_load", false);
+
+// Enable captive portal detection.
+pref("network.captive-portal-service.enabled", true);
+
+// If true, network link events will change the value of navigator.onLine
+pref("network.manage-offline-status", true);
+
+// We want to make sure mail URLs are handled externally...
+pref("network.protocol-handler.external.mailto", true); // for mail
+pref("network.protocol-handler.external.news", true);   // for news
+pref("network.protocol-handler.external.snews", true);  // for secure news
+pref("network.protocol-handler.external.nntp", true);   // also news
+#ifdef XP_WIN
+  pref("network.protocol-handler.external.ms-windows-store", true);
+#endif
+
+// ...without warning dialogs
+pref("network.protocol-handler.warn-external.mailto", false);
+pref("network.protocol-handler.warn-external.news", false);
+pref("network.protocol-handler.warn-external.snews", false);
+pref("network.protocol-handler.warn-external.nntp", false);
+#ifdef XP_WIN
+  pref("network.protocol-handler.warn-external.ms-windows-store", false);
+#endif
+
+// By default, all protocol handlers are exposed.  This means that
+// the browser will respond to openURL commands for all URL types.
+// It will also try to open link clicks inside the browser before
+// failing over to the system handlers.
+pref("network.protocol-handler.expose-all", true);
+pref("network.protocol-handler.expose.mailto", false);
+pref("network.protocol-handler.expose.news", false);
+pref("network.protocol-handler.expose.snews", false);
+pref("network.protocol-handler.expose.nntp", false);
+
+pref("accessibility.typeaheadfind", false);
+pref("accessibility.typeaheadfind.timeout", 5000);
+pref("accessibility.typeaheadfind.linksonly", false);
+pref("accessibility.typeaheadfind.flashBar", 1);
+
+pref("plugins.testmode", false);
+
+// Should plugins that are hidden show the infobar UI?
+pref("plugins.show_infobar", false);
+
+#if defined(_ARM64_) && defined(XP_WIN)
+  pref("plugin.default.state", 0);
+#else
+  pref("plugin.default.state", 1);
+#endif
+
+// Toggling Search bar on and off in about:preferences
+pref("browser.preferences.search", true);
+#if defined(NIGHTLY_BUILD)
+pref("browser.preferences.experimental", true);
+#else
+pref("browser.preferences.experimental", false);
+#endif
+pref("browser.preferences.moreFromMozilla", true);
+pref("browser.preferences.experimental.hidden", false);
+pref("browser.preferences.defaultPerformanceSettings.enabled", true);
+
+pref("browser.proton.toolbar.version", 0);
+
+// Backspace and Shift+Backspace behavior
+// 0 goes Back/Forward
+// 1 act like PgUp/PgDown
+// 2 and other values, nothing
+pref("browser.backspace_action", 2);
+
+pref("intl.regional_prefs.use_os_locales", false);
+
+// this will automatically enable inline spellchecking (if it is available) for
+// editable elements in HTML
+// 0 = spellcheck nothing
+// 1 = check multi-line controls [default]
+// 2 = check multi/single line controls
+pref("layout.spellcheckDefault", 1);
+
+pref("browser.send_pings", false);
+
+pref("browser.geolocation.warning.infoURL", "https://www.mozilla.org/%LOCALE%/firefox/geolocation/");
+pref("browser.xr.warning.infoURL", "https://www.mozilla.org/%LOCALE%/firefox/xr/");
+
+pref("browser.sessionstore.resume_from_crash", true);
+pref("browser.sessionstore.resume_session_once", false);
+pref("browser.sessionstore.resuming_after_os_restart", false);
+
+// Minimal interval between two save operations in milliseconds (while the user is idle).
+pref("browser.sessionstore.interval.idle", 3600000); // 1h
+
+// Time (seconds) before we assume that the user is idle and that we don't need to
+// collect/save the session quite as often.
+pref("browser.sessionstore.idleDelay", 180); // 3 minutes
+
+// on which sites to save text data, POSTDATA and cookies
+// 0 = everywhere, 1 = unencrypted sites, 2 = nowhere
+pref("browser.sessionstore.privacy_level", 0);
+// how many tabs can be reopened (per window)
+pref("browser.sessionstore.max_tabs_undo", 25);
+// how many windows can be reopened (per session) - on non-OS X platforms this
+// pref may be ignored when dealing with pop-up windows to ensure proper startup
+pref("browser.sessionstore.max_windows_undo", 3);
+// number of crashes that can occur before the about:sessionrestore page is displayed
+// (this pref has no effect if more than 6 hours have passed since the last crash)
+pref("browser.sessionstore.max_resumed_crashes", 1);
+// number of back button session history entries to restore (-1 = all of them)
+pref("browser.sessionstore.max_serialize_back", 10);
+// number of forward button session history entries to restore (-1 = all of them)
+pref("browser.sessionstore.max_serialize_forward", -1);
+// restore_on_demand overrides MAX_CONCURRENT_TAB_RESTORES (sessionstore constant)
+// and restore_hidden_tabs. When true, tabs will not be restored until they are
+// focused (also applies to tabs that aren't visible). When false, the values
+// for MAX_CONCURRENT_TAB_RESTORES and restore_hidden_tabs are respected.
+// Selected tabs are always restored regardless of this pref.
+pref("browser.sessionstore.restore_on_demand", true);
+// Whether to automatically restore hidden tabs (i.e., tabs in other tab groups) or not
+pref("browser.sessionstore.restore_hidden_tabs", false);
+// If restore_on_demand is set, pinned tabs are restored on startup by default.
+// When set to true, this pref overrides that behavior, and pinned tabs will only
+// be restored when they are focused.
+pref("browser.sessionstore.restore_pinned_tabs_on_demand", false);
+// The version at which we performed the latest upgrade backup
+pref("browser.sessionstore.upgradeBackup.latestBuildID", "");
+// How many upgrade backups should be kept
+pref("browser.sessionstore.upgradeBackup.maxUpgradeBackups", 3);
+// End-users should not run sessionstore in debug mode
+pref("browser.sessionstore.debug", false);
+// Forget closed windows/tabs after two weeks
+pref("browser.sessionstore.cleanup.forget_closed_after", 1209600000);
+// Platform collects session storage data for session store
+pref("browser.sessionstore.collect_session_storage", true);
+
+// Don't quit the browser when Ctrl + Q is pressed.
+pref("browser.quitShortcut.disabled", false);
+
+// allow META refresh by default
+pref("accessibility.blockautorefresh", false);
+
+// Whether history is enabled or not.
+pref("places.history.enabled", true);
+
+// The default Places log level.
+pref("places.loglevel", "Error");
+
+// Whether or not diacritics must match in history text searches.
+pref("places.search.matchDiacritics", false);
+
+// the (maximum) number of the recent visits to sample
+// when calculating frecency
+pref("places.frecency.numVisits", 10);
+
+// buckets (in days) for frecency calculation
+pref("places.frecency.firstBucketCutoff", 4);
+pref("places.frecency.secondBucketCutoff", 14);
+pref("places.frecency.thirdBucketCutoff", 31);
+pref("places.frecency.fourthBucketCutoff", 90);
+
+// weights for buckets for frecency calculations
+pref("places.frecency.firstBucketWeight", 100);
+pref("places.frecency.secondBucketWeight", 70);
+pref("places.frecency.thirdBucketWeight", 50);
+pref("places.frecency.fourthBucketWeight", 30);
+pref("places.frecency.defaultBucketWeight", 10);
+
+// bonus (in percent) for visit transition types for frecency calculations
+pref("places.frecency.embedVisitBonus", 0);
+pref("places.frecency.framedLinkVisitBonus", 0);
+pref("places.frecency.linkVisitBonus", 100);
+pref("places.frecency.typedVisitBonus", 2000);
+// The bookmarks bonus is always added on top of any other bonus, including
+// the redirect source and the typed ones.
+pref("places.frecency.bookmarkVisitBonus", 75);
+// The redirect source bonus overwrites any transition bonus.
+// 0 would hide these pages, instead we want them low ranked.  Thus we use
+// linkVisitBonus - bookmarkVisitBonus, so that a bookmarked source is in par
+// with a common link.
+pref("places.frecency.redirectSourceVisitBonus", 25);
+pref("places.frecency.downloadVisitBonus", 0);
+// The perm/temp redirects here relate to redirect targets, not sources.
+pref("places.frecency.permRedirectVisitBonus", 50);
+pref("places.frecency.tempRedirectVisitBonus", 40);
+pref("places.frecency.reloadVisitBonus", 0);
+pref("places.frecency.defaultVisitBonus", 0);
+
+// bonus (in percent) for place types for frecency calculations
+pref("places.frecency.unvisitedBookmarkBonus", 140);
+pref("places.frecency.unvisitedTypedBonus", 200);
+
+// Enables alternative frecency calculation for origins.
+pref("places.frecency.origins.alternative.featureGate", false);
+
+// Clear data by base domain (including partitioned storage) when the user
+// selects "Forget About This Site".
+pref("places.forgetThisSite.clearByBaseDomain", true);
+
+// Whether to warm up network connections for places: menus and places: toolbar.
+pref("browser.places.speculativeConnect.enabled", true);
+
+// if true, use full page zoom instead of text zoom
+pref("browser.zoom.full", true);
+
+// Whether or not to save and restore zoom levels on a per-site basis.
+pref("browser.zoom.siteSpecific", true);
+
+// Whether or not to update background tabs to the current zoom level.
+pref("browser.zoom.updateBackgroundTabs", true);
+
+// The breakpad report server to link to in about:crashes
+pref("breakpad.reportURL", "https://crash-stats.mozilla.org/report/index/");
+
+// URL for "Learn More" for DataCollection
+pref("toolkit.datacollection.infoURL",
+     "https://www.mozilla.org/legal/privacy/firefox.html");
+
+// URL for "Learn More" for Crash Reporter
+pref("toolkit.crashreporter.infoURL",
+     "https://www.mozilla.org/legal/privacy/firefox.html#crash-reporter");
+
+// base URL for web-based support pages
+pref("app.support.baseURL", "https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/");
+
+// base url for web-based feedback pages
+pref("app.feedback.baseURL", "https://ideas.mozilla.org/");
+
+// Name of alternate about: page for certificate errors (when undefined, defaults to about:neterror)
+pref("security.alternate_certificate_error_page", "certerror");
+
+pref("security.certerrors.recordEventTelemetry", true);
+pref("security.certerrors.permanentOverride", true);
+pref("security.certerrors.mitm.priming.enabled", true);
+pref("security.certerrors.mitm.priming.endpoint", "https://mitmdetection.services.mozilla.com/");
+pref("security.certerrors.mitm.auto_enable_enterprise_roots", true);
+
+// Whether the bookmark panel should be shown when bookmarking a page.
+pref("browser.bookmarks.editDialog.showForNewBookmarks", true);
+
+// Don't try to alter this pref, it'll be reset the next time you use the
+// bookmarking dialog
+pref("browser.bookmarks.editDialog.firstEditField", "namePicker");
+
+// The number of recently selected folders in the edit bookmarks dialog.
+pref("browser.bookmarks.editDialog.maxRecentFolders", 7);
+
+#if defined(XP_WIN) && defined(MOZ_SANDBOX)
+  // This controls the strength of the Windows content process sandbox for
+  // testing purposes. This will require a restart.
+  // On windows these levels are:
+  // See - security/sandbox/win/src/sandboxbroker/sandboxBroker.cpp
+  // SetSecurityLevelForContentProcess() for what the different settings mean.
+  pref("security.sandbox.content.level", 6);
+
+  // Pref controlling if messages relevant to sandbox violations are logged.
+  pref("security.sandbox.logging.enabled", false);
+#endif
+
+#if defined(XP_MACOSX) && defined(MOZ_SANDBOX)
+  // This pref is discussed in bug 1083344, the naming is inspired from its
+  // Windows counterpart, but on Mac it's an integer which means:
+  // 0 -> "no sandbox" (nightly only)
+  // 1 -> "preliminary content sandboxing enabled: write access to
+  //       home directory is prevented"
+  // 2 -> "preliminary content sandboxing enabled with profile protection:
+  //       write access to home directory is prevented, read and write access
+  //       to ~/Library and profile directories are prevented (excluding
+  //       $PROFILE/{extensions,chrome})"
+  // 3 -> "no global read/write access, read access permitted to
+  //       $PROFILE/{extensions,chrome}"
+  // This setting is read when the content process is started. On Mac the
+  // content process is killed when all windows are closed, so a change will
+  // take effect when the 1st window is opened.
+  pref("security.sandbox.content.level", 3);
+
+  // Disconnect content processes from the window server. Depends on
+  // out-of-process WebGL and non-native theming. i.e., both in-process WebGL
+  // and native theming depend on content processes having a connection to the
+  // window server. Window server disconnection is automatically disabled (and
+  // this pref overridden) if OOP WebGL is disabled. OOP WebGL is disabled
+  // for some tests.
+  pref("security.sandbox.content.mac.disconnect-windowserver", true);
+
+  // Pref controlling if messages relevant to sandbox violations are logged.
+  pref("security.sandbox.logging.enabled", false);
+#endif
+
+#if defined(XP_LINUX) && defined(MOZ_SANDBOX)
+  // This pref is introduced as part of bug 742434, the naming is inspired from
+  // its Windows/Mac counterpart, but on Linux it's an integer which means:
+  // 0 -> "no sandbox"
+  // 1 -> no longer used; level will be clamped to 2
+  // 2 -> "seccomp-bpf + write file broker"
+  // 3 -> "seccomp-bpf + read/write file brokering"
+  // 4 -> all of the above + network/socket restrictions + chroot
+  //
+  // The purpose of this setting is to allow Linux users or distros to disable
+  // the sandbox while we fix their problems, or to allow running Firefox with
+  // exotic configurations we can't reasonably support out of the box.
+  //
+  pref("security.sandbox.content.level", 4);
+  // Introduced as part of bug 1608558.  Linux is currently the only platform
+  // that uses a sandbox level for the socket process.  There are currently
+  // only 2 levels:
+  // 0 -> "no sandbox"
+  // 1 -> "sandboxed, allows socket operations and reading necessary certs"
+  pref("security.sandbox.socket.process.level", 1);
+  pref("security.sandbox.content.write_path_whitelist", "");
+  pref("security.sandbox.content.read_path_whitelist", "");
+  pref("security.sandbox.content.syscall_whitelist", "");
+#endif
+
+#if defined(XP_OPENBSD) && defined(MOZ_SANDBOX)
+  pref("security.sandbox.content.level", 1);
+#endif
+
+#if defined(MOZ_CONTENT_TEMP_DIR)
+  // ID (a UUID when set by gecko) that is used to form the name of a
+  // sandbox-writable temporary directory to be used by content processes
+  // when a temporary writable file is required.
+  pref("security.sandbox.content.tempDirSuffix", "");
+#endif
+
+// This pref governs whether we attempt to work around problems caused by
+// plugins using OS calls to manipulate the cursor while running out-of-
+// process.  These workarounds all involve intercepting (hooking) certain
+// OS calls in the plugin process, then arranging to make certain OS calls
+// in the browser process.  Eventually plugins will be required to use the
+// NPAPI to manipulate the cursor, and these workarounds will be removed.
+// See bug 621117.
+#ifdef XP_MACOSX
+  pref("dom.ipc.plugins.nativeCursorSupport", true);
+#endif
+
+#ifdef XP_WIN
+  pref("browser.taskbar.previews.enable", false);
+  pref("browser.taskbar.previews.max", 20);
+  pref("browser.taskbar.previews.cachetime", 5);
+  pref("browser.taskbar.lists.enabled", true);
+  pref("browser.taskbar.lists.frequent.enabled", true);
+  pref("browser.taskbar.lists.recent.enabled", false);
+  pref("browser.taskbar.lists.maxListItemCount", 7);
+  pref("browser.taskbar.lists.tasks.enabled", true);
+  pref("browser.taskbar.lists.refreshInSeconds", 120);
+#endif
+
+// Preferences to be synced by default.
+// Preferences with the prefix `services.sync.prefs.sync-seen.` should have
+// a value of `false`, and means the value of the pref will be synced as soon
+// as a value for the pref is "seen", even if it is the default, and should be
+// used for prefs we sync but which have different values on different channels,
+// platforms or distributions.
+pref("services.sync.prefs.sync.accessibility.blockautorefresh", true);
+pref("services.sync.prefs.sync.accessibility.browsewithcaret", true);
+pref("services.sync.prefs.sync.accessibility.typeaheadfind", true);
+pref("services.sync.prefs.sync.accessibility.typeaheadfind.linksonly", true);
+pref("services.sync.prefs.sync.addons.ignoreUserEnabledChanges", true);
+pref("services.sync.prefs.sync.app.shield.optoutstudies.enabled", true);
+// The addons prefs related to repository verification are intentionally
+// not synced for security reasons. If a system is compromised, a user
+// could weaken the pref locally, install an add-on from an untrusted
+// source, and this would propagate automatically to other,
+// uncompromised Sync-connected devices.
+pref("services.sync.prefs.sync.browser.contentblocking.category", true);
+pref("services.sync.prefs.sync.browser.contentblocking.features.strict", true);
+pref("services.sync.prefs.sync.browser.crashReports.unsubmittedCheck.autoSubmit2", true);
+pref("services.sync.prefs.sync.browser.ctrlTab.sortByRecentlyUsed", true);
+pref("services.sync.prefs.sync.browser.discovery.enabled", true);
+pref("services.sync.prefs.sync.browser.download.useDownloadDir", true);
+pref("services.sync.prefs.sync.browser.firefox-view.feature-tour", true);
+pref("services.sync.prefs.sync.browser.formfill.enable", true);
+pref("services.sync.prefs.sync.browser.link.open_newwindow", true);
+pref("services.sync.prefs.sync.browser.menu.showViewImageInfo", true);
+pref("services.sync.prefs.sync.browser.newtabpage.activity-stream.asrouter.userprefs.cfr.addons", true);
+pref("services.sync.prefs.sync.browser.newtabpage.activity-stream.asrouter.userprefs.cfr.features", true);
+pref("services.sync.prefs.sync.browser.newtabpage.activity-stream.showSearch", true);
+pref("services.sync.prefs.sync.browser.newtabpage.activity-stream.showSponsored", true);
+pref("services.sync.prefs.sync.browser.newtabpage.activity-stream.showSponsoredTopSites", true);
+pref("services.sync.prefs.sync.browser.newtabpage.activity-stream.feeds.topsites", true);
+pref("services.sync.prefs.sync.browser.newtabpage.activity-stream.topSitesRows", true);
+pref("services.sync.prefs.sync.browser.newtabpage.activity-stream.feeds.snippets", true);
+pref("services.sync.prefs.sync.browser.newtabpage.activity-stream.feeds.section.topstories", true);
+pref("services.sync.prefs.sync.browser.newtabpage.activity-stream.section.topstories.rows", true);
+pref("services.sync.prefs.sync.browser.newtabpage.activity-stream.feeds.section.highlights", true);
+// Some linux distributions disable all highlights by default.
+pref("services.sync.prefs.sync-seen.browser.newtabpage.activity-stream.section.highlights", false);
+pref("services.sync.prefs.sync.browser.newtabpage.activity-stream.section.highlights.includeVisited", true);
+pref("services.sync.prefs.sync.browser.newtabpage.activity-stream.section.highlights.includeBookmarks", true);
+pref("services.sync.prefs.sync.browser.newtabpage.activity-stream.section.highlights.includeDownloads", true);
+pref("services.sync.prefs.sync.browser.newtabpage.activity-stream.section.highlights.includePocket", true);
+// Some linux distributions disable just pocket by default.
+pref("services.sync.prefs.sync-seen.browser.newtabpage.activity-stream.section.highlights.includePocket", false);
+pref("services.sync.prefs.sync.browser.newtabpage.activity-stream.section.highlights.rows", true);
+pref("services.sync.prefs.sync.browser.newtabpage.enabled", true);
+pref("services.sync.prefs.sync.browser.newtabpage.pinned", true);
+pref("services.sync.prefs.sync.browser.pdfjs.feature-tour", true);
+pref("services.sync.prefs.sync.browser.safebrowsing.downloads.enabled", true);
+pref("services.sync.prefs.sync.browser.safebrowsing.downloads.remote.block_potentially_unwanted", true);
+pref("services.sync.prefs.sync.browser.safebrowsing.malware.enabled", true);
+pref("services.sync.prefs.sync.browser.safebrowsing.phishing.enabled", true);
+pref("services.sync.prefs.sync.browser.search.update", true);
+pref("services.sync.prefs.sync.browser.search.widget.inNavBar", true);
+pref("services.sync.prefs.sync.browser.startup.homepage", true);
+pref("services.sync.prefs.sync.browser.startup.page", true);
+pref("services.sync.prefs.sync.browser.tabs.loadInBackground", true);
+pref("services.sync.prefs.sync.browser.tabs.warnOnClose", true);
+pref("services.sync.prefs.sync.browser.tabs.warnOnOpen", true);
+pref("services.sync.prefs.sync.browser.taskbar.previews.enable", true);
+pref("services.sync.prefs.sync.browser.urlbar.maxRichResults", true);
+pref("services.sync.prefs.sync.browser.urlbar.showSearchSuggestionsFirst", true);
+pref("services.sync.prefs.sync.browser.urlbar.suggest.bookmark", true);
+pref("services.sync.prefs.sync.browser.urlbar.suggest.history", true);
+pref("services.sync.prefs.sync.browser.urlbar.suggest.openpage", true);
+pref("services.sync.prefs.sync.browser.urlbar.suggest.searches", true);
+pref("services.sync.prefs.sync.browser.urlbar.suggest.topsites", true);
+pref("services.sync.prefs.sync.browser.urlbar.suggest.engines", true);
+pref("services.sync.prefs.sync.dom.disable_open_during_load", true);
+pref("services.sync.prefs.sync.dom.disable_window_flip", true);
+pref("services.sync.prefs.sync.dom.disable_window_move_resize", true);
+pref("services.sync.prefs.sync.dom.event.contextmenu.enabled", true);
+pref("services.sync.prefs.sync.dom.security.https_only_mode", true);
+pref("services.sync.prefs.sync.dom.security.https_only_mode_ever_enabled", true);
+pref("services.sync.prefs.sync.dom.security.https_only_mode_ever_enabled_pbm", true);
+pref("services.sync.prefs.sync.dom.security.https_only_mode_pbm", true);
+pref("services.sync.prefs.sync.extensions.update.enabled", true);
+pref("services.sync.prefs.sync.extensions.activeThemeID", true);
+pref("services.sync.prefs.sync.general.autoScroll", true);
+// general.autoScroll has a different default on Linux vs elsewhere.
+pref("services.sync.prefs.sync-seen.general.autoScroll", false);
+pref("services.sync.prefs.sync.general.smoothScroll", true);
+pref("services.sync.prefs.sync.intl.accept_languages", true);
+pref("services.sync.prefs.sync.intl.regional_prefs.use_os_locales", true);
+pref("services.sync.prefs.sync.layout.spellcheckDefault", true);
+pref("services.sync.prefs.sync.media.autoplay.default", true);
+pref("services.sync.prefs.sync.media.eme.enabled", true);
+// Some linux distributions disable eme by default.
+pref("services.sync.prefs.sync-seen.media.eme.enabled", false);
+pref("services.sync.prefs.sync.media.videocontrols.picture-in-picture.video-toggle.enabled", true);
+pref("services.sync.prefs.sync.network.cookie.cookieBehavior", true);
+pref("services.sync.prefs.sync.network.cookie.thirdparty.sessionOnly", true);
+pref("services.sync.prefs.sync.permissions.default.image", true);
+pref("services.sync.prefs.sync.pref.downloads.disable_button.edit_actions", true);
+pref("services.sync.prefs.sync.pref.privacy.disable_button.cookie_exceptions", true);
+pref("services.sync.prefs.sync.privacy.clearOnShutdown.cache", true);
+pref("services.sync.prefs.sync.privacy.clearOnShutdown.cookies", true);
+pref("services.sync.prefs.sync.privacy.clearOnShutdown.downloads", true);
+pref("services.sync.prefs.sync.privacy.clearOnShutdown.formdata", true);
+pref("services.sync.prefs.sync.privacy.clearOnShutdown.history", true);
+pref("services.sync.prefs.sync.privacy.clearOnShutdown.offlineApps", true);
+pref("services.sync.prefs.sync.privacy.clearOnShutdown.sessions", true);
+pref("services.sync.prefs.sync.privacy.clearOnShutdown.siteSettings", true);
+pref("services.sync.prefs.sync.privacy.donottrackheader.enabled", true);
+pref("services.sync.prefs.sync.privacy.sanitize.sanitizeOnShutdown", true);
+pref("services.sync.prefs.sync.privacy.trackingprotection.enabled", true);
+pref("services.sync.prefs.sync.privacy.trackingprotection.cryptomining.enabled", true);
+pref("services.sync.prefs.sync.privacy.trackingprotection.fingerprinting.enabled", true);
+pref("services.sync.prefs.sync.privacy.trackingprotection.pbmode.enabled", true);
+// We do not sync `privacy.resistFingerprinting` by default as it's an undocumented,
+// not-recommended footgun - see bug 1763278 for more.
+pref("services.sync.prefs.sync.privacy.reduceTimerPrecision", true);
+pref("services.sync.prefs.sync.privacy.resistFingerprinting.reduceTimerPrecision.microseconds", true);
+pref("services.sync.prefs.sync.privacy.resistFingerprinting.reduceTimerPrecision.jitter", true);
+pref("services.sync.prefs.sync.privacy.userContext.enabled", true);
+pref("services.sync.prefs.sync.privacy.userContext.newTabContainerOnLeftClick.enabled", true);
+pref("services.sync.prefs.sync.security.default_personal_cert", true);
+pref("services.sync.prefs.sync.services.sync.syncedTabs.showRemoteIcons", true);
+pref("services.sync.prefs.sync.signon.autofillForms", true);
+pref("services.sync.prefs.sync.signon.generation.enabled", true);
+pref("services.sync.prefs.sync.signon.management.page.breach-alerts.enabled", true);
+pref("services.sync.prefs.sync.signon.rememberSignons", true);
+pref("services.sync.prefs.sync.spellchecker.dictionary", true);
+pref("services.sync.prefs.sync.ui.osk.enabled", true);
+
+// A preference which, if false, means sync will only apply incoming preference
+// changes if there's already a local services.sync.prefs.sync.* control pref.
+// If true, all incoming preferences will be applied and the local "control
+// pref" updated accordingly.
+pref("services.sync.prefs.dangerously_allow_arbitrary", false);
+
+// A preference that controls whether we should show the icon for a remote tab.
+// This pref has no UI but exists because some people may be concerned that
+// fetching these icons to show remote tabs may leak information about that
+// user's tabs and bookmarks. Note this pref is also synced.
+pref("services.sync.syncedTabs.showRemoteIcons", true);
+
+// A preference (in milliseconds) controlling if we sync after a tab change and
+// how long to delay before we schedule the sync
+// Anything <= 0 means disabled
+pref("services.sync.syncedTabs.syncDelayAfterTabChange", 5000);
+
+// Whether the character encoding menu is under the main Firefox button. This
+// preference is a string so that localizers can alter it.
+pref("browser.menu.showCharacterEncoding", "chrome://browser/locale/browser.properties");
+
+// Whether prompts should be content modal (1) tab modal (2) or window modal(3) by default
+// This is a fallback value for when prompt callers do not specify a modalType.
+pref("prompts.defaultModalType", 3);
+
+pref("browser.topsites.useRemoteSetting", true);
+// Fetch sponsored Top Sites from Mozilla Tiles Service (Contile)
+pref("browser.topsites.contile.enabled", true);
+pref("browser.topsites.contile.endpoint", "https://contile.services.mozilla.com/v1/tiles");
+
+// Whether to enable the Share-of-Voice feature for Sponsored Topsites via Contile.
+#if defined(EARLY_BETA_OR_EARLIER)
+  pref("browser.topsites.contile.sov.enabled", true);
+#else
+  pref("browser.topsites.contile.sov.enabled", false);
+#endif
+
+// The base URL for the Quick Suggest anonymizing proxy. To make a request to
+// the proxy, include a campaign ID in the path.
+pref("browser.partnerlink.attributionURL", "https://topsites.services.mozilla.com/cid/");
+pref("browser.partnerlink.campaign.topsites", "amzn_2020_a1");
+
+// Whether to show tab level system prompts opened via nsIPrompt(Service) as
+// SubDialogs in the TabDialogBox (true) or as TabModalPrompt in the
+// TabModalPromptBox (false).
+pref("prompts.tabChromePromptSubDialog", true);
+
+// Whether to show the dialogs opened at the content level, such as
+// alert() or prompt(), using a SubDialogManager in the TabDialogBox.
+pref("prompts.contentPromptSubDialog", true);
+
+// Whether to show window-modal dialogs opened for browser windows
+// in a SubDialog inside their parent, instead of an OS level window.
+pref("prompts.windowPromptSubDialog", true);
+
+// Activates preloading of the new tab url.
+pref("browser.newtab.preload", true);
+
+pref("browser.newtabpage.activity-stream.newNewtabExperience.colors", "#0090ED,#FF4F5F,#2AC3A2,#FF7139,#A172FF,#FFA437,#FF2A8A");
+
+// Activity Stream prefs that control to which page to redirect
+#ifndef RELEASE_OR_BETA
+  pref("browser.newtabpage.activity-stream.debug", false);
+#endif
+
+// The remote FxA root content URL for the Activity Stream firstrun page.
+pref("browser.newtabpage.activity-stream.fxaccounts.endpoint", "https://accounts.firefox.com/");
+
+// The pref that controls if the search shortcuts experiment is on
+pref("browser.newtabpage.activity-stream.improvesearch.topSiteSearchShortcuts", true);
+
+// ASRouter provider configuration
+pref("browser.newtabpage.activity-stream.asrouter.providers.cfr", "{\"id\":\"cfr\",\"enabled\":true,\"type\":\"remote-settings\",\"collection\":\"cfr\",\"updateCycleInMs\":3600000}");
+pref("browser.newtabpage.activity-stream.asrouter.providers.whats-new-panel", "{\"id\":\"whats-new-panel\",\"enabled\":true,\"type\":\"remote-settings\",\"collection\":\"whats-new-panel\",\"updateCycleInMs\":3600000}");
+pref("browser.newtabpage.activity-stream.asrouter.providers.message-groups", "{\"id\":\"message-groups\",\"enabled\":true,\"type\":\"remote-settings\",\"collection\":\"message-groups\",\"updateCycleInMs\":3600000}");
+// This url, if changed, MUST continue to point to an https url. Pulling arbitrary content to inject into
+// this page over http opens us up to a man-in-the-middle attack that we'd rather not face. If you are a downstream
+// repackager of this code using an alternate snippet url, please keep your users safe
+pref("browser.newtabpage.activity-stream.asrouter.providers.snippets", "{\"id\":\"snippets\",\"enabled\":false,\"type\":\"remote\",\"url\":\"https://snippets.cdn.mozilla.net/%STARTPAGE_VERSION%/%NAME%/%VERSION%/%APPBUILDID%/%BUILD_TARGET%/%LOCALE%/%CHANNEL%/%OS_VERSION%/%DISTRIBUTION%/%DISTRIBUTION_VERSION%/\",\"updateCycleInMs\":14400000}");
+pref("browser.newtabpage.activity-stream.asrouter.providers.messaging-experiments", "{\"id\":\"messaging-experiments\",\"enabled\":true,\"type\":\"remote-experiments\",\"updateCycleInMs\":3600000}");
+
+// ASRouter user prefs
+pref("browser.newtabpage.activity-stream.asrouter.userprefs.cfr.addons", true);
+pref("browser.newtabpage.activity-stream.asrouter.userprefs.cfr.features", true);
+
+// The pref that controls if ASRouter uses the remote fluent files.
+// It's enabled by default, but could be disabled to force ASRouter to use the local files.
+pref("browser.newtabpage.activity-stream.asrouter.useRemoteL10n", true);
+
+// These prefs control if Discovery Stream is enabled.
+pref("browser.newtabpage.activity-stream.discoverystream.enabled", true);
+pref("browser.newtabpage.activity-stream.discoverystream.hardcoded-basic-layout", false);
+pref("browser.newtabpage.activity-stream.discoverystream.hybridLayout.enabled", false);
+pref("browser.newtabpage.activity-stream.discoverystream.hideCardBackground.enabled", false);
+pref("browser.newtabpage.activity-stream.discoverystream.fourCardLayout.enabled", false);
+pref("browser.newtabpage.activity-stream.discoverystream.newFooterSection.enabled", false);
+pref("browser.newtabpage.activity-stream.discoverystream.saveToPocketCard.enabled", true);
+pref("browser.newtabpage.activity-stream.discoverystream.saveToPocketCardRegions", "");
+pref("browser.newtabpage.activity-stream.discoverystream.hideDescriptions.enabled", false);
+pref("browser.newtabpage.activity-stream.discoverystream.hideDescriptionsRegions", "");
+pref("browser.newtabpage.activity-stream.discoverystream.compactGrid.enabled", false);
+pref("browser.newtabpage.activity-stream.discoverystream.compactImages.enabled", false);
+pref("browser.newtabpage.activity-stream.discoverystream.imageGradient.enabled", false);
+pref("browser.newtabpage.activity-stream.discoverystream.titleLines", 3);
+pref("browser.newtabpage.activity-stream.discoverystream.descLines", 3);
+pref("browser.newtabpage.activity-stream.discoverystream.readTime.enabled", true);
+pref("browser.newtabpage.activity-stream.discoverystream.newSponsoredLabel.enabled", false);
+pref("browser.newtabpage.activity-stream.discoverystream.essentialReadsHeader.enabled", false);
+pref("browser.newtabpage.activity-stream.discoverystream.recentSaves.enabled", false);
+pref("browser.newtabpage.activity-stream.discoverystream.editorsPicksHeader.enabled", false);
+pref("browser.newtabpage.activity-stream.discoverystream.spoc-positions", "1,5,7,11,18,20");
+pref("browser.newtabpage.activity-stream.discoverystream.spoc-topsites-positions", "1");
+pref("browser.newtabpage.activity-stream.discoverystream.widget-positions", "");
+
+pref("browser.newtabpage.activity-stream.discoverystream.spocs-endpoint", "");
+pref("browser.newtabpage.activity-stream.discoverystream.spocs-endpoint-query", "");
+pref("browser.newtabpage.activity-stream.discoverystream.sponsored-collections.enabled", false);
+
+// Changes the spoc content.
+pref("browser.newtabpage.activity-stream.discoverystream.spocAdTypes", "");
+pref("browser.newtabpage.activity-stream.discoverystream.spocZoneIds", "");
+pref("browser.newtabpage.activity-stream.discoverystream.spocTopsitesAdTypes", "");
+pref("browser.newtabpage.activity-stream.discoverystream.spocTopsitesZoneIds", "");
+pref("browser.newtabpage.activity-stream.discoverystream.spocSiteId", "");
+
+pref("browser.newtabpage.activity-stream.discoverystream.sendToPocket.enabled", true);
+
+// List of regions that do not get stories, regardless of locale-list-config.
+pref("browser.newtabpage.activity-stream.discoverystream.region-stories-block", "");
+// List of locales that get stories, regardless of region-stories-config.
+#ifdef NIGHTLY_BUILD
+  pref("browser.newtabpage.activity-stream.discoverystream.locale-list-config", "en-US,en-CA,en-GB");
+#else
+  pref("browser.newtabpage.activity-stream.discoverystream.locale-list-config", "");
+#endif
+// List of regions that get stories by default.
+pref("browser.newtabpage.activity-stream.discoverystream.region-stories-config", "US,DE,CA,GB,IE,CH,AT,BE,IN,FR,IT,ES");
+// List of regions that support the new recommendations BFF, also requires region-stories-config
+pref("browser.newtabpage.activity-stream.discoverystream.region-bff-config", "FR,IT,ES");
+// List of regions that get spocs by default.
+pref("browser.newtabpage.activity-stream.discoverystream.region-spocs-config", "US,CA,DE,GB,FR,IT,ES");
+// List of regions that don't get the 7 row layout.
+pref("browser.newtabpage.activity-stream.discoverystream.region-basic-config", "");
+
+// Allows Pocket story collections to be dismissed.
+pref("browser.newtabpage.activity-stream.discoverystream.isCollectionDismissible", true);
+pref("browser.newtabpage.activity-stream.discoverystream.personalization.enabled", true);
+// Configurable keys used by personalization.
+pref("browser.newtabpage.activity-stream.discoverystream.personalization.modelKeys", "nb_model_arts_and_entertainment, nb_model_autos_and_vehicles, nb_model_beauty_and_fitness, nb_model_blogging_resources_and_services, nb_model_books_and_literature, nb_model_business_and_industrial, nb_model_computers_and_electronics, nb_model_finance, nb_model_food_and_drink, nb_model_games, nb_model_health, nb_model_hobbies_and_leisure, nb_model_home_and_garden, nb_model_internet_and_telecom, nb_model_jobs_and_education, nb_model_law_and_government, nb_model_online_communities, nb_model_people_and_society, nb_model_pets_and_animals, nb_model_real_estate, nb_model_reference, nb_model_science, nb_model_shopping, nb_model_sports, nb_model_travel");
+// System pref to allow Pocket stories personalization to be turned on/off.
+pref("browser.newtabpage.activity-stream.discoverystream.recs.personalized", false);
+// System pref to allow Pocket sponsored content personalization to be turned on/off.
+pref("browser.newtabpage.activity-stream.discoverystream.spocs.personalized", true);
+
+// Flip this once the user has dismissed the Pocket onboarding experience,
+pref("browser.newtabpage.activity-stream.discoverystream.onboardingExperience.dismissed", false);
+pref("browser.newtabpage.activity-stream.discoverystream.onboardingExperience.enabled", false);
+
+// User pref to show stories on newtab (feeds.system.topstories has to be set to true as well)
+pref("browser.newtabpage.activity-stream.feeds.section.topstories", true);
+
+// The pref controls if search hand-off is enabled for Activity Stream.
+pref("browser.newtabpage.activity-stream.improvesearch.handoffToAwesomebar", true);
+
+pref("browser.newtabpage.activity-stream.logowordmark.alwaysVisible", true);
+
+// URLs from the user's history that contain this search param will be hidden
+// from the top sites. The value is a string with one of the following forms:
+// - "" (empty) - Disable this feature
+// - "key" - Search param named "key" with any or no value
+// - "key=" - Search param named "key" with no value
+// - "key=value" - Search param named "key" with value "value"
+pref("browser.newtabpage.activity-stream.hideTopSitesWithSearchParam", "mfadid=adm");
+
+// Used to display triplet cards on newtab
+pref("trailhead.firstrun.newtab.triplets", "");
+// Separate about welcome
+pref("browser.aboutwelcome.enabled", true);
+// Used to set multistage welcome UX
+pref("browser.aboutwelcome.screens", "");
+// Used to enable window modal onboarding
+pref("browser.aboutwelcome.showModal", false);
+
+// The pref that controls if the What's New panel is enabled.
+pref("browser.messaging-system.whatsNewPanel.enabled", true);
+
+// Experiment Manager
+// See Console.sys.mjs LOG_LEVELS for all possible values
+pref("messaging-system.log", "warn");
+pref("messaging-system.rsexperimentloader.enabled", true);
+pref("messaging-system.rsexperimentloader.collection_id", "nimbus-desktop-experiments");
+pref("nimbus.debug", false);
+pref("nimbus.validation.enabled", true);
+
+// Nimbus QA prefs. Used to monitor pref-setting test experiments.
+pref("nimbus.qa.pref-1", "default");
+pref("nimbus.qa.pref-2", "default");
+
+// Enable the DOM fullscreen API.
+pref("full-screen-api.enabled", true);
+
+// Startup Crash Tracking
+// number of startup crashes that can occur before starting into safe mode automatically
+// (this pref has no effect if more than 6 hours have passed since the last crash)
+pref("toolkit.startup.max_resumed_crashes", 3);
+
+// Whether to use RegisterApplicationRestart to restart the browser and resume
+// the session on next Windows startup
+#if defined(XP_WIN)
+  pref("toolkit.winRegisterApplicationRestart", true);
+#endif
+
+// Used by pdf.js to know the first time firefox is run with it installed so it
+// can become the default pdf viewer.
+pref("pdfjs.firstRun", true);
+// The values of preferredAction and alwaysAskBeforeHandling before pdf.js
+// became the default.
+pref("pdfjs.previousHandler.preferredAction", 0);
+pref("pdfjs.previousHandler.alwaysAskBeforeHandling", false);
+
+// Try to convert PDFs sent as octet-stream
+pref("pdfjs.handleOctetStream", true);
+
+// Is the sidebar positioned ahead of the content browser
+pref("sidebar.position_start", true);
+
+pref("security.identitypopup.recordEventTelemetry", true);
+pref("security.protectionspopup.recordEventTelemetry", true);
+pref("security.app_menu.recordEventTelemetry", true);
+
+// Block insecure active content on https pages
+pref("security.mixed_content.block_active_content", true);
+
+// Show degraded UI for http pages.
+pref("security.insecure_connection_icon.enabled", true);
+// Show degraded UI for http pages in private mode.
+pref("security.insecure_connection_icon.pbmode.enabled", true);
+
+// Show "Not Secure" text for http pages; disabled for now
+pref("security.insecure_connection_text.enabled", false);
+pref("security.insecure_connection_text.pbmode.enabled", false);
+
+// 1 = allow MITM for certificate pinning checks.
+pref("security.cert_pinning.enforcement_level", 1);
+
+
+// If this turns true, Moz*Gesture events are not called stopPropagation()
+// before content.
+pref("dom.debug.propagate_gesture_events_through_content", false);
+
+// CustomizableUI debug logging.
+pref("browser.uiCustomization.debug", false);
+
+// CustomizableUI state of the browser's user interface
+pref("browser.uiCustomization.state", "");
+
+// If set to false, FxAccounts and Sync will be unavailable.
+// A restart is mandatory after flipping that preference.
+pref("identity.fxaccounts.enabled", true);
+
+// The remote FxA root content URL. Must use HTTPS.
+pref("identity.fxaccounts.remote.root", "https://accounts.firefox.com/");
+
+// The value of the context query parameter passed in fxa requests.
+pref("identity.fxaccounts.contextParam", "fx_desktop_v3");
+
+// The remote URL of the FxA Profile Server
+pref("identity.fxaccounts.remote.profile.uri", "https://profile.accounts.firefox.com/v1");
+
+// The remote URL of the FxA OAuth Server
+pref("identity.fxaccounts.remote.oauth.uri", "https://oauth.accounts.firefox.com/v1");
+
+// Whether FxA pairing using QR codes is enabled.
+pref("identity.fxaccounts.pairing.enabled", true);
+
+// The remote URI of the FxA pairing server
+pref("identity.fxaccounts.remote.pairing.uri", "wss://channelserver.services.mozilla.com");
+
+// Token server used by the FxA Sync identity.
+pref("identity.sync.tokenserver.uri", "https://token.services.mozilla.com/1.0/sync/1.5");
+
+// Auto-config URL for FxA self-hosters, makes an HTTP request to
+// [identity.fxaccounts.autoconfig.uri]/.well-known/fxa-client-configuration
+// This is now the prefered way of pointing to a custom FxA server, instead
+// of making changes to "identity.fxaccounts.*.uri".
+pref("identity.fxaccounts.autoconfig.uri", "");
+
+// URL for help link about Send Tab.
+pref("identity.sendtabpromo.url", "https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/send-tab");
+
+// URLs for promo links to mobile browsers. Note that consumers are expected to
+// append a value for utm_campaign.
+pref("identity.mobilepromo.android", "https://www.mozilla.org/firefox/android/?utm_source=firefox-browser&utm_medium=firefox-browser&utm_campaign=");
+pref("identity.mobilepromo.ios", "https://www.mozilla.org/firefox/ios/?utm_source=firefox-browser&utm_medium=firefox-browser&utm_campaign=");
+
+// Migrate any existing Firefox Account data from the default profile to the
+// Developer Edition profile.
+#ifdef MOZ_DEV_EDITION
+  pref("identity.fxaccounts.migrateToDevEdition", true);
+#else
+  pref("identity.fxaccounts.migrateToDevEdition", false);
+#endif
+
+// If activated, send tab will use the new FxA commands backend.
+pref("identity.fxaccounts.commands.enabled", true);
+// How often should we try to fetch missed FxA commands on sync (in seconds).
+// Default is 24 hours.
+pref("identity.fxaccounts.commands.missed.fetch_interval", 86400);
+
+// Whether we should run a test-pattern through EME GMPs before assuming they'll
+// decode H.264.
+pref("media.gmp.trial-create.enabled", true);
+
+// Note: when media.gmp-*.visible is true, provided we're running on a
+// supported platform/OS version, the corresponding CDM appears in the
+// plugins list, Firefox will download the GMP/CDM if enabled, and our
+// UI to re-enable EME prompts the user to re-enable EME if it's disabled
+// and script requests EME. If *.visible is false, we won't show the UI
+// to enable the CDM if its disabled; it's as if the keysystem is completely
+// unsupported.
+
+#ifdef MOZ_WIDEVINE_EME
+  pref("media.gmp-widevinecdm.visible", true);
+  pref("media.gmp-widevinecdm.enabled", true);
+#endif
+
+pref("media.gmp-gmpopenh264.visible", true);
+pref("media.gmp-gmpopenh264.enabled", true);
+
+pref("media.videocontrols.picture-in-picture.enabled", true);
+pref("media.videocontrols.picture-in-picture.audio-toggle.enabled", true);
+pref("media.videocontrols.picture-in-picture.video-toggle.enabled", true);
+pref("media.videocontrols.picture-in-picture.video-toggle.visibility-threshold", "1.0");
+pref("media.videocontrols.picture-in-picture.keyboard-controls.enabled", true);
+pref("media.videocontrols.picture-in-picture.urlbar-button.enabled", true);
+
+// Preferences for the older translation service backed by external services. This is
+// planned to be replaced with an integration of the Firefox Translations service.
+// The prefs for the new service are located under "browser.translations" in
+// modules/libpref/init/all.js
+//
+// See Bug 971044.
+pref("browser.translation.detectLanguage", false);
+pref("browser.translation.neverForLanguages", "");
+// Show the older translation UI that uses external services. This includes UI such as
+// the info bar, notification icon and preferences.
+pref("browser.translation.ui.show", false);
+// Allows to define the translation engine. Google is default, Bing or Yandex are other options.
+pref("browser.translation.engine", "Google");
+
+// Enable Firefox translations powered by the Bergamot translations
+// engine https://browser.mt/. See Bug 971044.
+#if defined(EARLY_BETA_OR_EARLIER)
+pref("browser.translations.enable", true);
+#endif
+
+// Telemetry settings.
+// Determines if Telemetry pings can be archived locally.
+pref("toolkit.telemetry.archive.enabled", true);
+// Enables sending the shutdown ping when Firefox shuts down.
+pref("toolkit.telemetry.shutdownPingSender.enabled", true);
+// Enables using the `pingsender` background task.
+pref("toolkit.telemetry.shutdownPingSender.backgroundtask.enabled", false);
+// Enables sending the shutdown ping using the pingsender from the first session.
+pref("toolkit.telemetry.shutdownPingSender.enabledFirstSession", false);
+// Enables sending a duplicate of the first shutdown ping from the first session.
+pref("toolkit.telemetry.firstShutdownPing.enabled", true);
+// Enables sending the 'new-profile' ping on new profiles.
+pref("toolkit.telemetry.newProfilePing.enabled", true);
+// Enables sending 'update' pings on Firefox updates.
+pref("toolkit.telemetry.updatePing.enabled", true);
+// Enables sending 'bhr' pings when the browser hangs.
+pref("toolkit.telemetry.bhrPing.enabled", true);
+
+// Ping Centre Telemetry settings.
+pref("browser.ping-centre.telemetry", true);
+pref("browser.ping-centre.log", false);
+
+// Enable GMP support in the addon manager.
+pref("media.gmp-provider.enabled", true);
+
+// Enable Dynamic First-Party Isolation by default.
+pref("network.cookie.cookieBehavior", 5 /* BEHAVIOR_REJECT_TRACKER_AND_PARTITION_FOREIGN */);
+
+// Enable Dynamic First-Party Isolation in the private browsing mode.
+pref("network.cookie.cookieBehavior.pbmode", 5 /* BEHAVIOR_REJECT_TRACKER_AND_PARTITION_FOREIGN */);
+
+// Enable fingerprinting blocking by default for all channels, only on desktop.
+pref("privacy.trackingprotection.fingerprinting.enabled", true);
+
+// Enable cryptomining blocking by default for all channels, only on desktop.
+pref("privacy.trackingprotection.cryptomining.enabled", true);
+
+pref("browser.contentblocking.database.enabled", true);
+
+pref("dom.storage_access.enabled", true);
+
+// Enable URL query stripping and strip on share in Nightly.
+#ifdef NIGHTLY_BUILD
+pref("privacy.query_stripping.enabled", true);
+pref("privacy.query_stripping.strip_on_share.enabled", true);
+#endif
+
+pref("browser.contentblocking.cryptomining.preferences.ui.enabled", true);
+pref("browser.contentblocking.fingerprinting.preferences.ui.enabled", true);
+// Enable cookieBehavior = BEHAVIOR_REJECT_TRACKER_AND_PARTITION_FOREIGN as an option in the custom category ui
+pref("browser.contentblocking.reject-and-isolate-cookies.preferences.ui.enabled", true);
+
+// Possible values for browser.contentblocking.features.strict pref:
+//   Tracking Protection:
+//     "tp": tracking protection enabled
+//     "-tp": tracking protection disabled
+//   Tracking Protection in private windows:
+//     "tpPrivate": tracking protection in private windows enabled
+//     "-tpPrivate": tracking protection in private windows disabled
+//   Fingerprinting:
+//     "fp": fingerprinting blocking enabled
+//     "-fp": fingerprinting blocking disabled
+//   Cryptomining:
+//     "cm": cryptomining blocking enabled
+//     "-cm": cryptomining blocking disabled
+//   Social Tracking Protection:
+//     "stp": social tracking protection enabled
+//     "-stp": social tracking protection disabled
+//   Email Tracking Protection:
+//     "emailTP": email tracking protection enabled
+//     "-emailTP": email tracking protection disabled
+//   Email Tracking Protection in private windows:
+//     "emailTPPrivate": email tracking protection in private windows enabled
+//     "-emailTPPrivate": email tracking protection in private windows disabled
+//   Level 2 Tracking list in normal windows:
+//     "lvl2": Level 2 tracking list enabled
+//     "-lvl2": Level 2 tracking list disabled
+//   Restrict relaxing default referrer policy:
+//     "rp": Restrict relaxing default referrer policy enabled
+//     "-rp": Restrict relaxing default referrer policy disabled
+//   Restrict relaxing default referrer policy for top navigation:
+//     "rpTop": Restrict relaxing default referrer policy enabled
+//     "-rpTop": Restrict relaxing default referrer policy disabled
+//   OCSP cache partitioning:
+//     "ocsp": OCSP cache partitioning enabled
+//     "-ocsp": OCSP cache partitioning disabled
+//   Query parameter stripping:
+//     "qps": Query parameter stripping enabled
+//     "-qps": Query parameter stripping disabled
+//   Query parameter stripping for private windows:
+//     "qpsPBM": Query parameter stripping enabled in private windows
+//     "-qpsPBM": Query parameter stripping disabled in private windows
+//   Cookie behavior:
+//     "cookieBehavior0": cookie behaviour BEHAVIOR_ACCEPT
+//     "cookieBehavior1": cookie behaviour BEHAVIOR_REJECT_FOREIGN
+//     "cookieBehavior2": cookie behaviour BEHAVIOR_REJECT
+//     "cookieBehavior3": cookie behaviour BEHAVIOR_LIMIT_FOREIGN
+//     "cookieBehavior4": cookie behaviour BEHAVIOR_REJECT_TRACKER
+//     "cookieBehavior5": cookie behaviour BEHAVIOR_REJECT_TRACKER_AND_PARTITION_FOREIGN
+//   Cookie behavior for private windows:
+//     "cookieBehaviorPBM0": cookie behaviour BEHAVIOR_ACCEPT
+//     "cookieBehaviorPBM1": cookie behaviour BEHAVIOR_REJECT_FOREIGN
+//     "cookieBehaviorPBM2": cookie behaviour BEHAVIOR_REJECT
+//     "cookieBehaviorPBM3": cookie behaviour BEHAVIOR_LIMIT_FOREIGN
+//     "cookieBehaviorPBM4": cookie behaviour BEHAVIOR_REJECT_TRACKER
+//     "cookieBehaviorPBM5": cookie behaviour BEHAVIOR_REJECT_TRACKER_AND_PARTITION_FOREIGN
+// One value from each section must be included in the browser.contentblocking.features.strict pref.
+pref("browser.contentblocking.features.strict", "tp,tpPrivate,cookieBehavior5,cookieBehaviorPBM5,cm,fp,stp,emailTP,emailTPPrivate,lvl2,rp,rpTop,ocsp,qps,qpsPBM");
+
+// Hide the "Change Block List" link for trackers/tracking content in the custom
+// Content Blocking/ETP panel. By default, it will not be visible. There is also
+// an UI migration in place to set this pref to true if a user has a custom block
+// lists enabled.
+pref("browser.contentblocking.customBlockList.preferences.ui.enabled", false);
+
+pref("browser.contentblocking.reportBreakage.url", "https://tracking-protection-issues.herokuapp.com/new");
+
+// Enable Protections report's Lockwise card by default.
+pref("browser.contentblocking.report.lockwise.enabled", true);
+
+// Disable rotections report's Monitor card by default. The new Monitor API does
+// not support this feature as of now. See Bug 1815751.
+pref("browser.contentblocking.report.monitor.enabled", false);
+
+// Disable Protections report's Proxy card by default.
+pref("browser.contentblocking.report.proxy.enabled", false);
+
+// Disable the mobile promotion by default.
+pref("browser.contentblocking.report.show_mobile_app", true);
+
+// Locales in which Send to Device emails are supported
+// The most recent list of supported locales can be found at https://github.com/mozilla/bedrock/blob/6a08c876f65924651554decc57b849c00874b4e7/bedrock/settings/base.py#L963
+pref("browser.send_to_device_locales", "de,en-GB,en-US,es-AR,es-CL,es-ES,es-MX,fr,id,pl,pt-BR,ru,zh-TW");
+
+// Avoid advertising in certain regions. Comma separated string of two letter ISO 3166-1 country codes.
+// We're currently blocking all of Ukraine (ua), but would prefer to block just Crimea (ua-43). Currently, the Mozilla Location Service APIs used by Region.sys.mjs only exposes the country, not the subdivision.
+pref("browser.vpn_promo.disallowed_regions", "ae,by,cn,cu,iq,ir,kp,om,ru,sd,sy,tm,tr,ua");
+
+// Default to enabling VPN promo messages to be shown when specified and allowed
+pref("browser.vpn_promo.enabled", true);
+// Only show vpn card to certain regions. Comma separated string of two letter ISO 3166-1 country codes.
+// The most recent list of supported countries can be found at https://support.mozilla.org/en-US/kb/mozilla-vpn-countries-available-subscribe
+// The full list of supported country codes can also be found at https://github.com/mozilla/bedrock/search?q=VPN_COUNTRY_CODES
+pref("browser.contentblocking.report.vpn_regions", "as,at,be,ca,ch,de,es,fi,fr,gb,gg,ie,im,io,it,je,mp,my,nl,nz,pr,se,sg,uk,um,us,vg,vi"
+);
+
+// Avoid advertising Focus in certain regions.  Comma separated string of two letter
+// ISO 3166-1 country codes.
+pref("browser.promo.focus.disallowed_regions", "cn");
+
+// Default to enabling focus promos to be shown where allowed.
+pref("browser.promo.focus.enabled", true);
+
+// Default to enabling pin promos to be shown where allowed.
+pref("browser.promo.pin.enabled", true);
+
+// Default to enabling cookie banner reduction promos to be shown where allowed.
+// Set to true for Fx113 (see bug 1808611)
+pref("browser.promo.cookiebanners.enabled", false);
+
+// Comma separated string of mozilla vpn supported platforms.
+pref("browser.contentblocking.report.vpn_platforms", "win,mac,linux");
+pref("browser.contentblocking.report.hide_vpn_banner", false);
+pref("browser.contentblocking.report.vpn_sub_id", "sub_HrfCZF7VPHzZkA");
+
+pref("browser.contentblocking.report.monitor.url", "https://monitor.firefox.com/?entrypoint=protection_report_monitor&utm_source=about-protections");
+pref("browser.contentblocking.report.monitor.how_it_works.url", "https://monitor.firefox.com/about");
+pref("browser.contentblocking.report.monitor.sign_in_url", "https://monitor.firefox.com/oauth/init?entrypoint=protection_report_monitor&utm_source=about-protections&email=");
+pref("browser.contentblocking.report.monitor.preferences_url", "https://monitor.firefox.com/user/preferences");
+pref("browser.contentblocking.report.monitor.home_page_url", "https://monitor.firefox.com/user/dashboard");
+pref("browser.contentblocking.report.manage_devices.url", "https://accounts.firefox.com/settings/clients");
+pref("browser.contentblocking.report.endpoint_url", "https://monitor.firefox.com/user/breach-stats?includeResolved=true");
+pref("browser.contentblocking.report.proxy_extension.url", "https://fpn.firefox.com/browser?utm_source=firefox-desktop&utm_medium=referral&utm_campaign=about-protections&utm_content=about-protections");
+pref("browser.contentblocking.report.mobile-ios.url", "https://apps.apple.com/app/firefox-private-safe-browser/id989804926");
+pref("browser.contentblocking.report.mobile-android.url", "https://play.google.com/store/apps/details?id=org.mozilla.firefox&referrer=utm_source%3Dprotection_report%26utm_content%3Dmobile_promotion");
+pref("browser.contentblocking.report.vpn.url", "https://vpn.mozilla.org/?utm_source=firefox-browser&utm_medium=firefox-browser&utm_campaign=about-protections-card");
+pref("browser.contentblocking.report.vpn-promo.url", "https://vpn.mozilla.org/?utm_source=firefox-browser&utm_medium=firefox-browser&utm_campaign=about-protections-top-promo");
+pref("browser.contentblocking.report.vpn-android.url", "https://play.google.com/store/apps/details?id=org.mozilla.firefox.vpn&referrer=utm_source%3Dfirefox-browser%26utm_medium%3Dfirefox-browser%26utm_campaign%3Dabout-protections-mobile-vpn%26anid%3D--");
+pref("browser.contentblocking.report.vpn-ios.url", "https://apps.apple.com/us/app/firefox-private-network-vpn/id1489407738");
+
+// Protection Report's SUMO urls
+pref("browser.contentblocking.report.lockwise.how_it_works.url", "https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/password-manager-report");
+pref("browser.contentblocking.report.social.url", "https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/social-media-tracking-report");
+pref("browser.contentblocking.report.cookie.url", "https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/cross-site-tracking-report");
+pref("browser.contentblocking.report.tracker.url", "https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/tracking-content-report");
+pref("browser.contentblocking.report.fingerprinter.url", "https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/fingerprinters-report");
+pref("browser.contentblocking.report.cryptominer.url", "https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/cryptominers-report");
+
+pref("browser.contentblocking.cfr-milestone.enabled", true);
+pref("browser.contentblocking.cfr-milestone.milestone-achieved", 0);
+// Milestones should always be in increasing order
+pref("browser.contentblocking.cfr-milestone.milestones", "[1000, 5000, 10000, 25000, 50000, 100000, 250000, 314159, 500000, 750000, 1000000, 1250000, 1500000, 1750000, 2000000, 2250000, 2500000, 8675309]");
+
+// Enables the new Protections Panel.
+#ifdef NIGHTLY_BUILD
+  pref("browser.protections_panel.enabled", true);
+  pref("browser.protections_panel.infoMessage.seen", false);
+#endif
+
+// Always enable newtab segregation using containers
+pref("privacy.usercontext.about_newtab_segregation.enabled", true);
+// Enable Contextual Identity Containers
+#ifdef NIGHTLY_BUILD
+  pref("privacy.userContext.enabled", true);
+  pref("privacy.userContext.ui.enabled", true);
+#else
+  pref("privacy.userContext.enabled", false);
+  pref("privacy.userContext.ui.enabled", false);
+#endif
+pref("privacy.userContext.extension", "");
+// allows user to open container menu on a left click instead of a new
+// tab in the default container
+pref("privacy.userContext.newTabContainerOnLeftClick.enabled", false);
+
+#if defined(NIGHTLY_BUILD) || defined(XP_WIN) || defined(XP_MACOSX)
+// Set to true to allow the user to silence all notifications when
+// sharing the screen. Only shipping on Windows and macOS out to
+// release. Enabled for all desktop platforms on Nightly.
+pref("privacy.webrtc.allowSilencingNotifications", true);
+// Set to true to use the legacy WebRTC global indicator
+pref("privacy.webrtc.legacyGlobalIndicator", false);
+pref("privacy.webrtc.hideGlobalIndicator", false);
+#else
+pref("privacy.webrtc.allowSilencingNotifications", false);
+pref("privacy.webrtc.legacyGlobalIndicator", true);
+#endif
+
+// Set to true to add toggles to the WebRTC indicator for globally
+// muting the camera and microphone.
+pref("privacy.webrtc.globalMuteToggles", false);
+
+// Set to true to enable a warning displayed when attempting
+// to switch tabs in a window that's being shared over WebRTC.
+pref("privacy.webrtc.sharedTabWarning", false);
+
+// Defines a grace period after camera or microphone use ends, where permission
+// is granted (even past navigation) to this tab + origin + device. This avoids
+// re-prompting without the user having to persist permission to the site, in a
+// common case of a web conference asking them for the camera in a lobby page,
+// before navigating to the actual meeting room page. Doesn't survive tab close.
+pref("privacy.webrtc.deviceGracePeriodTimeoutMs", 3600000);
+
+// Start the browser in e10s mode
+pref("browser.tabs.remote.autostart", true);
+pref("browser.tabs.remote.desktopbehavior", true);
+
+// Run media transport in a separate process?
+pref("media.peerconnection.mtransport_process", true);
+
+// For speculatively warming up tabs to improve perceived
+// performance while using the async tab switcher.
+pref("browser.tabs.remote.warmup.enabled", true);
+
+// Caches tab layers to improve perceived performance
+// of tab switches.
+pref("browser.tabs.remote.tabCacheSize", 0);
+
+pref("browser.tabs.remote.warmup.maxTabs", 3);
+pref("browser.tabs.remote.warmup.unloadDelayMs", 2000);
+
+// For the about:tabcrashed page
+pref("browser.tabs.crashReporting.sendReport", true);
+pref("browser.tabs.crashReporting.includeURL", false);
+
+// If true, unprivileged extensions may use experimental APIs on
+// nightly and developer edition.
+pref("extensions.experiments.enabled", false);
+
+#if defined(XP_LINUX) || defined(XP_WIN) || defined(XP_MACOSX)
+  // Allows us to adjust the priority of child processes at the OS level
+  pref("dom.ipc.processPriorityManager.enabled", true);
+#endif
+
+#if defined(XP_WIN)
+  pref("dom.ipc.processPriorityManager.backgroundUsesEcoQoS", true);
+#endif
+
+// Don't limit how many nodes we care about on desktop:
+pref("reader.parse-node-limit", 0);
+
+// On desktop, we want the URLs to be included here for ease of debugging,
+// and because (normally) these errors are not persisted anywhere.
+pref("reader.errors.includeURLs", true);
+
+// What version of Pocket CTA to show in Reader Mode (Empty string is no CTA)
+pref("reader.pocket.ctaVersion", "");
+
+pref("view_source.tab", true);
+
+pref("dom.serviceWorkers.enabled", true);
+
+// Enable Push API.
+pref("dom.push.enabled", true);
+
+// These are the thumbnail width/height set in about:newtab.
+// If you change this, ENSURE IT IS THE SAME SIZE SET
+// by about:newtab. These values are in CSS pixels.
+pref("toolkit.pageThumbs.minWidth", 280);
+pref("toolkit.pageThumbs.minHeight", 190);
+
+// Enable speech synthesis
+pref("media.webspeech.synth.enabled", true);
+
+pref("browser.esedbreader.loglevel", "Error");
+
+pref("browser.laterrun.enabled", false);
+
+#ifdef FUZZING_SNAPSHOT
+pref("dom.ipc.processPrelaunch.enabled", false);
+#else
+pref("dom.ipc.processPrelaunch.enabled", true);
+#endif
+
+pref("browser.migrate.bookmarks-file.enabled", true);
+pref("browser.migrate.brave.enabled", true);
+pref("browser.migrate.canary.enabled", true);
+
+pref("browser.migrate.chrome.enabled", true);
+// See comments in bug 1340115 on how we got to this number.
+pref("browser.migrate.chrome.history.limit", 2000);
+pref("browser.migrate.chrome.payment_methods.enabled", true);
+
+pref("browser.migrate.chrome-beta.enabled", true);
+pref("browser.migrate.chrome-dev.enabled", true);
+pref("browser.migrate.chromium.enabled", true);
+pref("browser.migrate.chromium-360se.enabled", true);
+pref("browser.migrate.chromium-edge.enabled", true);
+pref("browser.migrate.chromium-edge-beta.enabled", true);
+pref("browser.migrate.edge.enabled", true);
+pref("browser.migrate.firefox.enabled", true);
+pref("browser.migrate.ie.enabled", true);
+pref("browser.migrate.opera.enabled", true);
+pref("browser.migrate.opera-gx.enabled", true);
+pref("browser.migrate.safari.enabled", true);
+pref("browser.migrate.vivaldi.enabled", true);
+
+pref("browser.migrate.content-modal.enabled", true);
+pref("browser.migrate.content-modal.import-all.enabled", true);
+
+// Values can be: "default", "autoclose", "standalone", "legacy".
+pref("browser.migrate.content-modal.about-welcome-behavior", "legacy");
+
+// The maximum age of history entries we'll import, in days.
+pref("browser.migrate.history.maxAgeInDays", 180);
+
+// These following prefs are set to true if the user has at some
+// point in the past migrated one of these resource types from
+// another browser. We also attempt to transfer these preferences
+// across profile resets.
+pref("browser.migrate.interactions.bookmarks", false);
+pref("browser.migrate.interactions.history", false);
+pref("browser.migrate.interactions.passwords", false);
+pref("browser.migrate.preferences-entrypoint.enabled", true);
+
+pref("browser.device-migration.help-menu.hidden", false);
+
+pref("extensions.pocket.api", "api.getpocket.com");
+pref("extensions.pocket.bffApi", "firefox-api-proxy.cdn.mozilla.net");
+pref("extensions.pocket.bffRecentSaves", true);
+pref("extensions.pocket.enabled", true);
+pref("extensions.pocket.oAuthConsumerKey", "40249-e88c401e1b1f2242d9e441c4");
+pref("extensions.pocket.oAuthConsumerKeyBff", "94110-6d5ff7a89d72c869766af0e0");
+pref("extensions.pocket.site", "getpocket.com");
+pref("extensions.pocket.onSaveRecs", true);
+pref("extensions.pocket.onSaveRecs.locales", "en-US,en-GB,en-CA");
+
+// Enable Pocket button home panel for non link pages.
+pref("extensions.pocket.showHome", true);
+
+// Control what version of the logged out doorhanger is displayed
+// Possibilities are: `control`, `control-one-button`, `variant_a`, `variant_b`, `variant_c`
+pref("extensions.pocket.loggedOutVariant", "control");
+
+// Just for the new Pocket panels, enables the email signup button.
+pref("extensions.pocket.refresh.emailButton.enabled", false);
+// Hides the recently saved section in the home panel.
+pref("extensions.pocket.refresh.hideRecentSaves.enabled", false);
+
+pref("signon.management.page.fileImport.enabled", false);
+
+#ifdef NIGHTLY_BUILD
+pref("signon.management.page.os-auth.enabled", true);
+#else
+pref("signon.management.page.os-auth.enabled", false);
+#endif
+// "available"      - user can see feature offer.
+// "offered"        - we have offered feature to user and they have not yet made a decision.
+// "enabled"        - user opted in to the feature.
+// "disabled"       - user opted out of the feature.
+pref("signon.firefoxRelay.feature", "available");
+pref("signon.management.page.breach-alerts.enabled", true);
+pref("signon.management.page.vulnerable-passwords.enabled", true);
+pref("signon.management.page.sort", "name");
+// The utm_creative value is appended within the code (specific to the location on
+// where it is clicked). Be sure that if these two prefs are updated, that
+// the utm_creative param be last.
+pref("signon.management.page.breachAlertUrl",
+     "https://monitor.firefox.com/breach-details/");
+pref("signon.passwordEditCapture.enabled", true);
+pref("signon.relatedRealms.enabled", false);
+pref("signon.showAutoCompleteFooter", true);
+pref("signon.showAutoCompleteImport", "import");
+pref("signon.suggestImportCount", 3);
+
+// Enable the "Simplify Page" feature in Print Preview. This feature
+// is disabled by default in toolkit.
+pref("print.use_simplify_page", true);
+
+// Space separated list of URLS that are allowed to send objects (instead of
+// only strings) through webchannels. Bug 1275612 tracks removing this pref and capability.
+pref("webchannel.allowObject.urlWhitelist", "https://content.cdn.mozilla.net https://install.mozilla.org");
+
+// Whether or not the browser should scan for unsubmitted
+// crash reports, and then show a notification for submitting
+// those reports.
+#ifdef NIGHTLY_BUILD
+  pref("browser.crashReports.unsubmittedCheck.enabled", true);
+#else
+  pref("browser.crashReports.unsubmittedCheck.enabled", false);
+#endif
+
+// chancesUntilSuppress is how many times we'll show the unsubmitted
+// crash report notification across different days and shutdown
+// without a user choice before we suppress the notification for
+// some number of days.
+pref("browser.crashReports.unsubmittedCheck.chancesUntilSuppress", 4);
+pref("browser.crashReports.unsubmittedCheck.autoSubmit2", false);
+
+// Preferences for the form autofill toolkit component.
+// Checkbox in sync options for credit card data sync service
+pref("services.sync.engine.creditcards.available", true);
+// Whether the user enabled the OS re-auth dialog.
+pref("extensions.formautofill.reauth.enabled", false);
+
+// Whether or not to restore a session with lazy-browser tabs.
+pref("browser.sessionstore.restore_tabs_lazily", true);
+
+pref("browser.suppress_first_window_animation", true);
+
+// Preference that allows individual users to disable Screenshots.
+pref("extensions.screenshots.disabled", false);
+
+// Preference that determines whether Screenshots is opened as a dedicated browser component
+pref("screenshots.browser.component.enabled", false);
+
+// DoH Rollout: whether to clear the mode value at shutdown.
+pref("doh-rollout.clearModeOnShutdown", false);
+
+// URL for Learn More link for browser error logging in preferences
+pref("browser.chrome.errorReporter.infoURL",
+     "https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/nightly-error-collection");
+
+// Normandy client preferences
+pref("app.normandy.api_url", "https://normandy.cdn.mozilla.net/api/v1");
+pref("app.normandy.dev_mode", false);
+pref("app.normandy.enabled", true);
+pref("app.normandy.first_run", true);
+pref("app.normandy.logging.level", 50); // Warn
+pref("app.normandy.run_interval_seconds", 21600); // 6 hours
+pref("app.normandy.shieldLearnMoreUrl", "https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/shield");
+pref("app.normandy.last_seen_buildid", "");
+pref("app.normandy.onsync_skew_sec", 600);
+#ifdef MOZ_DATA_REPORTING
+  pref("app.shield.optoutstudies.enabled", true);
+#else
+  pref("app.shield.optoutstudies.enabled", false);
+#endif
+
+// Multi-lingual preferences:
+//  *.enabled - Are langpacks available for the build of Firefox?
+//  *.downloadEnabled - Langpacks are allowed to be downloaded from AMO. AMO only serves
+//      langpacks for release and beta. Unsupported releases (like Nightly) can be
+//      manually tested with the following preference:
+//      extensions.getAddons.langpacks.url: https://mock-amo-language-tools.glitch.me/?app=firefox&type=language&appversion=%VERSION%
+//  *.liveReload - Switching a langpack will change the language without a restart.
+//  *.liveReloadBidirectional - Allows switching when moving between LTR and RTL
+//      languages without a full restart.
+//  *.aboutWelcome.languageMismatchEnabled - Enables an onboarding menu in about:welcome
+//      to allow a user to change their language when there is a language mismatch between
+//      the app and browser.
+#if defined(RELEASE_OR_BETA) && !defined(MOZ_DEV_EDITION)
+  pref("intl.multilingual.enabled", true);
+  pref("intl.multilingual.downloadEnabled", true);
+  pref("intl.multilingual.liveReload", true);
+  pref("intl.multilingual.liveReloadBidirectional", false);
+  pref("intl.multilingual.aboutWelcome.languageMismatchEnabled", true);
+#else
+  pref("intl.multilingual.enabled", false);
+  pref("intl.multilingual.downloadEnabled", false);
+  pref("intl.multilingual.liveReload", false);
+  pref("intl.multilingual.liveReloadBidirectional", false);
+  pref("intl.multilingual.aboutWelcome.languageMismatchEnabled", false);
+#endif
+
+// Coverage ping is disabled by default.
+pref("toolkit.coverage.enabled", false);
+pref("toolkit.coverage.endpoint.base", "https://coverage.mozilla.org");
+
+// Discovery prefs
+pref("browser.discovery.enabled", true);
+pref("browser.discovery.containers.enabled", true);
+pref("browser.discovery.sites", "addons.mozilla.org");
+
+pref("browser.engagement.recent_visited_origins.expiry", 86400); // 24 * 60 * 60 (24 hours in seconds)
+pref("browser.engagement.downloads-button.has-used", false);
+pref("browser.engagement.fxa-toolbar-menu-button.has-used", false);
+pref("browser.engagement.home-button.has-used", false);
+pref("browser.engagement.sidebar-button.has-used", false);
+pref("browser.engagement.library-button.has-used", false);
+pref("browser.engagement.ctrlTab.has-used", false);
+
+pref("browser.aboutConfig.showWarning", true);
+
+pref("browser.toolbars.keyboard_navigation", true);
+
+// The visibility of the bookmarks toolbar.
+// "newtab": Show on the New Tab Page
+// "always": Always show
+// "never": Never show
+pref("browser.toolbars.bookmarks.visibility", "newtab");
+
+// Visibility of the "Show Other Bookmarks" menuitem in the
+// bookmarks toolbar contextmenu.
+pref("browser.toolbars.bookmarks.showOtherBookmarks", true);
+
+// Prefs to control the Firefox Account toolbar menu.
+// This pref will surface existing Firefox Account information
+// as a button next to the hamburger menu. It allows
+// quick access to sign-in and manage your Firefox Account.
+pref("identity.fxaccounts.toolbar.enabled", true);
+pref("identity.fxaccounts.toolbar.accessed", false);
+pref("identity.fxaccounts.toolbar.defaultVisible", false);
+
+// Prefs for different services supported by Firefox Account
+pref("identity.fxaccounts.service.monitorLoginUrl", "https://monitor.firefox.com/");
+
+// Check bundled omni JARs for corruption.
+pref("corroborator.enabled", true);
+
+// Toolbox preferences
+pref("devtools.toolbox.footer.height", 250);
+pref("devtools.toolbox.sidebar.width", 500);
+pref("devtools.toolbox.host", "bottom");
+pref("devtools.toolbox.previousHost", "right");
+pref("devtools.toolbox.selectedTool", "inspector");
+pref("devtools.toolbox.zoomValue", "1");
+pref("devtools.toolbox.splitconsoleEnabled", false);
+pref("devtools.toolbox.splitconsoleHeight", 100);
+pref("devtools.toolbox.tabsOrder", "");
+// This is only used for local Web Extension debugging,
+// and allows to keep the window on top of all others,
+// so that you can debug the Firefox window, while keeping the devtools
+// always visible
+pref("devtools.toolbox.alwaysOnTop", true);
+
+// When the Multiprocess Browser Toolbox is enabled, you can configure the scope of it:
+// - "everything" will enable debugging absolutely everything in the browser
+//   All processes, all documents, all workers, all add-ons.
+// - "parent-process" will restrict debugging to the parent process
+//   All privileged javascript, documents and workers running in the parent process.
+pref("devtools.browsertoolbox.scope", "parent-process");
+
+// This preference will enable watching top-level targets from the server side.
+pref("devtools.target-switching.server.enabled", true);
+
+// In DevTools, create a target for each frame (i.e. not only for top-level document and
+// remote frames).
+pref("devtools.every-frame-target.enabled", true);
+
+// Controls the hability to debug popups from the same DevTools
+// of the original tab the popups are coming from
+pref("devtools.popups.debug", false);
+
+// Toolbox Button preferences
+pref("devtools.command-button-pick.enabled", true);
+pref("devtools.command-button-frames.enabled", true);
+pref("devtools.command-button-splitconsole.enabled", true);
+pref("devtools.command-button-responsive.enabled", true);
+pref("devtools.command-button-screenshot.enabled", false);
+pref("devtools.command-button-rulers.enabled", false);
+pref("devtools.command-button-measure.enabled", false);
+pref("devtools.command-button-noautohide.enabled", false);
+pref("devtools.command-button-errorcount.enabled", true);
+#ifndef MOZILLA_OFFICIAL
+  pref("devtools.command-button-experimental-prefs.enabled", true);
+#endif
+
+// Inspector preferences
+// Enable the Inspector
+pref("devtools.inspector.enabled", true);
+// What was the last active sidebar in the inspector
+pref("devtools.inspector.selectedSidebar", "layoutview");
+pref("devtools.inspector.activeSidebar", "layoutview");
+pref("devtools.inspector.remote", false);
+
+// Enable the 3 pane mode in the inspector
+pref("devtools.inspector.three-pane-enabled", true);
+// Enable the 3 pane mode in the chrome inspector
+pref("devtools.inspector.chrome.three-pane-enabled", false);
+// Collapse pseudo-elements by default in the rule-view
+pref("devtools.inspector.show_pseudo_elements", false);
+// The default size for image preview tooltips in the rule-view/computed-view/markup-view
+pref("devtools.inspector.imagePreviewTooltipSize", 300);
+// Enable user agent style inspection in rule-view
+pref("devtools.inspector.showUserAgentStyles", false);
+// Show native anonymous content and user agent shadow roots
+pref("devtools.inspector.showAllAnonymousContent", false);
+// Enable the inline CSS compatiblity warning in inspector rule view
+#ifdef NIGHTLY_BUILD
+  pref("devtools.inspector.ruleview.inline-compatibility-warning.enabled", true);
+#else
+  pref("devtools.inspector.ruleview.inline-compatibility-warning.enabled", false);
+#endif
+// Enable the compatibility tool in the inspector.
+pref("devtools.inspector.compatibility.enabled", true);
+// Enable overflow debugging in the inspector.
+pref("devtools.overflow.debugging.enabled", true);
+// Enable drag to edit properties in the inspector rule view.
+pref("devtools.inspector.draggable_properties", true);
+
+// Grid highlighter preferences
+pref("devtools.gridinspector.gridOutlineMaxColumns", 50);
+pref("devtools.gridinspector.gridOutlineMaxRows", 50);
+pref("devtools.gridinspector.showGridAreas", false);
+pref("devtools.gridinspector.showGridLineNumbers", false);
+pref("devtools.gridinspector.showInfiniteLines", false);
+// Max number of grid highlighters that can be displayed
+pref("devtools.gridinspector.maxHighlighters", 3);
+
+// Whether or not simplified highlighters should be used when
+// prefers-reduced-motion is enabled.
+pref("devtools.inspector.simple-highlighters-reduced-motion", false);
+
+// Whether or not the box model panel is opened in the layout view
+pref("devtools.layout.boxmodel.opened", true);
+// Whether or not the flexbox panel is opened in the layout view
+pref("devtools.layout.flexbox.opened", true);
+// Whether or not the flexbox container panel is opened in the layout view
+pref("devtools.layout.flex-container.opened", true);
+// Whether or not the flexbox item panel is opened in the layout view
+pref("devtools.layout.flex-item.opened", true);
+// Whether or not the grid inspector panel is opened in the layout view
+pref("devtools.layout.grid.opened", true);
+
+// Enable hovering Box Model values and jumping to their source CSS rule in the
+// rule-view.
+#if defined(NIGHTLY_BUILD)
+  pref("devtools.layout.boxmodel.highlightProperty", true);
+#else
+  pref("devtools.layout.boxmodel.highlightProperty", false);
+#endif
+
+// By how many times eyedropper will magnify pixels
+pref("devtools.eyedropper.zoom", 6);
+
+// Enable to collapse attributes that are too long.
+pref("devtools.markup.collapseAttributes", true);
+// Length to collapse attributes
+pref("devtools.markup.collapseAttributeLength", 120);
+// Whether to auto-beautify the HTML on copy.
+pref("devtools.markup.beautifyOnCopy", false);
+// Whether or not the DOM mutation breakpoints context menu are enabled in the
+// markup view.
+pref("devtools.markup.mutationBreakpoints.enabled", true);
+
+// DevTools default color unit
+pref("devtools.defaultColorUnit", "authored");
+
+// Enable the Memory tools
+pref("devtools.memory.enabled", true);
+
+pref("devtools.memory.custom-census-displays", "{}");
+pref("devtools.memory.custom-label-displays", "{}");
+pref("devtools.memory.custom-tree-map-displays", "{}");
+
+pref("devtools.memory.max-individuals", 1000);
+pref("devtools.memory.max-retaining-paths", 10);
+
+// Enable the Performance tools
+pref("devtools.performance.enabled", true);
+
+// The default cache UI setting
+pref("devtools.cache.disabled", false);
+
+// The default service workers UI setting
+pref("devtools.serviceWorkers.testing.enabled", false);
+
+// Enable the Network Monitor
+pref("devtools.netmonitor.enabled", true);
+
+pref("devtools.netmonitor.features.search", true);
+pref("devtools.netmonitor.features.requestBlocking", true);
+
+// Enable the Application panel
+pref("devtools.application.enabled", true);
+
+// Enable the custom formatters feature
+// TODO remove once the custom formatters feature is stable (see bug 1734614)
+pref("devtools.custom-formatters", false);
+// This preference represents the user's choice to enable the custom formatters feature.
+// While the preference above will be removed once the feature is stable, this one is menat to stay.
+pref("devtools.custom-formatters.enabled", false);
+
+// The default Network Monitor UI settings
+pref("devtools.netmonitor.panes-network-details-width", 550);
+pref("devtools.netmonitor.panes-network-details-height", 450);
+pref("devtools.netmonitor.panes-search-width", 550);
+pref("devtools.netmonitor.panes-search-height", 450);
+pref("devtools.netmonitor.filters", "[\"all\"]");
+pref("devtools.netmonitor.visibleColumns",
+    "[\"status\",\"method\",\"domain\",\"file\",\"initiator\",\"type\",\"transferred\",\"contentSize\",\"waterfall\"]"
+);
+pref("devtools.netmonitor.columnsData",
+  '[{"name":"status","minWidth":30,"width":5}, {"name":"method","minWidth":30,"width":5}, {"name":"domain","minWidth":30,"width":10}, {"name":"file","minWidth":30,"width":25}, {"name":"url","minWidth":30,"width":25},{"name":"initiator","minWidth":30,"width":10},{"name":"type","minWidth":30,"width":5},{"name":"transferred","minWidth":30,"width":10},{"name":"contentSize","minWidth":30,"width":5},{"name":"waterfall","minWidth":150,"width":15}]');
+pref("devtools.netmonitor.msg.payload-preview-height", 128);
+pref("devtools.netmonitor.msg.visibleColumns",
+  '["data", "time"]'
+);
+pref("devtools.netmonitor.msg.displayed-messages.limit", 500);
+
+pref("devtools.netmonitor.response.ui.limit", 10240);
+
+// Save request/response bodies yes/no.
+pref("devtools.netmonitor.saveRequestAndResponseBodies", true);
+
+// The default Network monitor HAR export setting
+pref("devtools.netmonitor.har.defaultLogDir", "");
+pref("devtools.netmonitor.har.defaultFileName", "%hostname_Archive [%date]");
+pref("devtools.netmonitor.har.jsonp", false);
+pref("devtools.netmonitor.har.jsonpCallback", "");
+pref("devtools.netmonitor.har.includeResponseBodies", true);
+pref("devtools.netmonitor.har.compress", false);
+pref("devtools.netmonitor.har.forceExport", false);
+pref("devtools.netmonitor.har.pageLoadedTimeout", 1500);
+pref("devtools.netmonitor.har.enableAutoExportToFile", false);
+pref("devtools.netmonitor.har.multiple-pages", false);
+
+// netmonitor audit
+pref("devtools.netmonitor.audits.slow", 500);
+
+// Enable the new Edit and Resend panel
+  pref("devtools.netmonitor.features.newEditAndResend", true);
+
+pref("devtools.netmonitor.customRequest", '{}');
+
+// Enable the Storage Inspector
+pref("devtools.storage.enabled", true);
+
+// Enable the Style Editor.
+pref("devtools.styleeditor.enabled", true);
+pref("devtools.styleeditor.autocompletion-enabled", true);
+pref("devtools.styleeditor.showAtRulesSidebar", true);
+pref("devtools.styleeditor.atRulesSidebarWidth", 238);
+pref("devtools.styleeditor.navSidebarWidth", 245);
+pref("devtools.styleeditor.transitions", true);
+
+// Screenshot Option Settings.
+pref("devtools.screenshot.clipboard.enabled", false);
+pref("devtools.screenshot.audio.enabled", true);
+
+// Make sure the DOM panel is hidden by default
+pref("devtools.dom.enabled", false);
+
+// Enable the Accessibility panel.
+pref("devtools.accessibility.enabled", true);
+
+// Web console filters
+pref("devtools.webconsole.filter.error", true);
+pref("devtools.webconsole.filter.warn", true);
+pref("devtools.webconsole.filter.info", true);
+pref("devtools.webconsole.filter.log", true);
+pref("devtools.webconsole.filter.debug", true);
+pref("devtools.webconsole.filter.css", false);
+pref("devtools.webconsole.filter.net", false);
+pref("devtools.webconsole.filter.netxhr", false);
+
+// Webconsole autocomplete preference
+pref("devtools.webconsole.input.autocomplete",true);
+
+// Show context selector in console input
+pref("devtools.webconsole.input.context", true);
+
+// Set to true to eagerly show the results of webconsole terminal evaluations
+// when they don't have side effects.
+pref("devtools.webconsole.input.eagerEvaluation", true);
+
+// Browser console filters
+pref("devtools.browserconsole.filter.error", true);
+pref("devtools.browserconsole.filter.warn", true);
+pref("devtools.browserconsole.filter.info", true);
+pref("devtools.browserconsole.filter.log", true);
+pref("devtools.browserconsole.filter.debug", true);
+pref("devtools.browserconsole.filter.css", false);
+pref("devtools.browserconsole.filter.net", false);
+pref("devtools.browserconsole.filter.netxhr", false);
+
+// Max number of inputs to store in web console history.
+pref("devtools.webconsole.inputHistoryCount", 300);
+
+// Persistent logging: |true| if you want the relevant tool to keep all of the
+// logged messages after reloading the page, |false| if you want the output to
+// be cleared each time page navigation happens.
+pref("devtools.webconsole.persistlog", false);
+pref("devtools.netmonitor.persistlog", false);
+
+// Web Console timestamp: |true| if you want the logs and instructions
+// in the Web Console to display a timestamp, or |false| to not display
+// any timestamps.
+pref("devtools.webconsole.timestampMessages", false);
+
+// Enable the webconsole sidebar toggle in Nightly builds.
+#if defined(NIGHTLY_BUILD)
+  pref("devtools.webconsole.sidebarToggle", true);
+#else
+  pref("devtools.webconsole.sidebarToggle", false);
+#endif
+
+// Saved editor mode state in the console.
+pref("devtools.webconsole.input.editor", false);
+pref("devtools.browserconsole.input.editor", false);
+
+// Editor width for webconsole and browserconsole.
+pref("devtools.webconsole.input.editorWidth", 0);
+pref("devtools.browserconsole.input.editorWidth", 0);
+
+// Display an onboarding UI for the Editor mode.
+pref("devtools.webconsole.input.editorOnboarding", true);
+
+// Enable message grouping in the console, true by default
+pref("devtools.webconsole.groupWarningMessages", true);
+
+// Enable network monitoring the browser toolbox console/browser console.
+pref("devtools.browserconsole.enableNetworkMonitoring", false);
+
+// Enable client-side mapping service for source maps
+pref("devtools.source-map.client-service.enabled", true);
+
+// The number of lines that are displayed in the web console.
+pref("devtools.hud.loglimit", 10000);
+
+// The developer tools editor configuration:
+// - tabsize: how many spaces to use when a Tab character is displayed.
+// - expandtab: expand Tab characters to spaces.
+// - keymap: which keymap to use (can be 'default', 'emacs' or 'vim')
+// - autoclosebrackets: whether to permit automatic bracket/quote closing.
+// - detectindentation: whether to detect the indentation from the file
+// - enableCodeFolding: Whether to enable code folding or not.
+pref("devtools.editor.tabsize", 2);
+pref("devtools.editor.expandtab", true);
+pref("devtools.editor.keymap", "default");
+pref("devtools.editor.autoclosebrackets", true);
+pref("devtools.editor.detectindentation", true);
+pref("devtools.editor.enableCodeFolding", true);
+pref("devtools.editor.autocomplete", true);
+
+// The angle of the viewport.
+pref("devtools.responsive.viewport.angle", 0);
+// The width of the viewport.
+pref("devtools.responsive.viewport.width", 320);
+// The height of the viewport.
+pref("devtools.responsive.viewport.height", 480);
+// The pixel ratio of the viewport.
+pref("devtools.responsive.viewport.pixelRatio", 0);
+// Whether or not the viewports are left aligned.
+pref("devtools.responsive.leftAlignViewport.enabled", false);
+// Whether to reload when touch simulation is toggled
+pref("devtools.responsive.reloadConditions.touchSimulation", false);
+// Whether to reload when user agent is changed
+pref("devtools.responsive.reloadConditions.userAgent", false);
+// Whether to show the notification about reloading to apply emulation
+pref("devtools.responsive.reloadNotification.enabled", true);
+// Whether or not touch simulation is enabled.
+pref("devtools.responsive.touchSimulation.enabled", false);
+// The user agent of the viewport.
+pref("devtools.responsive.userAgent", "");
+// Show the custom user agent input by default
+pref("devtools.responsive.showUserAgentInput", true);
+
+// Show tab debug targets for This Firefox (on by default for local builds).
+#ifdef MOZILLA_OFFICIAL
+  pref("devtools.aboutdebugging.local-tab-debugging", false);
+#else
+  pref("devtools.aboutdebugging.local-tab-debugging", true);
+#endif
+
+// Show process debug targets.
+pref("devtools.aboutdebugging.process-debugging", true);
+// Stringified array of network locations that users can connect to.
+pref("devtools.aboutdebugging.network-locations", "[]");
+// Debug target pane collapse/expand settings.
+pref("devtools.aboutdebugging.collapsibilities.installedExtension", false);
+pref("devtools.aboutdebugging.collapsibilities.otherWorker", false);
+pref("devtools.aboutdebugging.collapsibilities.serviceWorker", false);
+pref("devtools.aboutdebugging.collapsibilities.sharedWorker", false);
+pref("devtools.aboutdebugging.collapsibilities.tab", false);
+pref("devtools.aboutdebugging.collapsibilities.temporaryExtension", false);
+
+// about:debugging: only show system and hidden extensions in local builds by
+// default.
+#ifdef MOZILLA_OFFICIAL
+  pref("devtools.aboutdebugging.showHiddenAddons", false);
+#else
+  pref("devtools.aboutdebugging.showHiddenAddons", true);
+#endif
+
+// Map top-level await expressions in the console
+pref("devtools.debugger.features.map-await-expression", true);
+
+// This relies on javascript.options.asyncstack as well or it has no effect.
+pref("devtools.debugger.features.async-captured-stacks", true);
+pref("devtools.debugger.features.async-live-stacks", false);
+pref("devtools.debugger.hide-ignored-sources", false);
+
+// Disable autohide for DevTools popups and tooltips.
+// This is currently not exposed by any UI to avoid making
+// about:devtools-toolbox tabs unusable by mistake.
+pref("devtools.popup.disable_autohide", false);
+
+// FirstStartup service time-out in ms
+pref("first-startup.timeout", 30000);
+
+// Enable the default browser agent.
+// The agent still runs as scheduled if this pref is disabled,
+// but it exits immediately before taking any action.
+#ifdef XP_WIN
+  pref("default-browser-agent.enabled", true);
+#endif
+
+// Test Prefs that do nothing for testing
+#if defined(EARLY_BETA_OR_EARLIER)
+  pref("app.normandy.test-prefs.bool", false);
+  pref("app.normandy.test-prefs.integer", 0);
+  pref("app.normandy.test-prefs.string", "");
+#endif
+
+// Shows 'View Image Info' item in the image context menu
+#ifdef MOZ_DEV_EDITION
+  pref("browser.menu.showViewImageInfo", true);
+#else
+  pref("browser.menu.showViewImageInfo", false);
+#endif
+
+// Handing URLs to external apps via the "Share URL" menu item could allow a proxy bypass
+#ifdef MOZ_PROXY_BYPASS_PROTECTION
+  pref("browser.menu.share_url.allow", false);
+#endif
+
+// Mozilla-controlled domains that are allowed to use non-standard
+// context properties for SVG images for use in the browser UI. Please
+// keep this list short. This preference (and SVG `context-` keyword support)
+// are expected to go away once a standardized alternative becomes
+// available.
+pref("svg.context-properties.content.allowed-domains", "profile.accounts.firefox.com,profile.stage.mozaws.net");
+
+// Preference that allows individual users to disable Firefox Translations.
+#ifdef NIGHTLY_BUILD
+  pref("extensions.translations.disabled", true);
+#endif
+
+// Turn on interaction measurements in Nightly only
+#ifdef NIGHTLY_BUILD
+  pref("browser.places.interactions.enabled", true);
+#endif
+
+// If the user has seen the Firefox View feature tour this value reflects
+// the id of the last screen they saw and whether they completed the tour
+pref("browser.firefox-view.feature-tour", "{\"screen\":\"FIREFOX_VIEW_SPOTLIGHT\",\"complete\":false}");
+// Number of times the user visited about:firefoxview
+pref("browser.firefox-view.view-count", 0);
+
+// If the user has seen the pdf.js feature tour this value reflects the tour
+// message id, the id of the last screen they saw, and whether they completed the tour
+pref("browser.pdfjs.feature-tour", "{\"screen\":\"\",\"complete\":false}");
+
+// Enables cookie banner handling in Nightly in Private Browsing Mode. See
+// StaticPrefList.yaml for a description of the prefs.
+#ifdef NIGHTLY_BUILD
+  pref("cookiebanners.service.mode.privateBrowsing", 1);
+#endif
+
+#if defined(EARLY_BETA_OR_EARLIER)
+  // Enables the cookie banner desktop UI.
+  pref("cookiebanners.ui.desktop.enabled", true);
+#else
+  pref("cookiebanners.ui.desktop.enabled", false);
+#endif
+
+// Controls which variant of the cookie banner CFR the user is presented with.
+pref("cookiebanners.ui.desktop.cfrVariant", 0);
+
+// Parameters for the swipe-to-navigation icon.
+//
+// `navigation-icon-{start|end}-position` is the start or the end position of
+// the icon movement in response to the user's swipe gesture. `0` means the icon
+// positions at the left edge of the browser window. For example on Mac, when
+// the user started swipe gesture left to right, the icon appears at a point
+// where left side 20px of the icon is outside of the browser window's view.
+//
+// `navigation-icon-{min|max}-radius` is the minimum or the maximum radius of
+// the icon's outer circle size in response to the user's swipe gesture.  `-1`
+// means that the circle radius never changes.
+#ifdef XP_MACOSX
+  pref("browser.swipe.navigation-icon-start-position", -20);
+  pref("browser.swipe.navigation-icon-end-position", 0);
+  pref("browser.swipe.navigation-icon-min-radius", -1);
+  pref("browser.swipe.navigation-icon-max-radius", -1);
+#else
+  pref("browser.swipe.navigation-icon-start-position", -40);
+  pref("browser.swipe.navigation-icon-end-position", 60);
+  pref("browser.swipe.navigation-icon-min-radius", 12);
+  pref("browser.swipe.navigation-icon-max-radius", 20);
+#endif
+
+// Trigger FOG's Artifact Build support on artifact builds.
+#ifdef MOZ_ARTIFACT_BUILDS
+  pref("telemetry.fog.artifact_build", true);
+#endif
diff --git a/browser/app/splash.rc b/browser/app/splash.rc
new file mode 100644
index 0000000000..259a8068c3
--- /dev/null
+++ b/browser/app/splash.rc
@@ -0,0 +1,20 @@
+/* -*- Mode: C++; tab-width: 2; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#include <windows.h>
+#include "nsNativeAppSupportWin.h"
+
+IDI_APPICON ICON FIREFOX_ICO
+IDI_DOCUMENT ICON DOCUMENT_ICO
+IDI_APPLICATION ICON FIREFOX_ICO
+IDI_NEWWINDOW ICON NEWWINDOW_ICO
+IDI_NEWTAB ICON NEWTAB_ICO
+IDI_PBMODE ICON PBMODE_ICO
+IDI_DOCUMENT_PDF ICON DOCUMENT_PDF_ICO
+
+STRINGTABLE DISCARDABLE
+BEGIN
+    IDS_STARTMENU_APPNAME,              "@MOZ_APP_DISPLAYNAME@"
+END
diff --git a/browser/app/winlauncher/DllBlocklistInit.cpp b/browser/app/winlauncher/DllBlocklistInit.cpp
new file mode 100644
index 0000000000..fc4958339f
--- /dev/null
+++ b/browser/app/winlauncher/DllBlocklistInit.cpp
@@ -0,0 +1,237 @@
+/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* vim: set ts=8 sts=2 et sw=2 tw=80: */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at https://mozilla.org/MPL/2.0/. */
+
+#include "nsWindowsDllInterceptor.h"
+#include "mozilla/ArrayUtils.h"
+#include "mozilla/Attributes.h"
+#include "mozilla/BinarySearch.h"
+#include "mozilla/ImportDir.h"
+#include "mozilla/NativeNt.h"
+#include "mozilla/PolicyChecks.h"
+#include "mozilla/ScopeExit.h"
+#include "mozilla/Types.h"
+#include "mozilla/WindowsDllBlocklist.h"
+#include "mozilla/WindowsStackCookie.h"
+#include "mozilla/WinHeaderOnlyUtils.h"
+
+#include "DllBlocklistInit.h"
+#include "freestanding/DllBlocklist.h"
+#include "freestanding/SharedSection.h"
+
+namespace mozilla {
+
+#if defined(MOZ_ASAN) || defined(_M_ARM64)
+
+// This DLL blocking code is incompatible with ASAN because
+// it is able to execute before ASAN itself has even initialized.
+// Also, AArch64 has not been tested with this.
+LauncherVoidResultWithLineInfo InitializeDllBlocklistOOP(
+    const wchar_t* aFullImagePath, HANDLE aChildProcess,
+    const IMAGE_THUNK_DATA*, const GeckoProcessType aProcessType) {
+  return mozilla::Ok();
+}
+
+LauncherVoidResultWithLineInfo InitializeDllBlocklistOOPFromLauncher(
+    const wchar_t* aFullImagePath, HANDLE aChildProcess,
+    const bool aDisableDynamicBlocklist,
+    Maybe<std::wstring> aBlocklistFileName) {
+  return mozilla::Ok();
+}
+
+#else
+
+static LauncherVoidResultWithLineInfo InitializeDllBlocklistOOPInternal(
+    const wchar_t* aFullImagePath, nt::CrossExecTransferManager& aTransferMgr,
+    const IMAGE_THUNK_DATA* aCachedNtdllThunk,
+    const GeckoProcessType aProcessType) {
+  CrossProcessDllInterceptor intcpt(aTransferMgr.RemoteProcess());
+  intcpt.Init(L"ntdll.dll");
+
+#  if defined(DEBUG) && defined(_M_X64) && !defined(__MINGW64__)
+  // This debug check preserves compatibility with third-parties (see bug
+  // 1733532).
+  MOZ_ASSERT(!HasStackCookieCheck(
+      reinterpret_cast<uintptr_t>(&freestanding::patched_NtMapViewOfSection)));
+#  endif  // #if defined(DEBUG) && defined(_M_X64) && !defined(__MINGW64__)
+
+  bool ok = freestanding::stub_NtMapViewOfSection.SetDetour(
+      aTransferMgr, intcpt, "NtMapViewOfSection",
+      &freestanding::patched_NtMapViewOfSection);
+  if (!ok) {
+    return LAUNCHER_ERROR_FROM_DETOUR_ERROR(intcpt.GetLastDetourError());
+  }
+
+  ok = freestanding::stub_LdrLoadDll.SetDetour(
+      aTransferMgr, intcpt, "LdrLoadDll", &freestanding::patched_LdrLoadDll);
+  if (!ok) {
+    return LAUNCHER_ERROR_FROM_DETOUR_ERROR(intcpt.GetLastDetourError());
+  }
+
+  // Because aChildProcess has just been created in a suspended state, its
+  // dynamic linker has not yet been initialized, thus its executable has
+  // not yet been linked with ntdll.dll. If the blocklist hook intercepts a
+  // library load prior to the link, the hook will be unable to invoke any
+  // ntdll.dll functions.
+  //
+  // We know that the executable for our *current* process's binary is already
+  // linked into ntdll, so we obtain the IAT from our own executable and graft
+  // it onto the child process's IAT, thus enabling the child process's hook to
+  // safely make its ntdll calls.
+
+  const nt::PEHeaders& ourExeImage = aTransferMgr.LocalPEHeaders();
+
+  // As part of our mitigation of binary tampering, copy our import directory
+  // from the original in our executable file.
+  LauncherVoidResult importDirRestored =
+      RestoreImportDirectory(aFullImagePath, aTransferMgr);
+  if (importDirRestored.isErr()) {
+    return importDirRestored;
+  }
+
+  mozilla::nt::PEHeaders ntdllImage(::GetModuleHandleW(L"ntdll.dll"));
+  if (!ntdllImage) {
+    return LAUNCHER_ERROR_FROM_WIN32(ERROR_BAD_EXE_FORMAT);
+  }
+
+  // If we have a cached IAT i.e. |aCachedNtdllThunk| is non-null, we can
+  // safely copy it to |aChildProcess| even if the local IAT has been modified.
+  // If |aCachedNtdllThunk| is null, we've failed to cache the IAT or we're in
+  // the launcher process where there is no chance to cache the IAT.  In those
+  // cases, we retrieve the IAT with the boundary check to avoid a modified IAT
+  // from being copied into |aChildProcess|.
+  Maybe<Span<IMAGE_THUNK_DATA> > ntdllThunks;
+  if (aCachedNtdllThunk) {
+    ntdllThunks = ourExeImage.GetIATThunksForModule("ntdll.dll");
+  } else {
+    Maybe<Range<const uint8_t> > ntdllBoundaries = ntdllImage.GetBounds();
+    if (!ntdllBoundaries) {
+      return LAUNCHER_ERROR_FROM_WIN32(ERROR_BAD_EXE_FORMAT);
+    }
+
+    // We can use GetIATThunksForModule() to check whether IAT is modified
+    // or not because no functions exported from ntdll.dll is forwarded.
+    ntdllThunks =
+        ourExeImage.GetIATThunksForModule("ntdll.dll", ntdllBoundaries.ptr());
+  }
+  if (!ntdllThunks) {
+    return LAUNCHER_ERROR_FROM_WIN32(ERROR_INVALID_DATA);
+  }
+
+  {  // Scope for prot
+    PIMAGE_THUNK_DATA firstIatThunkDst = ntdllThunks.value().data();
+    const IMAGE_THUNK_DATA* firstIatThunkSrc =
+        aCachedNtdllThunk ? aCachedNtdllThunk : firstIatThunkDst;
+    SIZE_T iatLength = ntdllThunks.value().LengthBytes();
+
+    AutoVirtualProtect prot =
+        aTransferMgr.Protect(firstIatThunkDst, iatLength, PAGE_READWRITE);
+    if (!prot) {
+      return LAUNCHER_ERROR_FROM_MOZ_WINDOWS_ERROR(prot.GetError());
+    }
+
+    LauncherVoidResult writeResult =
+        aTransferMgr.Transfer(firstIatThunkDst, firstIatThunkSrc, iatLength);
+    if (writeResult.isErr()) {
+      return writeResult.propagateErr();
+    }
+  }
+
+  // Tell the mozglue blocklist that we have bootstrapped
+  uint32_t newFlags = eDllBlocklistInitFlagWasBootstrapped;
+
+  if (gBlocklistInitFlags & eDllBlocklistInitFlagWasBootstrapped) {
+    // If we ourselves were bootstrapped, then we are starting a child process
+    // and need to set the appropriate flag.
+    newFlags |= eDllBlocklistInitFlagIsChildProcess;
+  }
+
+  SetDllBlocklistProcessTypeFlags(newFlags, aProcessType);
+
+  LauncherVoidResult writeResult =
+      aTransferMgr.Transfer(&gBlocklistInitFlags, &newFlags, sizeof(newFlags));
+  if (writeResult.isErr()) {
+    return writeResult.propagateErr();
+  }
+
+  return Ok();
+}
+
+LauncherVoidResultWithLineInfo InitializeDllBlocklistOOP(
+    const wchar_t* aFullImagePath, HANDLE aChildProcess,
+    const IMAGE_THUNK_DATA* aCachedNtdllThunk,
+    const GeckoProcessType aProcessType) {
+  nt::CrossExecTransferManager transferMgr(aChildProcess);
+  if (!transferMgr) {
+    return LAUNCHER_ERROR_FROM_WIN32(ERROR_BAD_EXE_FORMAT);
+  }
+
+  // We come here when the browser process launches a sandbox process.
+  // If the launcher process already failed to bootstrap the browser process,
+  // we should not attempt to bootstrap a child process because it's likely
+  // to fail again.  Instead, we only restore the import directory entry.
+  if (!(gBlocklistInitFlags & eDllBlocklistInitFlagWasBootstrapped)) {
+    return RestoreImportDirectory(aFullImagePath, transferMgr);
+  }
+
+  // Transfer a readonly handle to the child processes because all information
+  // are already written to the section by the launcher and main process.
+  LauncherVoidResult transferResult =
+      freestanding::gSharedSection.TransferHandle(transferMgr, GENERIC_READ);
+  if (transferResult.isErr()) {
+    return transferResult.propagateErr();
+  }
+
+  return InitializeDllBlocklistOOPInternal(aFullImagePath, transferMgr,
+                                           aCachedNtdllThunk, aProcessType);
+}
+
+LauncherVoidResultWithLineInfo InitializeDllBlocklistOOPFromLauncher(
+    const wchar_t* aFullImagePath, HANDLE aChildProcess,
+    const bool aDisableDynamicBlocklist,
+    Maybe<std::wstring> aBlocklistFileName) {
+  nt::CrossExecTransferManager transferMgr(aChildProcess);
+  if (!transferMgr) {
+    return LAUNCHER_ERROR_FROM_WIN32(ERROR_BAD_EXE_FORMAT);
+  }
+
+  // The launcher process initializes a section object, whose handle is
+  // transferred to the browser process, and that transferred handle in
+  // the browser process is transferred to the sandbox processes.
+  LauncherVoidResultWithLineInfo result = freestanding::gSharedSection.Init();
+  if (result.isErr()) {
+    return result;
+  }
+
+  if (aBlocklistFileName.isSome() &&
+      !PolicyCheckBoolean(L"DisableThirdPartyModuleBlocking")) {
+    DynamicBlockList blockList(aBlocklistFileName->c_str());
+    result = freestanding::gSharedSection.SetBlocklist(
+        blockList, aDisableDynamicBlocklist);
+    if (result.isErr()) {
+      return result;
+    }
+  }
+
+  // Transfer a writable handle to the main process because it needs to append
+  // dependent module paths to the section.
+  LauncherVoidResult transferResult =
+      freestanding::gSharedSection.TransferHandle(transferMgr,
+                                                  GENERIC_READ | GENERIC_WRITE);
+  if (transferResult.isErr()) {
+    return transferResult.propagateErr();
+  }
+
+  auto clearInstance = MakeScopeExit([]() {
+    // After transfer, the launcher process does not need the object anymore.
+    freestanding::gSharedSection.Reset(nullptr);
+  });
+  return InitializeDllBlocklistOOPInternal(aFullImagePath, transferMgr, nullptr,
+                                           GeckoProcessType_Default);
+}
+
+#endif  // defined(MOZ_ASAN) || defined(_M_ARM64)
+
+}  // namespace mozilla
diff --git a/browser/app/winlauncher/DllBlocklistInit.h b/browser/app/winlauncher/DllBlocklistInit.h
new file mode 100644
index 0000000000..9e5e1a181c
--- /dev/null
+++ b/browser/app/winlauncher/DllBlocklistInit.h
@@ -0,0 +1,32 @@
+/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* vim: set ts=8 sts=2 et sw=2 tw=80: */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at https://mozilla.org/MPL/2.0/. */
+
+#ifndef mozilla_DllBlocklistInit_h
+#define mozilla_DllBlocklistInit_h
+
+#include <windows.h>
+
+#if defined(MOZ_LAUNCHER_PROCESS)
+#  include "mozilla/LauncherRegistryInfo.h"
+#endif
+#include "mozilla/ProcessType.h"
+#include "mozilla/WinHeaderOnlyUtils.h"
+
+namespace mozilla {
+
+LauncherVoidResultWithLineInfo InitializeDllBlocklistOOP(
+    const wchar_t* aFullImagePath, HANDLE aChildProcess,
+    const IMAGE_THUNK_DATA* aCachedNtdllThunk,
+    const GeckoProcessType aProcessType);
+
+LauncherVoidResultWithLineInfo InitializeDllBlocklistOOPFromLauncher(
+    const wchar_t* aFullImagePath, HANDLE aChildProcess,
+    const bool aDisableDynamicBlocklist,
+    Maybe<std::wstring> aBlocklistFileName);
+
+}  // namespace mozilla
+
+#endif  // mozilla_DllBlocklistInit_h
diff --git a/browser/app/winlauncher/ErrorHandler.cpp b/browser/app/winlauncher/ErrorHandler.cpp
new file mode 100644
index 0000000000..1286e0f90f
--- /dev/null
+++ b/browser/app/winlauncher/ErrorHandler.cpp
@@ -0,0 +1,782 @@
+/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* vim: set ts=8 sts=2 et sw=2 tw=80: */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at https://mozilla.org/MPL/2.0/. */
+
+#include "ErrorHandler.h"
+
+#include <utility>
+
+#include "mozilla/ArrayUtils.h"
+#include "mozilla/CmdLineAndEnvUtils.h"
+#include "mozilla/DebugOnly.h"
+#include "mozilla/JSONWriter.h"
+#include "mozilla/UniquePtr.h"
+#include "mozilla/Unused.h"
+#include "mozilla/WinTokenUtils.h"
+#include "mozilla/WindowsVersion.h"
+#include "mozilla/XREAppData.h"
+#include "mozilla/glue/WindowsDllServices.h"
+#include "mozilla/mscom/ProcessRuntime.h"
+#include "nsWindowsHelpers.h"
+
+#if defined(MOZ_LAUNCHER_PROCESS)
+#  include "mozilla/LauncherRegistryInfo.h"
+#endif  // defined(MOZ_LAUNCHER_PROCESS)
+
+#include <algorithm>
+#include <process.h>
+#include <sstream>
+#include <string>
+#include <stdio.h>
+#include <string.h>
+#include <time.h>
+
+#include <objbase.h>
+#include <rpc.h>
+#if !defined(__MINGW32__)
+#  include <comutil.h>
+#  include <iwscapi.h>
+#  include <wscapi.h>
+#endif  // !defined(__MINGW32__)
+#include <tlhelp32.h>
+
+#if !defined(RRF_SUBKEY_WOW6464KEY)
+#  define RRF_SUBKEY_WOW6464KEY 0x00010000
+#endif  // !defined(RRF_SUBKEY_WOW6464KEY)
+
+#define QUOTE_ME2(x) #x
+#define QUOTE_ME(x) QUOTE_ME2(x)
+
+#define TELEMETRY_BASE_URL L"https://incoming.telemetry.mozilla.org/submit"
+#define TELEMETRY_NAMESPACE L"/firefox-launcher-process"
+#define TELEMETRY_LAUNCHER_PING_DOCTYPE L"/launcher-process-failure"
+#define TELEMETRY_LAUNCHER_PING_VERSION L"/1"
+
+static const wchar_t kUrl[] = TELEMETRY_BASE_URL TELEMETRY_NAMESPACE
+    TELEMETRY_LAUNCHER_PING_DOCTYPE TELEMETRY_LAUNCHER_PING_VERSION L"/";
+static const uint32_t kGuidCharLenWithNul = 39;
+static const uint32_t kGuidCharLenNoBracesNoNul = 36;
+static const mozilla::StaticXREAppData* gAppData;
+
+// Ordinarily, errors are only reported to the Windows Event Log when they are
+// not reported upstream via telemetry (usually due either to telemetry being
+// disabled or to network failure).
+//
+// If `--log-launcher-error` is given at the command line, launcher errors will
+// always be reported to the Windows Event Log, regardless of whether or not
+// they're sent upstream.
+static bool gForceEventLog = false;
+
+namespace {
+
+constexpr wchar_t kEventSourceName[] = L"" MOZ_APP_DISPLAYNAME " Launcher";
+
+struct EventSourceDeleter {
+  using pointer = HANDLE;
+
+  void operator()(pointer aEvtSrc) { ::DeregisterEventSource(aEvtSrc); }
+};
+
+using EventLog = mozilla::UniquePtr<HANDLE, EventSourceDeleter>;
+
+struct SerializedEventData {
+  HRESULT mHr;
+  uint32_t mLine;
+  char mFile[1];
+};
+
+}  // anonymous namespace
+
+static void PostErrorToLog(const mozilla::LauncherError& aError) {
+  // This is very bare-bones; just enough to spit out an HRESULT to the
+  // Application event log.
+  EventLog log(::RegisterEventSourceW(nullptr, kEventSourceName));
+
+  if (!log) {
+    return;
+  }
+
+  size_t fileLen = strlen(aError.mFile);
+  size_t dataLen = sizeof(HRESULT) + sizeof(uint32_t) + fileLen;
+  auto evtDataBuf = mozilla::MakeUnique<char[]>(dataLen);
+  SerializedEventData& evtData =
+      *reinterpret_cast<SerializedEventData*>(evtDataBuf.get());
+  evtData.mHr = aError.mError.AsHResult();
+  evtData.mLine = aError.mLine;
+  // Since this is binary data, we're not concerning ourselves with null
+  // terminators.
+  memcpy(evtData.mFile, aError.mFile, fileLen);
+
+  ::ReportEventW(log.get(), EVENTLOG_ERROR_TYPE, 0, aError.mError.AsHResult(),
+                 nullptr, 0, dataLen, nullptr, evtDataBuf.get());
+}
+
+#if defined(MOZ_TELEMETRY_REPORTING)
+
+namespace {
+
+// This JSONWriteFunc writes directly to a temp file. By creating this file
+// with the FILE_ATTRIBUTE_TEMPORARY attribute, we hint to the OS that this
+// file is short-lived. The OS will try to avoid flushing it to disk if at
+// all possible.
+class TempFileWriter final : public mozilla::JSONWriteFunc {
+ public:
+  TempFileWriter() : mFailed(false), mSuccessfulHandoff(false) {
+    wchar_t name[MAX_PATH + 1] = {};
+    if (_wtmpnam_s(name)) {
+      mFailed = true;
+      return;
+    }
+
+    mTempFileName = name;
+
+    mTempFile.own(::CreateFileW(name, GENERIC_WRITE, FILE_SHARE_READ, nullptr,
+                                CREATE_NEW, FILE_ATTRIBUTE_TEMPORARY, nullptr));
+    if (mTempFile.get() == INVALID_HANDLE_VALUE) {
+      mFailed = true;
+    }
+  }
+
+  ~TempFileWriter() {
+    if (mSuccessfulHandoff) {
+      // It is no longer our responsibility to delete the temp file if we have
+      // successfully handed it off to pingsender.
+      return;
+    }
+
+    mTempFile.reset();
+    ::DeleteFileW(mTempFileName.c_str());
+  }
+
+  explicit operator bool() const { return !mFailed; }
+
+  void Write(const mozilla::Span<const char>& aStr) final {
+    if (mFailed) {
+      return;
+    }
+
+    DWORD bytesWritten = 0;
+    if (!::WriteFile(mTempFile, aStr.data(), aStr.size(), &bytesWritten,
+                     nullptr) ||
+        bytesWritten != aStr.size()) {
+      mFailed = true;
+    }
+  }
+
+  const std::wstring& GetFileName() const { return mTempFileName; }
+
+  void SetSuccessfulHandoff() { mSuccessfulHandoff = true; }
+
+ private:
+  bool mFailed;
+  bool mSuccessfulHandoff;
+  std::wstring mTempFileName;
+  nsAutoHandle mTempFile;
+};
+
+using SigMap = mozilla::Vector<std::wstring, 0, InfallibleAllocPolicy>;
+
+}  // anonymous namespace
+
+// This is the guideline for maximum string length for telemetry intake
+static const size_t kMaxStrLen = 80;
+
+static mozilla::UniquePtr<char[]> WideToUTF8(const wchar_t* aStr,
+                                             const size_t aStrLenExclNul) {
+  // Yes, this might not handle surrogate pairs correctly. Let's just let
+  // WideCharToMultiByte fail in that unlikely case.
+  size_t cvtLen = std::min(aStrLenExclNul, kMaxStrLen);
+
+  int numConv = ::WideCharToMultiByte(CP_UTF8, 0, aStr, cvtLen, nullptr, 0,
+                                      nullptr, nullptr);
+  if (!numConv) {
+    return nullptr;
+  }
+
+  // Include room for the null terminator by adding one
+  auto buf = mozilla::MakeUnique<char[]>(numConv + 1);
+
+  numConv = ::WideCharToMultiByte(CP_UTF8, 0, aStr, cvtLen, buf.get(), numConv,
+                                  nullptr, nullptr);
+  if (!numConv) {
+    return nullptr;
+  }
+
+  // Add null termination. numConv does not include the terminator, so we don't
+  // subtract 1 when indexing into buf.
+  buf[numConv] = 0;
+
+  return buf;
+}
+
+static mozilla::UniquePtr<char[]> WideToUTF8(const wchar_t* aStr) {
+  return WideToUTF8(aStr, wcslen(aStr));
+}
+
+static mozilla::UniquePtr<char[]> WideToUTF8(const std::wstring& aStr) {
+  return WideToUTF8(aStr.c_str(), aStr.length());
+}
+
+// MinGW does not support the Windows Security Center APIs.
+#  if !defined(__MINGW32__)
+
+static mozilla::UniquePtr<char[]> WideToUTF8(const _bstr_t& aStr) {
+  return WideToUTF8(static_cast<const wchar_t*>(aStr), aStr.length());
+}
+
+namespace {
+
+struct ProviderKey {
+  WSC_SECURITY_PROVIDER mProviderType;
+  const char* mKey;
+};
+
+}  // anonymous namespace
+
+static bool EnumWSCProductList(RefPtr<IWSCProductList>& aProdList,
+                               mozilla::JSONWriter& aJson) {
+  LONG count;
+  HRESULT hr = aProdList->get_Count(&count);
+  if (FAILED(hr)) {
+    return false;
+  }
+
+  // Unlikely, but put a bound on the max length of the output array for the
+  // purposes of telemetry intake.
+  count = std::min(count, 1000L);
+
+  // Record the name(s) of each active registered product in this category
+  for (LONG index = 0; index < count; ++index) {
+    RefPtr<IWscProduct> product;
+    hr = aProdList->get_Item(index, getter_AddRefs(product));
+    if (FAILED(hr)) {
+      return false;
+    }
+
+    WSC_SECURITY_PRODUCT_STATE state;
+    hr = product->get_ProductState(&state);
+    if (FAILED(hr)) {
+      return false;
+    }
+
+    // We only care about products that are active
+    if (state == WSC_SECURITY_PRODUCT_STATE_OFF ||
+        state == WSC_SECURITY_PRODUCT_STATE_SNOOZED ||
+        state == WSC_SECURITY_PRODUCT_STATE_EXPIRED) {
+      continue;
+    }
+
+    _bstr_t bName;
+    hr = product->get_ProductName(bName.GetAddress());
+    if (FAILED(hr)) {
+      return false;
+    }
+
+    auto buf = WideToUTF8(bName);
+    if (!buf) {
+      return false;
+    }
+
+    aJson.StringElement(mozilla::MakeStringSpan(buf.get()));
+  }
+
+  return true;
+}
+
+static const ProviderKey gProvKeys[] = {
+    {WSC_SECURITY_PROVIDER_ANTIVIRUS, "av"},
+    {WSC_SECURITY_PROVIDER_ANTISPYWARE, "antispyware"},
+    {WSC_SECURITY_PROVIDER_FIREWALL, "firewall"}};
+
+static bool AddWscInfo(mozilla::JSONWriter& aJson) {
+  if (!mozilla::IsWin8OrLater()) {
+    // We haven't written anything yet, so we can return true here and continue
+    // capturing data.
+    return true;
+  }
+
+  // We need COM for this. Using ProcessRuntime so that process-global COM
+  // configuration is done correctly
+  mozilla::mscom::ProcessRuntime mscom(
+      mozilla::mscom::ProcessRuntime::ProcessCategory::Launcher);
+  if (!mscom) {
+    // We haven't written anything yet, so we can return true here and continue
+    // capturing data.
+    return true;
+  }
+
+  aJson.StartObjectProperty("security");
+
+  const CLSID clsid = __uuidof(WSCProductList);
+  const IID iid = __uuidof(IWSCProductList);
+
+  for (uint32_t index = 0; index < mozilla::ArrayLength(gProvKeys); ++index) {
+    // NB: A separate instance of IWSCProductList is needed for each distinct
+    // security provider type; MSDN says that we cannot reuse the same object
+    // and call Initialize() to pave over the previous data.
+    RefPtr<IWSCProductList> prodList;
+    HRESULT hr = ::CoCreateInstance(clsid, nullptr, CLSCTX_INPROC_SERVER, iid,
+                                    getter_AddRefs(prodList));
+    if (FAILED(hr)) {
+      return false;
+    }
+
+    hr = prodList->Initialize(gProvKeys[index].mProviderType);
+    if (FAILED(hr)) {
+      return false;
+    }
+
+    aJson.StartArrayProperty(mozilla::MakeStringSpan(gProvKeys[index].mKey));
+
+    if (!EnumWSCProductList(prodList, aJson)) {
+      return false;
+    }
+
+    aJson.EndArray();
+  }
+
+  aJson.EndObject();
+
+  return true;
+}
+#  endif  // !defined(__MINGW32__)
+
+// Max array length for telemetry intake.
+static const size_t kMaxArrayLen = 1000;
+
+static bool AddModuleInfo(const nsAutoHandle& aSnapshot,
+                          mozilla::JSONWriter& aJson) {
+  if (aSnapshot.get() == INVALID_HANDLE_VALUE) {
+    // We haven't written anything yet, so we can return true here and continue
+    // capturing data.
+    return true;
+  }
+
+  SigMap signatures;
+  size_t moduleCount = 0;
+
+  MODULEENTRY32W module = {sizeof(module)};
+  if (!::Module32FirstW(aSnapshot, &module)) {
+    // We haven't written anything yet, so we can return true here and continue
+    // capturing data.
+    return true;
+  }
+
+  mozilla::glue::BasicDllServices dllServices;
+
+  aJson.StartObjectProperty("modules");
+
+  // For each module, add its version number (or empty string if not present),
+  // followed by an optional index into the signatures array
+  do {
+    ++moduleCount;
+
+    wchar_t leaf[_MAX_FNAME] = {};
+    if (::_wsplitpath_s(module.szExePath, nullptr, 0, nullptr, 0, leaf,
+                        mozilla::ArrayLength(leaf), nullptr, 0)) {
+      return false;
+    }
+
+    if (_wcslwr_s(leaf, mozilla::ArrayLength(leaf))) {
+      return false;
+    }
+
+    auto leafUtf8 = WideToUTF8(leaf);
+    if (!leafUtf8) {
+      return false;
+    }
+
+    aJson.StartArrayProperty(mozilla::MakeStringSpan(leafUtf8.get()));
+
+    std::string version;
+    DWORD verInfoSize = ::GetFileVersionInfoSizeW(module.szExePath, nullptr);
+    if (verInfoSize) {
+      auto verInfoBuf = mozilla::MakeUnique<BYTE[]>(verInfoSize);
+
+      if (::GetFileVersionInfoW(module.szExePath, 0, verInfoSize,
+                                verInfoBuf.get())) {
+        VS_FIXEDFILEINFO* fixedInfo = nullptr;
+        UINT fixedInfoLen = 0;
+
+        if (::VerQueryValueW(verInfoBuf.get(), L"\\",
+                             reinterpret_cast<LPVOID*>(&fixedInfo),
+                             &fixedInfoLen)) {
+          std::ostringstream oss;
+          oss << HIWORD(fixedInfo->dwFileVersionMS) << '.'
+              << LOWORD(fixedInfo->dwFileVersionMS) << '.'
+              << HIWORD(fixedInfo->dwFileVersionLS) << '.'
+              << LOWORD(fixedInfo->dwFileVersionLS);
+          version = oss.str();
+        }
+      }
+    }
+
+    aJson.StringElement(version);
+
+    mozilla::Maybe<ptrdiff_t> sigIndex;
+    auto signedBy = dllServices.GetBinaryOrgName(module.szExePath);
+    if (signedBy) {
+      std::wstring strSignedBy(signedBy.get());
+      auto entry = std::find(signatures.begin(), signatures.end(), strSignedBy);
+      if (entry == signatures.end()) {
+        mozilla::Unused << signatures.append(std::move(strSignedBy));
+        entry = &signatures.back();
+      }
+
+      sigIndex = mozilla::Some(entry - signatures.begin());
+    }
+
+    if (sigIndex) {
+      aJson.IntElement(sigIndex.value());
+    }
+
+    aJson.EndArray();
+  } while (moduleCount < kMaxArrayLen && ::Module32NextW(aSnapshot, &module));
+
+  aJson.EndObject();
+
+  aJson.StartArrayProperty("signatures");
+
+  // Serialize each entry in the signatures array
+  for (auto&& itr : signatures) {
+    auto sigUtf8 = WideToUTF8(itr);
+    if (!sigUtf8) {
+      continue;
+    }
+
+    aJson.StringElement(mozilla::MakeStringSpan(sigUtf8.get()));
+  }
+
+  aJson.EndArray();
+
+  return true;
+}
+
+namespace {
+
+struct PingThreadContext {
+  explicit PingThreadContext(const mozilla::LauncherError& aError,
+                             const char* aProcessType)
+      : mLauncherError(aError),
+        mModulesSnapshot(::CreateToolhelp32Snapshot(TH32CS_SNAPMODULE, 0)),
+        mProcessType(aProcessType ? aProcessType : "") {}
+  mozilla::LauncherError mLauncherError;
+  nsAutoHandle mModulesSnapshot;
+  std::string mProcessType;
+};
+
+}  // anonymous namespace
+
+static bool PrepPing(const PingThreadContext& aContext, const std::wstring& aId,
+                     mozilla::JSONWriter& aJson) {
+#  if defined(DEBUG)
+  const mozilla::JSONWriter::CollectionStyle style =
+      mozilla::JSONWriter::MultiLineStyle;
+#  else
+  const mozilla::JSONWriter::CollectionStyle style =
+      mozilla::JSONWriter::SingleLineStyle;
+#  endif  // defined(DEBUG)
+
+  aJson.Start(style);
+
+  aJson.StringProperty("type", "launcher-process-failure");
+  aJson.IntProperty("version", 1);
+
+  auto idUtf8 = WideToUTF8(aId);
+  if (idUtf8) {
+    aJson.StringProperty("id", mozilla::MakeStringSpan(idUtf8.get()));
+  }
+
+  time_t now;
+  time(&now);
+  tm gmTm;
+  if (!gmtime_s(&gmTm, &now)) {
+    char isoTimeBuf[32] = {};
+    if (strftime(isoTimeBuf, mozilla::ArrayLength(isoTimeBuf), "%FT%T.000Z",
+                 &gmTm)) {
+      aJson.StringProperty("creationDate", isoTimeBuf);
+    }
+  }
+
+  aJson.StringProperty("update_channel", QUOTE_ME(MOZ_UPDATE_CHANNEL));
+
+  if (gAppData) {
+    aJson.StringProperty("build_id",
+                         mozilla::MakeStringSpan(gAppData->buildID));
+    aJson.StringProperty("build_version",
+                         mozilla::MakeStringSpan(gAppData->version));
+  }
+
+  OSVERSIONINFOEXW osv = {sizeof(osv)};
+  if (::GetVersionExW(reinterpret_cast<OSVERSIONINFOW*>(&osv))) {
+    std::ostringstream oss;
+    oss << osv.dwMajorVersion << "." << osv.dwMinorVersion << "."
+        << osv.dwBuildNumber;
+
+    if (osv.dwMajorVersion == 10 && osv.dwMinorVersion == 0) {
+      // Get the "Update Build Revision" (UBR) value
+      DWORD ubrValue;
+      DWORD ubrValueLen = sizeof(ubrValue);
+      LSTATUS ubrOk =
+          ::RegGetValueW(HKEY_LOCAL_MACHINE,
+                         L"SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion",
+                         L"UBR", RRF_RT_DWORD | RRF_SUBKEY_WOW6464KEY, nullptr,
+                         &ubrValue, &ubrValueLen);
+      if (ubrOk == ERROR_SUCCESS) {
+        oss << "." << ubrValue;
+      }
+    }
+
+    if (oss) {
+      aJson.StringProperty("os_version", oss.str());
+    }
+
+    bool isServer = osv.wProductType == VER_NT_DOMAIN_CONTROLLER ||
+                    osv.wProductType == VER_NT_SERVER;
+    aJson.BoolProperty("server_os", isServer);
+  }
+
+  WCHAR localeName[LOCALE_NAME_MAX_LENGTH] = {};
+  int localeNameLen =
+      ::GetUserDefaultLocaleName(localeName, mozilla::ArrayLength(localeName));
+  if (localeNameLen) {
+    auto localeNameUtf8 = WideToUTF8(localeName, localeNameLen - 1);
+    if (localeNameUtf8) {
+      aJson.StringProperty("os_locale",
+                           mozilla::MakeStringSpan(localeNameUtf8.get()));
+    }
+  }
+
+  SYSTEM_INFO sysInfo;
+  ::GetNativeSystemInfo(&sysInfo);
+  aJson.IntProperty("cpu_arch", sysInfo.wProcessorArchitecture);
+  aJson.IntProperty("num_logical_cpus", sysInfo.dwNumberOfProcessors);
+
+  mozilla::LauncherResult<bool> isAdminWithoutUac =
+      mozilla::IsAdminWithoutUac();
+  if (isAdminWithoutUac.isOk()) {
+    aJson.BoolProperty("is_admin_without_uac", isAdminWithoutUac.unwrap());
+  }
+
+  if (!aContext.mProcessType.empty()) {
+    aJson.StringProperty("process_type", aContext.mProcessType);
+  }
+
+  MEMORYSTATUSEX memStatus = {sizeof(memStatus)};
+  if (::GlobalMemoryStatusEx(&memStatus)) {
+    aJson.StartObjectProperty("memory");
+    aJson.IntProperty("total_phys", memStatus.ullTotalPhys);
+    aJson.IntProperty("avail_phys", memStatus.ullAvailPhys);
+    aJson.IntProperty("avail_page_file", memStatus.ullAvailPageFile);
+    aJson.IntProperty("avail_virt", memStatus.ullAvailVirtual);
+    aJson.EndObject();
+  }
+
+  aJson.StringProperty("xpcom_abi", TARGET_XPCOM_ABI);
+
+  aJson.StartObjectProperty("launcher_error", style);
+
+  std::string srcFileLeaf(aContext.mLauncherError.mFile);
+  // Obtain the leaf name of the file for privacy reasons
+  // (In case this is somebody's local build)
+  auto pos = srcFileLeaf.find_last_of("/\\");
+  if (pos != std::string::npos) {
+    srcFileLeaf = srcFileLeaf.substr(pos + 1);
+  }
+
+  aJson.StringProperty("source_file", srcFileLeaf);
+
+  aJson.IntProperty("source_line", aContext.mLauncherError.mLine);
+  aJson.IntProperty("hresult", aContext.mLauncherError.mError.AsHResult());
+
+#  if defined(NIGHTLY_BUILD)
+  if (aContext.mLauncherError.mDetourError.isSome()) {
+    static const char* kHexMap = "0123456789abcdef";
+    char hexStr[sizeof(mozilla::DetourError::mOrigBytes) * 2 + 1];
+    int cnt = 0;
+    for (uint8_t byte : aContext.mLauncherError.mDetourError->mOrigBytes) {
+      hexStr[cnt++] = kHexMap[(byte >> 4) & 0x0f];
+      hexStr[cnt++] = kHexMap[byte & 0x0f];
+    }
+    hexStr[cnt] = 0;
+    aJson.StringProperty("detour_orig_bytes", hexStr);
+  }
+#  endif  // defined(NIGHTLY_BUILD)
+
+  aJson.EndObject();
+
+#  if !defined(__MINGW32__)
+  if (!AddWscInfo(aJson)) {
+    return false;
+  }
+#  endif  // !defined(__MINGW32__)
+
+  if (!AddModuleInfo(aContext.mModulesSnapshot, aJson)) {
+    return false;
+  }
+
+  aJson.End();
+
+  return true;
+}
+
+static bool DoSendPing(const PingThreadContext& aContext) {
+  TempFileWriter tempFile;
+  mozilla::JSONWriter json(tempFile);
+
+  UUID uuid;
+  if (::UuidCreate(&uuid) != RPC_S_OK) {
+    return false;
+  }
+
+  wchar_t guidBuf[kGuidCharLenWithNul] = {};
+  if (::StringFromGUID2(uuid, guidBuf, kGuidCharLenWithNul) !=
+      kGuidCharLenWithNul) {
+    return false;
+  }
+
+  // Strip the curly braces off of the guid
+  std::wstring guidNoBraces(guidBuf + 1, kGuidCharLenNoBracesNoNul);
+
+  // Populate json with the ping information
+  if (!PrepPing(aContext, guidNoBraces, json)) {
+    return false;
+  }
+
+  // Obtain the name of the temp file that we have written
+  const std::wstring& fileName = tempFile.GetFileName();
+
+  // Using the path to our executable binary, construct the path to
+  // pingsender.exe
+  mozilla::UniquePtr<wchar_t[]> exePath(mozilla::GetFullBinaryPath());
+
+  wchar_t drive[_MAX_DRIVE] = {};
+  wchar_t dir[_MAX_DIR] = {};
+  if (_wsplitpath_s(exePath.get(), drive, mozilla::ArrayLength(drive), dir,
+                    mozilla::ArrayLength(dir), nullptr, 0, nullptr, 0)) {
+    return false;
+  }
+
+  wchar_t pingSenderPath[MAX_PATH + 1] = {};
+  if (_wmakepath_s(pingSenderPath, mozilla::ArrayLength(pingSenderPath), drive,
+                   dir, L"pingsender", L"exe")) {
+    return false;
+  }
+
+  // Construct the telemetry URL
+  wchar_t urlBuf[mozilla::ArrayLength(kUrl) + kGuidCharLenNoBracesNoNul] = {};
+  if (wcscpy_s(urlBuf, kUrl)) {
+    return false;
+  }
+
+  if (wcscat_s(urlBuf, guidNoBraces.c_str())) {
+    return false;
+  }
+
+  // Now build the command line arguments to pingsender
+  wchar_t* pingSenderArgv[] = {pingSenderPath, urlBuf,
+                               const_cast<wchar_t*>(fileName.c_str())};
+
+  mozilla::UniquePtr<wchar_t[]> pingSenderCmdLine(mozilla::MakeCommandLine(
+      mozilla::ArrayLength(pingSenderArgv), pingSenderArgv));
+
+  // Now start pingsender to handle the rest
+  PROCESS_INFORMATION pi;
+
+  STARTUPINFOW si = {sizeof(si)};
+  si.dwFlags = STARTF_USESHOWWINDOW;
+  si.wShowWindow = SW_HIDE;
+
+  if (!::CreateProcessW(pingSenderPath, pingSenderCmdLine.get(), nullptr,
+                        nullptr, FALSE, 0, nullptr, nullptr, &si, &pi)) {
+    return false;
+  }
+
+  tempFile.SetSuccessfulHandoff();
+
+  nsAutoHandle proc(pi.hProcess);
+  nsAutoHandle thread(pi.hThread);
+
+  return true;
+}
+
+static unsigned __stdcall SendPingThread(void* aContext) {
+  mozilla::UniquePtr<PingThreadContext> context(
+      reinterpret_cast<PingThreadContext*>(aContext));
+
+  if (!DoSendPing(*context) || gForceEventLog) {
+    PostErrorToLog(context->mLauncherError);
+  }
+
+  return 0;
+}
+
+#endif  // defined(MOZ_TELEMETRY_REPORTING)
+
+static bool SendPing(const mozilla::LauncherError& aError,
+                     const char* aProcessType) {
+#if defined(MOZ_TELEMETRY_REPORTING)
+#  if defined(MOZ_LAUNCHER_PROCESS)
+  mozilla::LauncherRegistryInfo regInfo;
+  mozilla::LauncherResult<bool> telemetryEnabled = regInfo.IsTelemetryEnabled();
+  if (telemetryEnabled.isErr() || !telemetryEnabled.unwrap()) {
+    // Do not send anything if telemetry has been opted out
+    return false;
+  }
+#  endif  // defined(MOZ_LAUNCHER_PROCESS)
+
+  // We send this ping when the launcher process fails. After we start the
+  // SendPingThread, this thread falls back from running as the launcher process
+  // to running as the browser main thread. Once this happens, it will be unsafe
+  // to set up PoisonIOInterposer (since we have already spun up a background
+  // thread).
+  mozilla::SaveToEnv("MOZ_DISABLE_POISON_IO_INTERPOSER=1");
+
+  // Capture aError and our module list into context for processing on another
+  // thread.
+  auto thdParam = mozilla::MakeUnique<PingThreadContext>(aError, aProcessType);
+
+  // The ping does a lot of file I/O. Since we want this thread to continue
+  // executing browser startup, we should gather that information on a
+  // background thread.
+  uintptr_t thdHandle =
+      _beginthreadex(nullptr, 0, &SendPingThread, thdParam.get(),
+                     STACK_SIZE_PARAM_IS_A_RESERVATION, nullptr);
+  if (!thdHandle) {
+    return false;
+  }
+
+  // We have handed off thdParam to the background thread
+  mozilla::Unused << thdParam.release();
+
+  ::CloseHandle(reinterpret_cast<HANDLE>(thdHandle));
+  return true;
+#else
+  return false;
+#endif
+}
+
+namespace mozilla {
+
+void HandleLauncherError(const LauncherError& aError,
+                         const char* aProcessType) {
+#if defined(MOZ_LAUNCHER_PROCESS)
+  LauncherRegistryInfo regInfo;
+  Unused << regInfo.DisableDueToFailure();
+#endif  // defined(MOZ_LAUNCHER_PROCESS)
+
+  if (!SendPing(aError, aProcessType)) {
+    // couldn't (or shouldn't) send telemetry; fall back to event log
+    PostErrorToLog(aError);
+  }
+}
+
+void SetLauncherErrorAppData(const StaticXREAppData& aAppData) {
+  gAppData = &aAppData;
+}
+
+void SetLauncherErrorForceEventLog() { gForceEventLog = true; }
+
+}  // namespace mozilla
diff --git a/browser/app/winlauncher/ErrorHandler.h b/browser/app/winlauncher/ErrorHandler.h
new file mode 100644
index 0000000000..71fe72cf07
--- /dev/null
+++ b/browser/app/winlauncher/ErrorHandler.h
@@ -0,0 +1,54 @@
+/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* vim: set ts=8 sts=2 et sw=2 tw=80: */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at https://mozilla.org/MPL/2.0/. */
+
+#ifndef mozilla_ErrorHandler_h
+#define mozilla_ErrorHandler_h
+
+#include "mozilla/Assertions.h"
+#include "mozilla/WinHeaderOnlyUtils.h"
+
+namespace mozilla {
+
+/**
+ * All launcher process error handling should live in the implementation of
+ * this function.
+ */
+void HandleLauncherError(const LauncherError& aError,
+                         const char* aProcessType = nullptr);
+
+// This function is simply a convenience overload that automatically unwraps
+// the LauncherError from the provided LauncherResult and then forwards it to
+// the main implementation.
+template <typename T>
+inline void HandleLauncherError(const LauncherResult<T>& aResult,
+                                const char* aProcessType = nullptr) {
+  MOZ_ASSERT(aResult.isErr());
+  if (aResult.isOk()) {
+    return;
+  }
+
+  HandleLauncherError(aResult.inspectErr(), aProcessType);
+}
+
+// This function is simply a convenience overload that unwraps the provided
+// GenericErrorResult<LauncherError> and forwards it to the main implementation.
+inline void HandleLauncherError(
+    const GenericErrorResult<LauncherError>& aResult,
+    const char* aProcessType = nullptr) {
+  LauncherVoidResult r(aResult);
+  HandleLauncherError(r, aProcessType);
+}
+
+// Forward declaration
+struct StaticXREAppData;
+
+void SetLauncherErrorAppData(const StaticXREAppData& aAppData);
+
+void SetLauncherErrorForceEventLog();
+
+}  // namespace mozilla
+
+#endif  //  mozilla_ErrorHandler_h
diff --git a/browser/app/winlauncher/LaunchUnelevated.cpp b/browser/app/winlauncher/LaunchUnelevated.cpp
new file mode 100644
index 0000000000..3cf6ac837c
--- /dev/null
+++ b/browser/app/winlauncher/LaunchUnelevated.cpp
@@ -0,0 +1,290 @@
+/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* vim: set ts=8 sts=2 et sw=2 tw=80: */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at https://mozilla.org/MPL/2.0/. */
+
+#include "LaunchUnelevated.h"
+
+#include "mozilla/Assertions.h"
+#include "mozilla/CmdLineAndEnvUtils.h"
+#include "mozilla/mscom/ProcessRuntime.h"
+#include "mozilla/RefPtr.h"
+#include "mozilla/ShellHeaderOnlyUtils.h"
+#include "mozilla/WinHeaderOnlyUtils.h"
+#include "../BrowserDefines.h"
+#include "nsWindowsHelpers.h"
+
+#include <windows.h>
+
+#if !defined(RRF_SUBKEY_WOW6464KEY)
+#  define RRF_SUBKEY_WOW6464KEY 0x00010000
+#endif  // !defined(RRF_SUBKEY_WOW6464KEY)
+
+static mozilla::LauncherResult<bool> IsHighIntegrity(
+    const nsAutoHandle& aToken) {
+  DWORD reqdLen;
+  if (!::GetTokenInformation(aToken.get(), TokenIntegrityLevel, nullptr, 0,
+                             &reqdLen)) {
+    DWORD err = ::GetLastError();
+    if (err != ERROR_INSUFFICIENT_BUFFER) {
+      return LAUNCHER_ERROR_FROM_WIN32(err);
+    }
+  }
+
+  auto buf = mozilla::MakeUnique<char[]>(reqdLen);
+
+  if (!::GetTokenInformation(aToken.get(), TokenIntegrityLevel, buf.get(),
+                             reqdLen, &reqdLen)) {
+    return LAUNCHER_ERROR_FROM_LAST();
+  }
+
+  auto tokenLabel = reinterpret_cast<PTOKEN_MANDATORY_LABEL>(buf.get());
+
+  DWORD subAuthCount = *::GetSidSubAuthorityCount(tokenLabel->Label.Sid);
+  DWORD integrityLevel =
+      *::GetSidSubAuthority(tokenLabel->Label.Sid, subAuthCount - 1);
+  return integrityLevel > SECURITY_MANDATORY_MEDIUM_RID;
+}
+
+static mozilla::LauncherResult<HANDLE> GetMediumIntegrityToken(
+    const nsAutoHandle& aProcessToken) {
+  HANDLE rawResult;
+  if (!::DuplicateTokenEx(aProcessToken.get(), 0, nullptr,
+                          SecurityImpersonation, TokenPrimary, &rawResult)) {
+    return LAUNCHER_ERROR_FROM_LAST();
+  }
+
+  nsAutoHandle result(rawResult);
+
+  BYTE mediumIlSid[SECURITY_MAX_SID_SIZE];
+  DWORD mediumIlSidSize = sizeof(mediumIlSid);
+  if (!::CreateWellKnownSid(WinMediumLabelSid, nullptr, mediumIlSid,
+                            &mediumIlSidSize)) {
+    return LAUNCHER_ERROR_FROM_LAST();
+  }
+
+  TOKEN_MANDATORY_LABEL integrityLevel = {};
+  integrityLevel.Label.Attributes = SE_GROUP_INTEGRITY;
+  integrityLevel.Label.Sid = reinterpret_cast<PSID>(mediumIlSid);
+
+  if (!::SetTokenInformation(rawResult, TokenIntegrityLevel, &integrityLevel,
+                             sizeof(integrityLevel))) {
+    return LAUNCHER_ERROR_FROM_LAST();
+  }
+
+  return result.disown();
+}
+
+static mozilla::LauncherResult<bool> IsAdminByAppCompat(
+    HKEY aRootKey, const wchar_t* aExecutablePath) {
+  static const wchar_t kPathToLayers[] =
+      L"SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\"
+      L"AppCompatFlags\\Layers";
+
+  DWORD dataLength = 0;
+  LSTATUS status = ::RegGetValueW(aRootKey, kPathToLayers, aExecutablePath,
+                                  RRF_RT_REG_SZ | RRF_SUBKEY_WOW6464KEY,
+                                  nullptr, nullptr, &dataLength);
+  if (status == ERROR_FILE_NOT_FOUND) {
+    return false;
+  } else if (status != ERROR_SUCCESS) {
+    return LAUNCHER_ERROR_FROM_WIN32(status);
+  }
+
+  auto valueData = mozilla::MakeUnique<wchar_t[]>(dataLength);
+  if (!valueData) {
+    return LAUNCHER_ERROR_FROM_WIN32(ERROR_OUTOFMEMORY);
+  }
+
+  status = ::RegGetValueW(aRootKey, kPathToLayers, aExecutablePath,
+                          RRF_RT_REG_SZ | RRF_SUBKEY_WOW6464KEY, nullptr,
+                          valueData.get(), &dataLength);
+  if (status != ERROR_SUCCESS) {
+    return LAUNCHER_ERROR_FROM_WIN32(status);
+  }
+
+  const wchar_t kRunAsAdmin[] = L"RUNASADMIN";
+  const wchar_t kDelimiters[] = L" ";
+  wchar_t* tokenContext = nullptr;
+  const wchar_t* token = wcstok_s(valueData.get(), kDelimiters, &tokenContext);
+  while (token) {
+    if (!_wcsnicmp(token, kRunAsAdmin, mozilla::ArrayLength(kRunAsAdmin))) {
+      return true;
+    }
+    token = wcstok_s(nullptr, kDelimiters, &tokenContext);
+  }
+
+  return false;
+}
+
+namespace mozilla {
+
+// If we're running at an elevated integrity level, re-run ourselves at the
+// user's normal integrity level. We do this by locating the active explorer
+// shell, and then asking it to do a ShellExecute on our behalf. We do it this
+// way to ensure that the child process runs as the original user in the active
+// session; an elevated process could be running with different credentials than
+// those of the session.
+// See https://devblogs.microsoft.com/oldnewthing/20131118-00/?p=2643
+
+LauncherVoidResult LaunchUnelevated(int aArgc, wchar_t* aArgv[]) {
+  // We need COM to talk to Explorer. Using ProcessRuntime so that
+  // process-global COM configuration is done correctly
+  mozilla::mscom::ProcessRuntime mscom(
+      mozilla::mscom::ProcessRuntime::ProcessCategory::Launcher);
+  if (!mscom) {
+    return LAUNCHER_ERROR_FROM_HRESULT(mscom.GetHResult());
+  }
+
+  // Omit the original argv[0] because ShellExecute doesn't need it. Insert
+  // ATTEMPTING_DEELEVATION_FLAG so that we know not to attempt to restart
+  // ourselves if deelevation fails.
+  UniquePtr<wchar_t[]> cmdLine = [&]() {
+    constexpr wchar_t const* kTagArg = L"--" ATTEMPTING_DEELEVATION_FLAG;
+
+    // This should have already been checked, but just in case...
+    EnsureBrowserCommandlineSafe(aArgc, aArgv);
+
+    if (mozilla::CheckArg(aArgc, aArgv, "osint", nullptr, CheckArgFlag::None)) {
+      // If the command line contains -osint, we have to arrange things in a
+      // particular order.
+      //
+      // (We can't just replace -osint with kTagArg, unfortunately: there is
+      // code in the browser which behaves differently in the presence of an
+      // `-osint` tag, but which will not have had a chance to react to this.
+      // See, _e.g._, bug 1243603.)
+      auto const aArgvCopy = MakeUnique<wchar_t const*[]>(aArgc + 1);
+      aArgvCopy[0] = aArgv[1];
+      aArgvCopy[1] = kTagArg;
+      for (int i = 2; i < aArgc; ++i) {
+        aArgvCopy[i] = aArgv[i];
+      }
+      aArgvCopy[aArgc] = nullptr;  // because argv[argc] is NULL
+      return MakeCommandLine(aArgc, aArgvCopy.get(), 0, nullptr);
+    } else {
+      // Otherwise, just tack it on at the end.
+      constexpr wchar_t const* const kTagArgArray[] = {kTagArg};
+      return MakeCommandLine(aArgc - 1, aArgv + 1, 1, kTagArgArray);
+    }
+  }();
+  if (!cmdLine) {
+    return LAUNCHER_ERROR_GENERIC();
+  }
+
+  _bstr_t cmd;
+
+  UniquePtr<wchar_t[]> packageFamilyName = mozilla::GetPackageFamilyName();
+  if (packageFamilyName) {
+    int cmdLen =
+        // 22 for the prefix + suffix + null terminator below
+        22 + wcslen(packageFamilyName.get());
+    wchar_t appCmd[cmdLen];
+    swprintf(appCmd, cmdLen, L"shell:appsFolder\\%s!App",
+             packageFamilyName.get());
+    cmd = appCmd;
+  } else {
+    cmd = aArgv[0];
+  }
+
+  _variant_t args(cmdLine.get());
+  _variant_t operation(L"open");
+  _variant_t directory;
+  _variant_t showCmd(SW_SHOWNORMAL);
+  return ShellExecuteByExplorer(cmd, args, operation, directory, showCmd);
+}
+
+LauncherResult<ElevationState> GetElevationState(
+    const wchar_t* aExecutablePath, mozilla::LauncherFlags aFlags,
+    nsAutoHandle& aOutMediumIlToken) {
+  aOutMediumIlToken.reset();
+
+  const DWORD tokenFlags = TOKEN_QUERY | TOKEN_DUPLICATE |
+                           TOKEN_ADJUST_DEFAULT | TOKEN_ASSIGN_PRIMARY;
+  HANDLE rawToken;
+  if (!::OpenProcessToken(::GetCurrentProcess(), tokenFlags, &rawToken)) {
+    return LAUNCHER_ERROR_FROM_LAST();
+  }
+
+  nsAutoHandle token(rawToken);
+
+  LauncherResult<TOKEN_ELEVATION_TYPE> elevationType = GetElevationType(token);
+  if (elevationType.isErr()) {
+    return elevationType.propagateErr();
+  }
+
+  Maybe<ElevationState> elevationState;
+  switch (elevationType.unwrap()) {
+    case TokenElevationTypeLimited:
+      return ElevationState::eNormalUser;
+    case TokenElevationTypeFull:
+      elevationState = Some(ElevationState::eElevated);
+      break;
+    case TokenElevationTypeDefault: {
+      // In this case, UAC is disabled. We do not yet know whether or not we
+      // are running at high integrity. If we are at high integrity, we can't
+      // relaunch ourselves in a non-elevated state via Explorer, as we would
+      // just end up in an infinite loop of launcher processes re-launching
+      // themselves.
+      LauncherResult<bool> isHighIntegrity = IsHighIntegrity(token);
+      if (isHighIntegrity.isErr()) {
+        return isHighIntegrity.propagateErr();
+      }
+
+      if (!isHighIntegrity.unwrap()) {
+        return ElevationState::eNormalUser;
+      }
+
+      elevationState = Some(ElevationState::eHighIntegrityNoUAC);
+      break;
+    }
+    default:
+      MOZ_ASSERT_UNREACHABLE("Was a new value added to the enumeration?");
+      return LAUNCHER_ERROR_GENERIC();
+  }
+
+  MOZ_ASSERT(elevationState.isSome() &&
+                 elevationState.value() != ElevationState::eNormalUser,
+             "Should have returned earlier for the eNormalUser case.");
+
+  LauncherResult<bool> isAdminByAppCompat =
+      IsAdminByAppCompat(HKEY_CURRENT_USER, aExecutablePath);
+  if (isAdminByAppCompat.isErr()) {
+    return isAdminByAppCompat.propagateErr();
+  }
+
+  if (isAdminByAppCompat.unwrap()) {
+    elevationState = Some(ElevationState::eHighIntegrityByAppCompat);
+  } else {
+    isAdminByAppCompat =
+        IsAdminByAppCompat(HKEY_LOCAL_MACHINE, aExecutablePath);
+    if (isAdminByAppCompat.isErr()) {
+      return isAdminByAppCompat.propagateErr();
+    }
+
+    if (isAdminByAppCompat.unwrap()) {
+      elevationState = Some(ElevationState::eHighIntegrityByAppCompat);
+    }
+  }
+
+  // A medium IL token is not needed in the following cases.
+  // 1) We keep the process elevated (= LauncherFlags::eNoDeelevate)
+  // 2) The process was elevated by UAC (= ElevationState::eElevated)
+  //    AND the launcher process doesn't wait for the browser process
+  if ((aFlags & mozilla::LauncherFlags::eNoDeelevate) ||
+      (elevationState.value() == ElevationState::eElevated &&
+       !(aFlags & mozilla::LauncherFlags::eWaitForBrowser))) {
+    return elevationState.value();
+  }
+
+  LauncherResult<HANDLE> tokenResult = GetMediumIntegrityToken(token);
+  if (tokenResult.isOk()) {
+    aOutMediumIlToken.own(tokenResult.unwrap());
+  } else {
+    return tokenResult.propagateErr();
+  }
+
+  return elevationState.value();
+}
+
+}  // namespace mozilla
diff --git a/browser/app/winlauncher/LaunchUnelevated.h b/browser/app/winlauncher/LaunchUnelevated.h
new file mode 100644
index 0000000000..8c6679edf3
--- /dev/null
+++ b/browser/app/winlauncher/LaunchUnelevated.h
@@ -0,0 +1,32 @@
+/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* vim: set ts=8 sts=2 et sw=2 tw=80: */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at https://mozilla.org/MPL/2.0/. */
+
+#ifndef mozilla_LaunchUnelevated_h
+#define mozilla_LaunchUnelevated_h
+
+#include "LauncherProcessWin.h"
+#include "mozilla/WinHeaderOnlyUtils.h"
+#include "mozilla/Maybe.h"
+#include "nsWindowsHelpers.h"
+
+namespace mozilla {
+
+enum class ElevationState {
+  eNormalUser = 0,
+  eElevated = (1 << 0),
+  eHighIntegrityNoUAC = (1 << 1),
+  eHighIntegrityByAppCompat = (1 << 2),
+};
+
+LauncherResult<ElevationState> GetElevationState(
+    const wchar_t* aExecutablePath, LauncherFlags aFlags,
+    nsAutoHandle& aOutMediumIlToken);
+
+LauncherVoidResult LaunchUnelevated(int aArgc, wchar_t* aArgv[]);
+
+}  // namespace mozilla
+
+#endif  // mozilla_LaunchUnelevated_h
diff --git a/browser/app/winlauncher/LauncherProcessWin.cpp b/browser/app/winlauncher/LauncherProcessWin.cpp
new file mode 100644
index 0000000000..082ada9ea7
--- /dev/null
+++ b/browser/app/winlauncher/LauncherProcessWin.cpp
@@ -0,0 +1,536 @@
+/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* vim: set ts=8 sts=2 et sw=2 tw=80: */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at https://mozilla.org/MPL/2.0/. */
+
+#include "LauncherProcessWin.h"
+
+#include <string.h>
+
+#include "mozilla/Attributes.h"
+#include "mozilla/CmdLineAndEnvUtils.h"
+#include "mozilla/DebugOnly.h"
+#include "mozilla/DynamicallyLinkedFunctionPtr.h"
+#include "mozilla/glue/Debug.h"
+#include "mozilla/GeckoArgs.h"
+#include "mozilla/Maybe.h"
+#include "mozilla/SafeMode.h"
+#include "mozilla/UniquePtr.h"
+#include "mozilla/WindowsConsole.h"
+#include "mozilla/WindowsVersion.h"
+#include "mozilla/WinHeaderOnlyUtils.h"
+#include "nsWindowsHelpers.h"
+
+#include <windows.h>
+#include <processthreadsapi.h>
+
+#include "DllBlocklistInit.h"
+#include "ErrorHandler.h"
+#include "LaunchUnelevated.h"
+#include "ProcThreadAttributes.h"
+#include "../BrowserDefines.h"
+
+#if defined(MOZ_LAUNCHER_PROCESS)
+#  include "mozilla/LauncherRegistryInfo.h"
+#  include "SameBinary.h"
+#endif  // defined(MOZ_LAUNCHER_PROCESS)
+
+#if defined(MOZ_SANDBOX)
+#  include "mozilla/sandboxing/SandboxInitialization.h"
+#endif
+
+namespace mozilla {
+// "const" because nothing in this process modifies it.
+// "volatile" because something in another process may.
+const volatile DeelevationStatus gDeelevationStatus =
+    DeelevationStatus::DefaultStaticValue;
+}  // namespace mozilla
+
+/**
+ * At this point the child process has been created in a suspended state. Any
+ * additional startup work (eg, blocklist setup) should go here.
+ *
+ * @return Ok if browser startup should proceed
+ */
+static mozilla::LauncherVoidResult PostCreationSetup(
+    const wchar_t* aFullImagePath, HANDLE aChildProcess,
+    HANDLE aChildMainThread, mozilla::DeelevationStatus aDStatus,
+    const bool aIsSafeMode, const bool aDisableDynamicBlocklist,
+    mozilla::Maybe<std::wstring> aBlocklistFileName) {
+  /* scope for txManager */ {
+    mozilla::nt::CrossExecTransferManager txManager(aChildProcess);
+    if (!txManager) {
+      return LAUNCHER_ERROR_FROM_WIN32(ERROR_BAD_EXE_FORMAT);
+    }
+
+    using mozilla::gDeelevationStatus;
+
+    void* targetAddress = (LPVOID)&gDeelevationStatus;
+
+    auto const guard = txManager.Protect(
+        targetAddress, sizeof(gDeelevationStatus), PAGE_READWRITE);
+
+    mozilla::LauncherVoidResult result =
+        txManager.Transfer(targetAddress, &aDStatus, sizeof(aDStatus));
+    if (result.isErr()) {
+      return result;
+    }
+  }
+
+  return mozilla::InitializeDllBlocklistOOPFromLauncher(
+      aFullImagePath, aChildProcess, aDisableDynamicBlocklist,
+      aBlocklistFileName);
+}
+
+/**
+ * Create a new Job object and assign |aProcess| to it.  If something fails
+ * in this function, we return nullptr but continue without recording
+ * a launcher failure because it's not a critical problem to launch
+ * the browser process.
+ */
+static nsReturnRef<HANDLE> CreateJobAndAssignProcess(HANDLE aProcess) {
+  nsAutoHandle empty;
+  nsAutoHandle job(::CreateJobObjectW(nullptr, nullptr));
+
+  // Set JOB_OBJECT_LIMIT_BREAKAWAY_OK to allow the browser process
+  // to put child processes into a job on Win7, which does not support
+  // nested jobs.  See CanUseJob() in sandboxBroker.cpp.
+  JOBOBJECT_EXTENDED_LIMIT_INFORMATION jobInfo = {};
+  jobInfo.BasicLimitInformation.LimitFlags =
+      JOB_OBJECT_LIMIT_KILL_ON_JOB_CLOSE | JOB_OBJECT_LIMIT_BREAKAWAY_OK;
+  if (!::SetInformationJobObject(job.get(), JobObjectExtendedLimitInformation,
+                                 &jobInfo, sizeof(jobInfo))) {
+    return empty.out();
+  }
+
+  if (!::AssignProcessToJobObject(job.get(), aProcess)) {
+    return empty.out();
+  }
+
+  return job.out();
+}
+
+#if !defined( \
+    PROCESS_CREATION_MITIGATION_POLICY_IMAGE_LOAD_PREFER_SYSTEM32_ALWAYS_ON)
+#  define PROCESS_CREATION_MITIGATION_POLICY_IMAGE_LOAD_PREFER_SYSTEM32_ALWAYS_ON \
+    (0x00000001ULL << 60)
+#endif  // !defined(PROCESS_CREATION_MITIGATION_POLICY_IMAGE_LOAD_PREFER_SYSTEM32_ALWAYS_ON)
+
+#if !defined(PROCESS_CREATION_MITIGATION_POLICY_CONTROL_FLOW_GUARD_ALWAYS_OFF)
+#  define PROCESS_CREATION_MITIGATION_POLICY_CONTROL_FLOW_GUARD_ALWAYS_OFF \
+    (0x00000002ULL << 40)
+#endif  // !defined(PROCESS_CREATION_MITIGATION_POLICY_CONTROL_FLOW_GUARD_ALWAYS_OFF)
+
+#if (_WIN32_WINNT < 0x0602)
+BOOL WINAPI
+SetProcessMitigationPolicy(PROCESS_MITIGATION_POLICY aMitigationPolicy,
+                           PVOID aBuffer, SIZE_T aBufferLen);
+#endif  // (_WIN32_WINNT >= 0x0602)
+
+/**
+ * Any mitigation policies that should be set on the browser process should go
+ * here.
+ */
+static void SetMitigationPolicies(mozilla::ProcThreadAttributes& aAttrs,
+                                  const bool aIsSafeMode) {
+  if (mozilla::IsWin10AnniversaryUpdateOrLater()) {
+    aAttrs.AddMitigationPolicy(
+        PROCESS_CREATION_MITIGATION_POLICY_IMAGE_LOAD_PREFER_SYSTEM32_ALWAYS_ON);
+  }
+
+#if defined(_M_ARM64)
+  // Disable CFG on older versions of ARM64 Windows to avoid a crash in COM.
+  if (!mozilla::IsWin10Sep2018UpdateOrLater()) {
+    aAttrs.AddMitigationPolicy(
+        PROCESS_CREATION_MITIGATION_POLICY_CONTROL_FLOW_GUARD_ALWAYS_OFF);
+  }
+#endif  // defined(_M_ARM64)
+}
+
+static mozilla::LauncherFlags ProcessCmdLine(int& aArgc, wchar_t* aArgv[]) {
+  mozilla::LauncherFlags result = mozilla::LauncherFlags::eNone;
+
+  if (mozilla::CheckArg(aArgc, aArgv, "wait-for-browser", nullptr,
+                        mozilla::CheckArgFlag::RemoveArg) ==
+          mozilla::ARG_FOUND ||
+      mozilla::CheckArg(aArgc, aArgv, "marionette", nullptr,
+                        mozilla::CheckArgFlag::None) == mozilla::ARG_FOUND ||
+      mozilla::CheckArg(aArgc, aArgv, "backgroundtask", nullptr,
+                        mozilla::CheckArgFlag::None) == mozilla::ARG_FOUND ||
+      mozilla::CheckArg(aArgc, aArgv, "headless", nullptr,
+                        mozilla::CheckArgFlag::None) == mozilla::ARG_FOUND ||
+      mozilla::CheckArg(aArgc, aArgv, "remote-debugging-port", nullptr,
+                        mozilla::CheckArgFlag::None) == mozilla::ARG_FOUND ||
+      mozilla::EnvHasValue("MOZ_AUTOMATION") ||
+      mozilla::EnvHasValue("MOZ_HEADLESS")) {
+    result |= mozilla::LauncherFlags::eWaitForBrowser;
+  }
+
+  if (mozilla::CheckArg(aArgc, aArgv, "no-deelevate") == mozilla::ARG_FOUND) {
+    result |= mozilla::LauncherFlags::eNoDeelevate;
+  }
+
+  if (mozilla::CheckArg(aArgc, aArgv, ATTEMPTING_DEELEVATION_FLAG) ==
+      mozilla::ARG_FOUND) {
+    result |= mozilla::LauncherFlags::eDeelevating;
+  }
+
+  return result;
+}
+
+static void MaybeBreakForBrowserDebugging() {
+  if (mozilla::EnvHasValue("MOZ_DEBUG_BROWSER_PROCESS")) {
+    ::DebugBreak();
+    return;
+  }
+
+  const wchar_t* pauseLenS = _wgetenv(L"MOZ_DEBUG_BROWSER_PAUSE");
+  if (!pauseLenS || !(*pauseLenS)) {
+    return;
+  }
+
+  DWORD pauseLenMs = wcstoul(pauseLenS, nullptr, 10) * 1000;
+  printf_stderr("\n\nBROWSERBROWSERBROWSERBROWSER\n  debug me @ %lu\n\n",
+                ::GetCurrentProcessId());
+  ::Sleep(pauseLenMs);
+}
+
+static bool DoLauncherProcessChecks(int& argc, wchar_t** argv) {
+  // NB: We run all tests in this function instead of returning early in order
+  // to ensure that all side effects take place, such as clearing environment
+  // variables.
+  bool result = false;
+
+#if defined(MOZ_LAUNCHER_PROCESS)
+  // We still prefer to compare file ids.  Comparing NT paths i.e. passing
+  // CompareNtPathsOnly to IsSameBinaryAsParentProcess is much faster, but
+  // we're not 100% sure that NT path comparison perfectly prevents the
+  // launching loop of the launcher process.
+  mozilla::LauncherResult<bool> isSame = mozilla::IsSameBinaryAsParentProcess();
+  if (isSame.isOk()) {
+    result = !isSame.unwrap();
+  } else {
+    HandleLauncherError(isSame.unwrapErr());
+  }
+#endif  // defined(MOZ_LAUNCHER_PROCESS)
+
+  if (mozilla::EnvHasValue("MOZ_LAUNCHER_PROCESS")) {
+    mozilla::SaveToEnv("MOZ_LAUNCHER_PROCESS=");
+    result = true;
+  }
+
+  result |=
+      mozilla::CheckArg(argc, argv, "launcher", nullptr,
+                        mozilla::CheckArgFlag::RemoveArg) == mozilla::ARG_FOUND;
+
+  return result;
+}
+
+#if defined(MOZ_LAUNCHER_PROCESS)
+static mozilla::Maybe<bool> RunAsLauncherProcess(
+    mozilla::LauncherRegistryInfo& aRegInfo, int& argc, wchar_t** argv) {
+#else
+static mozilla::Maybe<bool> RunAsLauncherProcess(int& argc, wchar_t** argv) {
+#endif  // defined(MOZ_LAUNCHER_PROCESS)
+  bool runAsLauncher = DoLauncherProcessChecks(argc, argv);
+
+#if defined(MOZ_LAUNCHER_PROCESS)
+  bool forceLauncher =
+      runAsLauncher &&
+      mozilla::CheckArg(argc, argv, "force-launcher", nullptr,
+                        mozilla::CheckArgFlag::RemoveArg) == mozilla::ARG_FOUND;
+
+  mozilla::LauncherRegistryInfo::ProcessType desiredType =
+      runAsLauncher ? mozilla::LauncherRegistryInfo::ProcessType::Launcher
+                    : mozilla::LauncherRegistryInfo::ProcessType::Browser;
+
+  mozilla::LauncherRegistryInfo::CheckOption checkOption =
+      forceLauncher ? mozilla::LauncherRegistryInfo::CheckOption::Force
+                    : mozilla::LauncherRegistryInfo::CheckOption::Default;
+
+  mozilla::LauncherResult<mozilla::LauncherRegistryInfo::ProcessType>
+      runAsType = aRegInfo.Check(desiredType, checkOption);
+
+  if (runAsType.isErr()) {
+    mozilla::HandleLauncherError(runAsType);
+    return mozilla::Nothing();
+  }
+
+  runAsLauncher = runAsType.unwrap() ==
+                  mozilla::LauncherRegistryInfo::ProcessType::Launcher;
+#endif  // defined(MOZ_LAUNCHER_PROCESS)
+
+  if (!runAsLauncher) {
+    // In this case, we will be proceeding to run as the browser.
+    // We should check MOZ_DEBUG_BROWSER_* env vars.
+    MaybeBreakForBrowserDebugging();
+  }
+
+  return mozilla::Some(runAsLauncher);
+}
+
+namespace mozilla {
+
+Maybe<int> LauncherMain(int& argc, wchar_t* argv[],
+                        const StaticXREAppData& aAppData) {
+  EnsureBrowserCommandlineSafe(argc, argv);
+
+  SetLauncherErrorAppData(aAppData);
+
+  if (CheckArg(argc, argv, "log-launcher-error", nullptr,
+               mozilla::CheckArgFlag::RemoveArg) == ARG_FOUND) {
+    SetLauncherErrorForceEventLog();
+  }
+
+  // return fast when we're a child process.
+  // (The remainder of this function has some side effects that are
+  // undesirable for content processes)
+  if (mozilla::CheckArg(argc, argv, "contentproc", nullptr,
+                        mozilla::CheckArgFlag::None) == mozilla::ARG_FOUND) {
+    // A child process should not instantiate LauncherRegistryInfo.
+    return Nothing();
+  }
+
+#if defined(MOZ_LAUNCHER_PROCESS)
+  LauncherRegistryInfo regInfo;
+  Maybe<bool> runAsLauncher = RunAsLauncherProcess(regInfo, argc, argv);
+  LauncherResult<std::wstring> blocklistFileNameResult =
+      regInfo.GetBlocklistFileName();
+  Maybe<std::wstring> blocklistFileName =
+      blocklistFileNameResult.isOk() ? Some(blocklistFileNameResult.unwrap())
+                                     : Nothing();
+#else
+  Maybe<bool> runAsLauncher = RunAsLauncherProcess(argc, argv);
+  Maybe<std::wstring> blocklistFileName = Nothing();
+#endif  // defined(MOZ_LAUNCHER_PROCESS)
+  if (!runAsLauncher || !runAsLauncher.value()) {
+#if defined(MOZ_LAUNCHER_PROCESS)
+    // Update the registry as Browser
+    LauncherVoidResult commitResult = regInfo.Commit();
+    if (commitResult.isErr()) {
+      mozilla::HandleLauncherError(commitResult);
+    }
+#endif  // defined(MOZ_LAUNCHER_PROCESS)
+    return Nothing();
+  }
+
+  // Make sure that the launcher process itself has image load policies set
+  if (IsWin10AnniversaryUpdateOrLater()) {
+    static const StaticDynamicallyLinkedFunctionPtr<
+        decltype(&SetProcessMitigationPolicy)>
+        pSetProcessMitigationPolicy(L"kernel32.dll",
+                                    "SetProcessMitigationPolicy");
+    if (pSetProcessMitigationPolicy) {
+      PROCESS_MITIGATION_IMAGE_LOAD_POLICY imgLoadPol = {};
+      imgLoadPol.PreferSystem32Images = 1;
+
+      DebugOnly<BOOL> setOk = pSetProcessMitigationPolicy(
+          ProcessImageLoadPolicy, &imgLoadPol, sizeof(imgLoadPol));
+      MOZ_ASSERT(setOk);
+    }
+  }
+
+#if defined(MOZ_SANDBOX)
+  // Ensure the relevant mitigations are enforced.
+  mozilla::sandboxing::ApplyParentProcessMitigations();
+#endif
+
+  mozilla::UseParentConsole();
+
+  if (!SetArgv0ToFullBinaryPath(argv)) {
+    HandleLauncherError(LAUNCHER_ERROR_GENERIC());
+    return Nothing();
+  }
+
+  LauncherFlags flags = ProcessCmdLine(argc, argv);
+
+  nsAutoHandle mediumIlToken;
+  LauncherResult<ElevationState> elevationState =
+      GetElevationState(argv[0], flags, mediumIlToken);
+  if (elevationState.isErr()) {
+    HandleLauncherError(elevationState);
+    return Nothing();
+  }
+
+  // Distill deelevation status, and/or attempt to perform launcher deelevation
+  // via an indirect relaunch.
+  DeelevationStatus deelevationStatus = DeelevationStatus::Unknown;
+  if (mediumIlToken.get()) {
+    // Rather than indirectly relaunch the launcher, we'll attempt to directly
+    // launch the main process with a reduced-privilege security token.
+    deelevationStatus = DeelevationStatus::PartiallyDeelevated;
+  } else if (elevationState.unwrap() == ElevationState::eElevated) {
+    if (flags & LauncherFlags::eWaitForBrowser) {
+      // An indirect relaunch won't provide a process-handle to block on,
+      // so we have to continue onwards with this process.
+      deelevationStatus = DeelevationStatus::DeelevationProhibited;
+    } else if (flags & LauncherFlags::eNoDeelevate) {
+      // Our invoker (hopefully, the user) has explicitly requested that the
+      // launcher not deelevate itself.
+      deelevationStatus = DeelevationStatus::DeelevationProhibited;
+    } else if (flags & LauncherFlags::eDeelevating) {
+      // We've already tried to deelevate, to no effect. Continue onward.
+      deelevationStatus = DeelevationStatus::UnsuccessfullyDeelevated;
+    } else {
+      // Otherwise, attempt to relaunch the launcher process itself via the
+      // shell, which hopefully will not be elevated. (But see bug 1733821.)
+      LauncherVoidResult launchedUnelevated = LaunchUnelevated(argc, argv);
+      if (launchedUnelevated.isErr()) {
+        // On failure, don't even try for a launcher process. Continue onwards
+        // in this one. (TODO: why? This isn't technically fatal...)
+        HandleLauncherError(launchedUnelevated);
+        return Nothing();
+      }
+      // Otherwise, tell our caller to exit with a success code.
+      return Some(0);
+    }
+  } else if (elevationState.unwrap() == ElevationState::eNormalUser) {
+    if (flags & LauncherFlags::eDeelevating) {
+      // Deelevation appears to have been successful!
+      deelevationStatus = DeelevationStatus::SuccessfullyDeelevated;
+    } else {
+      // We haven't done anything and we don't need to.
+      deelevationStatus = DeelevationStatus::StartedUnprivileged;
+    }
+  } else {
+    // Some other elevation state with no medium-integrity token.
+    // (This should probably not happen.)
+    deelevationStatus = DeelevationStatus::Unknown;
+  }
+
+#if defined(MOZ_LAUNCHER_PROCESS)
+  // Update the registry as Launcher
+  LauncherVoidResult commitResult = regInfo.Commit();
+  if (commitResult.isErr()) {
+    mozilla::HandleLauncherError(commitResult);
+    return Nothing();
+  }
+#endif  // defined(MOZ_LAUNCHER_PROCESS)
+
+  // Now proceed with setting up the parameters for process creation
+  UniquePtr<wchar_t[]> cmdLine(MakeCommandLine(argc, argv));
+  if (!cmdLine) {
+    HandleLauncherError(LAUNCHER_ERROR_GENERIC());
+    return Nothing();
+  }
+
+  const Maybe<bool> isSafeMode =
+      IsSafeModeRequested(argc, argv, SafeModeFlag::NoKeyPressCheck);
+  if (!isSafeMode) {
+    HandleLauncherError(LAUNCHER_ERROR_FROM_WIN32(ERROR_INVALID_PARAMETER));
+    return Nothing();
+  }
+
+  ProcThreadAttributes attrs;
+  SetMitigationPolicies(attrs, isSafeMode.value());
+
+  HANDLE stdHandles[] = {::GetStdHandle(STD_INPUT_HANDLE),
+                         ::GetStdHandle(STD_OUTPUT_HANDLE),
+                         ::GetStdHandle(STD_ERROR_HANDLE)};
+
+  attrs.AddInheritableHandles(stdHandles);
+
+  DWORD creationFlags = CREATE_SUSPENDED | CREATE_UNICODE_ENVIRONMENT;
+
+  STARTUPINFOEXW siex;
+  LauncherResult<bool> attrsOk = attrs.AssignTo(siex);
+  if (attrsOk.isErr()) {
+    HandleLauncherError(attrsOk);
+    return Nothing();
+  }
+
+  BOOL inheritHandles = FALSE;
+
+  if (attrsOk.unwrap()) {
+    creationFlags |= EXTENDED_STARTUPINFO_PRESENT;
+
+    if (attrs.HasInheritableHandles()) {
+      siex.StartupInfo.dwFlags |= STARTF_USESTDHANDLES;
+      siex.StartupInfo.hStdInput = stdHandles[0];
+      siex.StartupInfo.hStdOutput = stdHandles[1];
+      siex.StartupInfo.hStdError = stdHandles[2];
+
+      // Since attrsOk == true, we have successfully set the handle inheritance
+      // whitelist policy, so only the handles added to attrs will be inherited.
+      inheritHandles = TRUE;
+    }
+  }
+
+  // Pass on the path of the shortcut used to launch this process, if any.
+  STARTUPINFOW currentStartupInfo = {.cb = sizeof(STARTUPINFOW)};
+  GetStartupInfoW(&currentStartupInfo);
+  if ((currentStartupInfo.dwFlags & STARTF_TITLEISLINKNAME) &&
+      currentStartupInfo.lpTitle) {
+    siex.StartupInfo.dwFlags |= STARTF_TITLEISLINKNAME;
+    siex.StartupInfo.lpTitle = currentStartupInfo.lpTitle;
+  }
+
+  PROCESS_INFORMATION pi = {};
+  BOOL createOk;
+
+  if (mediumIlToken.get()) {
+    createOk =
+        ::CreateProcessAsUserW(mediumIlToken.get(), argv[0], cmdLine.get(),
+                               nullptr, nullptr, inheritHandles, creationFlags,
+                               nullptr, nullptr, &siex.StartupInfo, &pi);
+  } else {
+    createOk = ::CreateProcessW(argv[0], cmdLine.get(), nullptr, nullptr,
+                                inheritHandles, creationFlags, nullptr, nullptr,
+                                &siex.StartupInfo, &pi);
+  }
+
+  if (!createOk) {
+    HandleLauncherError(LAUNCHER_ERROR_FROM_LAST());
+    return Nothing();
+  }
+
+  nsAutoHandle process(pi.hProcess);
+  nsAutoHandle mainThread(pi.hThread);
+
+  nsAutoHandle job;
+  if (flags & LauncherFlags::eWaitForBrowser) {
+    job = CreateJobAndAssignProcess(process.get());
+  }
+
+  bool disableDynamicBlocklist = IsDynamicBlocklistDisabled(
+      isSafeMode.value(),
+      mozilla::CheckArg(
+          argc, argv, mozilla::geckoargs::sDisableDynamicDllBlocklist.sMatch,
+          nullptr, mozilla::CheckArgFlag::None) == mozilla::ARG_FOUND);
+  LauncherVoidResult setupResult = PostCreationSetup(
+      argv[0], process.get(), mainThread.get(), deelevationStatus,
+      isSafeMode.value(), disableDynamicBlocklist, blocklistFileName);
+  if (setupResult.isErr()) {
+    HandleLauncherError(setupResult);
+    ::TerminateProcess(process.get(), 1);
+    return Nothing();
+  }
+
+  if (::ResumeThread(mainThread.get()) == static_cast<DWORD>(-1)) {
+    HandleLauncherError(LAUNCHER_ERROR_FROM_LAST());
+    ::TerminateProcess(process.get(), 1);
+    return Nothing();
+  }
+
+  if (flags & LauncherFlags::eWaitForBrowser) {
+    DWORD exitCode;
+    if (::WaitForSingleObject(process.get(), INFINITE) == WAIT_OBJECT_0 &&
+        ::GetExitCodeProcess(process.get(), &exitCode)) {
+      // Propagate the browser process's exit code as our exit code.
+      return Some(static_cast<int>(exitCode));
+    }
+  } else {
+    const DWORD timeout =
+        ::IsDebuggerPresent() ? INFINITE : kWaitForInputIdleTimeoutMS;
+
+    // Keep the current process around until the callback process has created
+    // its message queue, to avoid the launched process's windows being forced
+    // into the background.
+    mozilla::WaitForInputIdle(process.get(), timeout);
+  }
+
+  return Some(0);
+}
+
+}  // namespace mozilla
diff --git a/browser/app/winlauncher/LauncherProcessWin.h b/browser/app/winlauncher/LauncherProcessWin.h
new file mode 100644
index 0000000000..8fd53d7d3f
--- /dev/null
+++ b/browser/app/winlauncher/LauncherProcessWin.h
@@ -0,0 +1,70 @@
+/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* vim: set ts=8 sts=2 et sw=2 tw=80: */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at https://mozilla.org/MPL/2.0/. */
+
+#ifndef mozilla_LauncherProcessWin_h
+#define mozilla_LauncherProcessWin_h
+
+#include "mozilla/Maybe.h"
+#include "mozilla/TypedEnumBits.h"
+
+#include <stdint.h>
+
+namespace mozilla {
+
+// Forward declaration
+struct StaticXREAppData;
+
+/**
+ * Determine whether or not the current process should be run as the launcher
+ * process, and run if so. If we are not supposed to run as the launcher
+ * process, or in the event of a launcher process failure, return Nothing, thus
+ * indicating that we should continue on the original startup code path.
+ */
+Maybe<int> LauncherMain(int& argc, wchar_t* argv[],
+                        const StaticXREAppData& aAppData);
+
+enum class LauncherFlags : uint32_t {
+  eNone = 0,
+  eWaitForBrowser = (1 << 0),  // Launcher should block until browser finishes
+  eNoDeelevate = (1 << 1),     // If elevated, do not attempt to de-elevate
+  eDeelevating = (1 << 2),     // A de-elevation attempt has been made
+};
+
+MOZ_MAKE_ENUM_CLASS_BITWISE_OPERATORS(LauncherFlags);
+
+enum class DeelevationStatus : uint32_t {
+  // The deelevation status could not be determined. Should never actually be
+  // the value of `gDeelevationStatus`.
+  Unknown = 0,
+
+  // Deelevation did not need to be performed because the process was started
+  // without administrative privileges.
+  StartedUnprivileged = 1,
+  // Deelevation would have been performed, but was prohibited due to a flag.
+  DeelevationProhibited = 2,
+  // The launcher process was successfully deelevated.
+  SuccessfullyDeelevated = 3,
+  // The launcher process was not successfully deelevated, but a
+  // medium-integrity token was used to launch the main process.
+  PartiallyDeelevated = 4,
+  // Deelevation was attempted, but failed completely. The main process is
+  // running with administrative privileges.
+  UnsuccessfullyDeelevated = 5,
+
+  // This is the static initial value of `gDeelevationStatus`; it acts as a
+  // sentinel to determine whether the launcher has set it at all. (It's
+  // therefore the normal value of `gDeelevationStatus` when the launcher is
+  // disabled.)
+  DefaultStaticValue = 0x55AA55AA,
+};
+
+// The result of the deelevation attempt. Set by the launcher process in the
+// main process when the two are distinct.
+extern const volatile DeelevationStatus gDeelevationStatus;
+
+}  // namespace mozilla
+
+#endif  // mozilla_LauncherProcessWin_h
diff --git a/browser/app/winlauncher/NtLoaderAPI.cpp b/browser/app/winlauncher/NtLoaderAPI.cpp
new file mode 100644
index 0000000000..97f8a20186
--- /dev/null
+++ b/browser/app/winlauncher/NtLoaderAPI.cpp
@@ -0,0 +1,33 @@
+/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* vim: set ts=8 sts=2 et sw=2 tw=80: */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at https://mozilla.org/MPL/2.0/. */
+
+#include "mozilla/LoaderAPIInterfaces.h"
+
+#include "freestanding/CheckForCaller.h"
+#include "freestanding/LoaderPrivateAPI.h"
+
+namespace mozilla {
+
+extern "C" MOZ_EXPORT nt::LoaderAPI* GetNtLoaderAPI(
+    nt::LoaderObserver* aNewObserver) {
+  // Make sure the caller is inside mozglue.dll - we don't want to allow
+  // external access to this function, as it contains details about
+  // the SharedSection which is used to sandbox future child processes.
+  const bool isCallerMozglue =
+      CheckForAddress(RETURN_ADDRESS(), L"mozglue.dll");
+  MOZ_ASSERT(isCallerMozglue);
+  if (!isCallerMozglue) {
+    return nullptr;
+  }
+
+  freestanding::EnsureInitialized();
+  freestanding::LoaderPrivateAPI& api = freestanding::gLoaderPrivateAPI;
+  api.SetObserver(aNewObserver);
+
+  return &api;
+}
+
+}  // namespace mozilla
diff --git a/browser/app/winlauncher/ProcThreadAttributes.h b/browser/app/winlauncher/ProcThreadAttributes.h
new file mode 100644
index 0000000000..74d5fee06c
--- /dev/null
+++ b/browser/app/winlauncher/ProcThreadAttributes.h
@@ -0,0 +1,159 @@
+/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* vim: set ts=8 sts=2 et sw=2 tw=80: */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at https://mozilla.org/MPL/2.0/. */
+
+#ifndef mozilla_ProcThreadAttributes_h
+#define mozilla_ProcThreadAttributes_h
+
+#include <windows.h>
+
+#include <utility>
+
+#include "mozilla/Attributes.h"
+#include "mozilla/Maybe.h"
+#include "mozilla/UniquePtr.h"
+#include "mozilla/Vector.h"
+
+namespace mozilla {
+
+class MOZ_RAII ProcThreadAttributes final {
+  struct ProcThreadAttributeListDeleter {
+    void operator()(LPPROC_THREAD_ATTRIBUTE_LIST aList) {
+      ::DeleteProcThreadAttributeList(aList);
+      delete[] reinterpret_cast<char*>(aList);
+    }
+  };
+
+  using ProcThreadAttributeListPtr =
+      UniquePtr<_PROC_THREAD_ATTRIBUTE_LIST, ProcThreadAttributeListDeleter>;
+
+ public:
+  ProcThreadAttributes() : mMitigationPolicies(0) {}
+
+  ~ProcThreadAttributes() = default;
+
+  ProcThreadAttributes(const ProcThreadAttributes&) = delete;
+  ProcThreadAttributes(ProcThreadAttributes&&) = delete;
+  ProcThreadAttributes& operator=(const ProcThreadAttributes&) = delete;
+  ProcThreadAttributes& operator=(ProcThreadAttributes&&) = delete;
+
+  void AddMitigationPolicy(DWORD64 aPolicy) { mMitigationPolicies |= aPolicy; }
+
+  bool AddInheritableHandle(HANDLE aHandle) {
+    DWORD type = ::GetFileType(aHandle);
+    if (type != FILE_TYPE_DISK && type != FILE_TYPE_PIPE) {
+      return false;
+    }
+
+    if (!::SetHandleInformation(aHandle, HANDLE_FLAG_INHERIT,
+                                HANDLE_FLAG_INHERIT)) {
+      return false;
+    }
+
+    return mInheritableHandles.append(aHandle);
+  }
+
+  template <size_t N>
+  bool AddInheritableHandles(HANDLE (&aHandles)[N]) {
+    bool ok = true;
+    for (auto handle : aHandles) {
+      ok &= AddInheritableHandle(handle);
+    }
+
+    return ok;
+  }
+
+  bool HasMitigationPolicies() const { return !!mMitigationPolicies; }
+
+  bool HasInheritableHandles() const { return !mInheritableHandles.empty(); }
+
+  /**
+   * @return false if the STARTUPINFOEXW::lpAttributeList was set to null
+   *               as expected based on the state of |this|;
+   *         true  if the STARTUPINFOEXW::lpAttributeList was set to
+   *               non-null;
+   */
+  LauncherResult<bool> AssignTo(STARTUPINFOEXW& aSiex) {
+    ZeroMemory(&aSiex, sizeof(STARTUPINFOEXW));
+
+    // We'll set the size to sizeof(STARTUPINFOW) until we determine whether the
+    // extended fields will be used.
+    aSiex.StartupInfo.cb = sizeof(STARTUPINFOW);
+
+    DWORD numAttributes = 0;
+    if (HasMitigationPolicies()) {
+      ++numAttributes;
+    }
+
+    if (HasInheritableHandles()) {
+      ++numAttributes;
+    }
+
+    if (!numAttributes) {
+      return false;
+    }
+
+    SIZE_T listSize = 0;
+    if (!::InitializeProcThreadAttributeList(nullptr, numAttributes, 0,
+                                             &listSize)) {
+      DWORD err = ::GetLastError();
+      if (err != ERROR_INSUFFICIENT_BUFFER) {
+        return LAUNCHER_ERROR_FROM_WIN32(err);
+      }
+    }
+
+    auto buf = MakeUnique<char[]>(listSize);
+
+    LPPROC_THREAD_ATTRIBUTE_LIST tmpList =
+        reinterpret_cast<LPPROC_THREAD_ATTRIBUTE_LIST>(buf.get());
+
+    if (!::InitializeProcThreadAttributeList(tmpList, numAttributes, 0,
+                                             &listSize)) {
+      return LAUNCHER_ERROR_FROM_LAST();
+    }
+
+    // Transfer buf to a ProcThreadAttributeListPtr - now that the list is
+    // initialized, we are no longer dealing with a plain old char array. We
+    // must now deinitialize the attribute list before deallocating the
+    // underlying buffer.
+    ProcThreadAttributeListPtr attrList(
+        reinterpret_cast<LPPROC_THREAD_ATTRIBUTE_LIST>(buf.release()));
+
+    if (mMitigationPolicies) {
+      if (!::UpdateProcThreadAttribute(
+              attrList.get(), 0, PROC_THREAD_ATTRIBUTE_MITIGATION_POLICY,
+              &mMitigationPolicies, sizeof(mMitigationPolicies), nullptr,
+              nullptr)) {
+        return LAUNCHER_ERROR_FROM_LAST();
+      }
+    }
+
+    if (!mInheritableHandles.empty()) {
+      if (!::UpdateProcThreadAttribute(
+              attrList.get(), 0, PROC_THREAD_ATTRIBUTE_HANDLE_LIST,
+              mInheritableHandles.begin(),
+              mInheritableHandles.length() * sizeof(HANDLE), nullptr,
+              nullptr)) {
+        return LAUNCHER_ERROR_FROM_LAST();
+      }
+    }
+
+    mAttrList = std::move(attrList);
+    aSiex.lpAttributeList = mAttrList.get();
+    aSiex.StartupInfo.cb = sizeof(STARTUPINFOEXW);
+    return true;
+  }
+
+ private:
+  static const uint32_t kNumInline = 3;  // Inline storage for the std handles
+
+  DWORD64 mMitigationPolicies;
+  Vector<HANDLE, kNumInline> mInheritableHandles;
+  ProcThreadAttributeListPtr mAttrList;
+};
+
+}  // namespace mozilla
+
+#endif  // mozilla_ProcThreadAttributes_h
diff --git a/browser/app/winlauncher/SameBinary.h b/browser/app/winlauncher/SameBinary.h
new file mode 100644
index 0000000000..e8fa78600f
--- /dev/null
+++ b/browser/app/winlauncher/SameBinary.h
@@ -0,0 +1,146 @@
+/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* vim: set ts=8 sts=2 et sw=2 tw=80: */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at https://mozilla.org/MPL/2.0/. */
+
+#ifndef mozilla_SameBinary_h
+#define mozilla_SameBinary_h
+
+#include "mozilla/WinHeaderOnlyUtils.h"
+#include "mozilla/NativeNt.h"
+#include "nsWindowsHelpers.h"
+
+namespace mozilla {
+
+class ProcessImagePath final {
+  PathType mType;
+  LauncherVoidResult mLastError;
+
+  // Using a larger buffer because an NT path may exceed MAX_PATH.
+  WCHAR mPathBuffer[(MAX_PATH * 2) + 1];
+
+ public:
+  // Initialize with an NT path string of a given process handle
+  explicit ProcessImagePath(const nsAutoHandle& aProcess)
+      : mType(PathType::eNtPath), mLastError(Ok()) {
+    DWORD len = mozilla::ArrayLength(mPathBuffer);
+    if (!::QueryFullProcessImageNameW(aProcess.get(), PROCESS_NAME_NATIVE,
+                                      mPathBuffer, &len)) {
+      mLastError = LAUNCHER_ERROR_FROM_LAST();
+      return;
+    }
+  }
+
+  // Initizlize with a DOS path string of a given imagebase address
+  explicit ProcessImagePath(HMODULE aImageBase)
+      : mType(PathType::eDosPath), mLastError(Ok()) {
+    DWORD len = ::GetModuleFileNameW(aImageBase, mPathBuffer,
+                                     mozilla::ArrayLength(mPathBuffer));
+    if (!len || len == mozilla::ArrayLength(mPathBuffer)) {
+      mLastError = LAUNCHER_ERROR_FROM_LAST();
+      return;
+    }
+  }
+
+  bool IsError() const { return mLastError.isErr(); }
+
+  const WindowsErrorType& GetError() const { return mLastError.inspectErr(); }
+
+  FileUniqueId GetId() const { return FileUniqueId(mPathBuffer, mType); }
+
+  bool CompareNtPaths(const ProcessImagePath& aOther) const {
+    if (mLastError.isErr() || aOther.mLastError.isErr() ||
+        mType != PathType::eNtPath || aOther.mType != PathType::eNtPath) {
+      return false;
+    }
+
+    UNICODE_STRING path1, path2;
+    ::RtlInitUnicodeString(&path1, mPathBuffer);
+    ::RtlInitUnicodeString(&path2, aOther.mPathBuffer);
+    return !!::RtlEqualUnicodeString(&path1, &path2, TRUE);
+  }
+};
+
+enum class ImageFileCompareOption {
+  Default,
+  CompareNtPathsOnly,
+};
+
+static inline mozilla::LauncherResult<bool> IsSameBinaryAsParentProcess(
+    ImageFileCompareOption aOption = ImageFileCompareOption::Default) {
+  mozilla::LauncherResult<DWORD> parentPid = mozilla::nt::GetParentProcessId();
+  if (parentPid.isErr()) {
+    return parentPid.propagateErr();
+  }
+
+  nsAutoHandle parentProcess(::OpenProcess(PROCESS_QUERY_LIMITED_INFORMATION,
+                                           FALSE, parentPid.unwrap()));
+  if (!parentProcess.get()) {
+    DWORD err = ::GetLastError();
+    if (err == ERROR_INVALID_PARAMETER || err == ERROR_ACCESS_DENIED) {
+      // In the ERROR_INVALID_PARAMETER case, the process identified by
+      // parentPid has already exited. This is a common case when the parent
+      // process is not Firefox, thus we should return false instead of erroring
+      // out.
+      // The ERROR_ACCESS_DENIED case can happen when the parent process is
+      // something that we don't have permission to query. For example, we may
+      // encounter this when Firefox is launched by the Windows Task Scheduler.
+      return false;
+    }
+
+    return LAUNCHER_ERROR_FROM_WIN32(err);
+  }
+
+  ProcessImagePath parentExe(parentProcess);
+  if (parentExe.IsError()) {
+    return ::mozilla::Err(parentExe.GetError());
+  }
+
+  if (aOption == ImageFileCompareOption::Default) {
+    bool skipFileIdComparison = false;
+
+    FileUniqueId id1 = parentExe.GetId();
+    if (id1.IsError()) {
+      // We saw a number of Win7 users failed to call NtOpenFile with
+      // STATUS_OBJECT_PATH_NOT_FOUND for an unknown reason.  In this
+      // particular case, we fall back to the logic to compare NT path
+      // strings instead of a file id which will not fail because we don't
+      // need to open a file handle.
+#if !defined(STATUS_OBJECT_PATH_NOT_FOUND)
+      constexpr NTSTATUS STATUS_OBJECT_PATH_NOT_FOUND = 0xc000003a;
+#endif
+      const LauncherError& err = id1.GetError();
+      if (err.mError !=
+          WindowsError::FromNtStatus(STATUS_OBJECT_PATH_NOT_FOUND)) {
+        return ::mozilla::Err(err);
+      }
+
+      skipFileIdComparison = true;
+    }
+
+    if (!skipFileIdComparison) {
+      ProcessImagePath ourExe(nullptr);
+      if (ourExe.IsError()) {
+        return ::mozilla::Err(ourExe.GetError());
+      }
+
+      FileUniqueId id2 = ourExe.GetId();
+      if (id2.IsError()) {
+        return ::mozilla::Err(id2.GetError());
+      }
+      return id1 == id2;
+    }
+  }
+
+  nsAutoHandle ourProcess(::GetCurrentProcess());
+  ProcessImagePath ourExeNt(ourProcess);
+  if (ourExeNt.IsError()) {
+    return ::mozilla::Err(ourExeNt.GetError());
+  }
+  return parentExe.CompareNtPaths(ourExeNt);
+}
+
+}  // namespace mozilla
+
+#endif  //  mozilla_SameBinary_h
diff --git a/browser/app/winlauncher/freestanding/CheckForCaller.h b/browser/app/winlauncher/freestanding/CheckForCaller.h
new file mode 100644
index 0000000000..799d16cd1f
--- /dev/null
+++ b/browser/app/winlauncher/freestanding/CheckForCaller.h
@@ -0,0 +1,36 @@
+/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* vim: set ts=8 sts=2 et sw=2 tw=80: */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at https://mozilla.org/MPL/2.0/. */
+
+#ifndef mozilla_freestanding_CheckForCaller_h
+#define mozilla_freestanding_CheckForCaller_h
+
+namespace mozilla {
+
+#if defined(_MSC_VER)
+#  include <intrin.h>
+#  pragma intrinsic(_ReturnAddress)
+#  define RETURN_ADDRESS() _ReturnAddress()
+#elif defined(__GNUC__) || defined(__clang__)
+#  define RETURN_ADDRESS() \
+    __builtin_extract_return_addr(__builtin_return_address(0))
+#endif
+
+template <int N>
+bool CheckForAddress(void* aReturnAddress, const wchar_t (&aName)[N]) {
+  HMODULE callingModule;
+  if (!::GetModuleHandleExW(GET_MODULE_HANDLE_EX_FLAG_FROM_ADDRESS |
+                                GET_MODULE_HANDLE_EX_FLAG_UNCHANGED_REFCOUNT,
+                            reinterpret_cast<LPCWSTR>(aReturnAddress),
+                            &callingModule)) {
+    return false;
+  }
+
+  return callingModule && callingModule == ::GetModuleHandleW(aName);
+}
+
+}  // namespace mozilla
+
+#endif  // mozilla_freestanding_CheckForCaller_h
diff --git a/browser/app/winlauncher/freestanding/DllBlocklist.cpp b/browser/app/winlauncher/freestanding/DllBlocklist.cpp
new file mode 100644
index 0000000000..105ab6d918
--- /dev/null
+++ b/browser/app/winlauncher/freestanding/DllBlocklist.cpp
@@ -0,0 +1,641 @@
+/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* vim: set ts=8 sts=2 et sw=2 tw=80: */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at https://mozilla.org/MPL/2.0/. */
+
+#include "mozilla/ArrayUtils.h"
+#include "mozilla/Attributes.h"
+#include "mozilla/BinarySearch.h"
+#include "mozilla/NativeNt.h"
+#include "mozilla/Types.h"
+#include "mozilla/WindowsDllBlocklist.h"
+
+#include "CrashAnnotations.h"
+#include "DllBlocklist.h"
+#include "LoaderPrivateAPI.h"
+#include "ModuleLoadFrame.h"
+#include "SharedSection.h"
+
+using mozilla::DllBlockInfoFlags;
+
+#define DLL_BLOCKLIST_ENTRY(name, ...) \
+  {MOZ_LITERAL_UNICODE_STRING(L##name), __VA_ARGS__},
+#define DLL_BLOCKLIST_STRING_TYPE UNICODE_STRING
+
+#if defined(MOZ_LAUNCHER_PROCESS) || defined(NIGHTLY_BUILD)
+#  include "mozilla/WindowsDllBlocklistLauncherDefs.h"
+#else
+#  include "mozilla/WindowsDllBlocklistCommon.h"
+DLL_BLOCKLIST_DEFINITIONS_BEGIN
+DLL_BLOCKLIST_DEFINITIONS_END
+#endif
+
+using WritableBuffer = mozilla::glue::detail::WritableBuffer<1024>;
+
+class MOZ_STATIC_CLASS MOZ_TRIVIAL_CTOR_DTOR NativeNtBlockSet final {
+  struct NativeNtBlockSetEntry {
+    NativeNtBlockSetEntry() = default;
+    ~NativeNtBlockSetEntry() = default;
+    NativeNtBlockSetEntry(const UNICODE_STRING& aName, uint64_t aVersion,
+                          NativeNtBlockSetEntry* aNext)
+        : mName(aName), mVersion(aVersion), mNext(aNext) {}
+    UNICODE_STRING mName;
+    uint64_t mVersion;
+    NativeNtBlockSetEntry* mNext;
+  };
+
+ public:
+  // Constructor and destructor MUST be trivial
+  constexpr NativeNtBlockSet() : mFirstEntry(nullptr) {}
+  ~NativeNtBlockSet() = default;
+
+  void Add(const UNICODE_STRING& aName, uint64_t aVersion);
+  void Write(WritableBuffer& buffer);
+
+ private:
+  static NativeNtBlockSetEntry* NewEntry(const UNICODE_STRING& aName,
+                                         uint64_t aVersion,
+                                         NativeNtBlockSetEntry* aNextEntry);
+
+ private:
+  NativeNtBlockSetEntry* mFirstEntry;
+  mozilla::nt::SRWLock mLock;
+};
+
+NativeNtBlockSet::NativeNtBlockSetEntry* NativeNtBlockSet::NewEntry(
+    const UNICODE_STRING& aName, uint64_t aVersion,
+    NativeNtBlockSet::NativeNtBlockSetEntry* aNextEntry) {
+  return mozilla::freestanding::RtlNew<NativeNtBlockSetEntry>(aName, aVersion,
+                                                              aNextEntry);
+}
+
+void NativeNtBlockSet::Add(const UNICODE_STRING& aName, uint64_t aVersion) {
+  mozilla::nt::AutoExclusiveLock lock(mLock);
+
+  for (NativeNtBlockSetEntry* entry = mFirstEntry; entry;
+       entry = entry->mNext) {
+    if (::RtlEqualUnicodeString(&entry->mName, &aName, TRUE) &&
+        aVersion == entry->mVersion) {
+      return;
+    }
+  }
+
+  // Not present, add it
+  NativeNtBlockSetEntry* newEntry = NewEntry(aName, aVersion, mFirstEntry);
+  if (newEntry) {
+    mFirstEntry = newEntry;
+  }
+}
+
+void NativeNtBlockSet::Write(WritableBuffer& aBuffer) {
+  // NB: If this function is called, it is long after kernel32 is initialized,
+  // so it is safe to use Win32 calls here.
+  char buf[MAX_PATH];
+
+  // It would be nicer to use RAII here. However, its destructor
+  // might not run if an exception occurs, in which case we would never release
+  // the lock (MSVC warns about this possibility). So we acquire and release
+  // manually.
+  ::AcquireSRWLockExclusive(&mLock);
+
+  MOZ_SEH_TRY {
+    for (auto entry = mFirstEntry; entry; entry = entry->mNext) {
+      int convOk = ::WideCharToMultiByte(CP_UTF8, 0, entry->mName.Buffer,
+                                         entry->mName.Length / sizeof(wchar_t),
+                                         buf, sizeof(buf), nullptr, nullptr);
+      if (!convOk) {
+        continue;
+      }
+
+      // write name[,v.v.v.v];
+      aBuffer.Write(buf, convOk);
+
+      if (entry->mVersion != DllBlockInfo::ALL_VERSIONS) {
+        aBuffer.Write(",", 1);
+        uint16_t parts[4];
+        parts[0] = entry->mVersion >> 48;
+        parts[1] = (entry->mVersion >> 32) & 0xFFFF;
+        parts[2] = (entry->mVersion >> 16) & 0xFFFF;
+        parts[3] = entry->mVersion & 0xFFFF;
+        for (size_t p = 0; p < mozilla::ArrayLength(parts); ++p) {
+          _ltoa_s(parts[p], buf, sizeof(buf), 10);
+          aBuffer.Write(buf, strlen(buf));
+          if (p != mozilla::ArrayLength(parts) - 1) {
+            aBuffer.Write(".", 1);
+          }
+        }
+      }
+      aBuffer.Write(";", 1);
+    }
+  }
+  MOZ_SEH_EXCEPT(EXCEPTION_EXECUTE_HANDLER) {}
+
+  ::ReleaseSRWLockExclusive(&mLock);
+}
+
+static NativeNtBlockSet gBlockSet;
+
+extern "C" void MOZ_EXPORT
+NativeNtBlockSet_Write(CrashReporter::AnnotationWriter& aWriter) {
+  WritableBuffer buffer;
+  gBlockSet.Write(buffer);
+  aWriter.Write(CrashReporter::Annotation::BlockedDllList, buffer.Data(),
+                buffer.Length());
+}
+
+enum class BlockAction {
+  // Allow the DLL to be loaded.
+  Allow,
+  // Substitute in a different DLL to be loaded instead of this one?
+  // This is intended to be used for Layered Service Providers, which
+  // cannot be blocked in the normal way. Note that this doesn't seem
+  // to be actually implemented right now, and no entries in the blocklist
+  // use it.
+  SubstituteLSP,
+  // There was an error in determining whether we should block this DLL.
+  // It will be blocked.
+  Error,
+  // Block the DLL from loading.
+  Deny,
+  // Effectively block the DLL from loading by redirecting its DllMain
+  // to a stub version. This is needed for DLLs that add themselves to
+  // the executable's Import Table, since failing to load would mean the
+  // executable would fail to launch.
+  NoOpEntryPoint,
+};
+
+static BlockAction CheckBlockInfo(const DllBlockInfo* aInfo,
+                                  const mozilla::nt::PEHeaders& aHeaders,
+                                  uint64_t& aVersion) {
+  aVersion = DllBlockInfo::ALL_VERSIONS;
+
+  if (aInfo->mFlags & (DllBlockInfoFlags::BLOCK_WIN8_AND_OLDER |
+                       DllBlockInfoFlags::BLOCK_WIN7_AND_OLDER)) {
+    RTL_OSVERSIONINFOW osv = {sizeof(osv)};
+    NTSTATUS ntStatus = ::RtlGetVersion(&osv);
+    if (!NT_SUCCESS(ntStatus)) {
+      return BlockAction::Error;
+    }
+
+    if ((aInfo->mFlags & DllBlockInfoFlags::BLOCK_WIN8_AND_OLDER) &&
+        (osv.dwMajorVersion > 6 ||
+         (osv.dwMajorVersion == 6 && osv.dwMinorVersion > 2))) {
+      return BlockAction::Allow;
+    }
+
+    if ((aInfo->mFlags & DllBlockInfoFlags::BLOCK_WIN7_AND_OLDER) &&
+        (osv.dwMajorVersion > 6 ||
+         (osv.dwMajorVersion == 6 && osv.dwMinorVersion > 1))) {
+      return BlockAction::Allow;
+    }
+  }
+
+  if ((aInfo->mFlags & DllBlockInfoFlags::CHILD_PROCESSES_ONLY) &&
+      !(gBlocklistInitFlags & eDllBlocklistInitFlagIsChildProcess)) {
+    return BlockAction::Allow;
+  }
+
+  if ((aInfo->mFlags & DllBlockInfoFlags::UTILITY_PROCESSES_ONLY) &&
+      !(gBlocklistInitFlags & eDllBlocklistInitFlagIsUtilityProcess)) {
+    return BlockAction::Allow;
+  }
+
+  if ((aInfo->mFlags & DllBlockInfoFlags::SOCKET_PROCESSES_ONLY) &&
+      !(gBlocklistInitFlags & eDllBlocklistInitFlagIsSocketProcess)) {
+    return BlockAction::Allow;
+  }
+
+  if ((aInfo->mFlags & DllBlockInfoFlags::GPU_PROCESSES_ONLY) &&
+      !(gBlocklistInitFlags & eDllBlocklistInitFlagIsGPUProcess)) {
+    return BlockAction::Allow;
+  }
+
+  if ((aInfo->mFlags & DllBlockInfoFlags::BROWSER_PROCESS_ONLY) &&
+      (gBlocklistInitFlags & eDllBlocklistInitFlagIsChildProcess)) {
+    return BlockAction::Allow;
+  }
+
+  if ((aInfo->mFlags & DllBlockInfoFlags::GMPLUGIN_PROCESSES_ONLY) &&
+      !(gBlocklistInitFlags & eDllBlocklistInitFlagIsGMPluginProcess)) {
+    return BlockAction::Allow;
+  }
+
+  if (aInfo->mMaxVersion == DllBlockInfo::ALL_VERSIONS) {
+    return BlockAction::Deny;
+  }
+
+  if (!aHeaders) {
+    return BlockAction::Error;
+  }
+
+  if (aInfo->mFlags & DllBlockInfoFlags::USE_TIMESTAMP) {
+    DWORD timestamp;
+    if (!aHeaders.GetTimeStamp(timestamp)) {
+      return BlockAction::Error;
+    }
+
+    if (timestamp > aInfo->mMaxVersion) {
+      return BlockAction::Allow;
+    }
+
+    return BlockAction::Deny;
+  }
+
+  // Else we try to get the file version information. Note that we don't have
+  // access to GetFileVersionInfo* APIs.
+  if (!aHeaders.GetVersionInfo(aVersion)) {
+    return BlockAction::Error;
+  }
+
+  if (aInfo->IsVersionBlocked(aVersion)) {
+    return BlockAction::Deny;
+  }
+
+  return BlockAction::Allow;
+}
+
+static BOOL WINAPI NoOp_DllMain(HINSTANCE, DWORD, LPVOID) { return TRUE; }
+
+// This helper function checks whether a given module is included
+// in the executable's Import Table.  Because an injected module's
+// DllMain may revert the Import Table to the original state, we parse
+// the Import Table every time a module is loaded without creating a cache.
+static bool IsInjectedDependentModule(
+    const UNICODE_STRING& aModuleLeafName,
+    mozilla::freestanding::Kernel32ExportsSolver& aK32Exports) {
+  mozilla::nt::PEHeaders exeHeaders(aK32Exports.mGetModuleHandleW(nullptr));
+  if (!exeHeaders || !exeHeaders.IsImportDirectoryTampered()) {
+    // If no tampering is detected, no need to enumerate the Import Table.
+    return false;
+  }
+
+  bool isDependent = false;
+  exeHeaders.EnumImportChunks(
+      [&isDependent, &aModuleLeafName, &exeHeaders](const char* aDepModule) {
+        // If |aDepModule| is within the PE image, it's not an injected module
+        // but a legitimate dependent module.
+        if (isDependent || exeHeaders.IsWithinImage(aDepModule)) {
+          return;
+        }
+
+        UNICODE_STRING depModuleLeafName;
+        mozilla::nt::AllocatedUnicodeString depModuleName(aDepModule);
+        mozilla::nt::GetLeafName(&depModuleLeafName, depModuleName);
+        isDependent = (::RtlCompareUnicodeString(
+                           &aModuleLeafName, &depModuleLeafName, TRUE) == 0);
+      });
+  return isDependent;
+}
+
+// Allowing a module to be loaded but detour the entrypoint to NoOp_DllMain
+// so that the module has no chance to interact with our code.  We need this
+// technique to safely block a module injected by IAT tampering because
+// blocking such a module makes a process fail to launch.
+static bool RedirectToNoOpEntryPoint(
+    const mozilla::nt::PEHeaders& aModule,
+    mozilla::freestanding::Kernel32ExportsSolver& aK32Exports) {
+  mozilla::interceptor::WindowsDllEntryPointInterceptor interceptor(
+      aK32Exports);
+  if (!interceptor.Set(aModule, NoOp_DllMain)) {
+    return false;
+  }
+
+  return true;
+}
+
+static BlockAction DetermineBlockAction(
+    const UNICODE_STRING& aLeafName, void* aBaseAddress,
+    mozilla::freestanding::Kernel32ExportsSolver* aK32Exports) {
+  if (mozilla::nt::Contains12DigitHexString(aLeafName) ||
+      mozilla::nt::IsFileNameAtLeast16HexDigits(aLeafName)) {
+    return BlockAction::Deny;
+  }
+
+  mozilla::nt::PEHeaders headers(aBaseAddress);
+  DWORD checksum = 0;
+  DWORD timestamp = 0;
+  DWORD imageSize = 0;
+  uint64_t version = 0;
+
+  // Block some malicious DLLs known for crashing our process (bug 1841751),
+  // based on matching the combination of version number + timestamp + image
+  // size. We further reduce the chances of collision with legit DLLs by
+  // checking for a checksum of 0 and the absence of debug information, both of
+  // which are unusual for production-ready DLLs.
+  if (headers.GetCheckSum(checksum) && checksum == 0 && !headers.GetPdbInfo() &&
+      headers.GetTimeStamp(timestamp)) {
+    struct KnownMaliciousCombination {
+      uint64_t mVersion;
+      uint32_t mTimestamp;
+      uint32_t mImageSize;
+    };
+    const KnownMaliciousCombination instances[]{
+        // 1.0.0.26638
+        {0x000100000000680e, 0x570B8A90, 0x62000},
+        // 1.0.0.26793
+        {0x00010000000068a9, 0x572B4CE4, 0x62000},
+        // 1.0.0.27567
+        {0x0001000000006baf, 0x57A725AC, 0x61000},
+        // 1.0.0.29915
+        {0x00010000000074db, 0x5A115D81, 0x5D000},
+        // 1.0.0.31122
+        {0x0001000000007992, 0x5CFF88B8, 0x5D000}};
+
+    // We iterate over timestamps, because they are unique and it is a quick
+    // field to fetch
+    for (const auto& instance : instances) {
+      if (instance.mTimestamp == timestamp) {
+        // Only fetch other fields in case we have a match. Then, we can exit
+        // the loop.
+        if (headers.GetImageSize(imageSize) &&
+            instance.mImageSize == imageSize &&
+            headers.GetVersionInfo(version) && instance.mVersion == version) {
+          return BlockAction::Deny;
+        }
+        break;
+      }
+    }
+  }
+
+  DECLARE_POINTER_TO_FIRST_DLL_BLOCKLIST_ENTRY(info);
+  DECLARE_DLL_BLOCKLIST_NUM_ENTRIES(infoNumEntries);
+
+  mozilla::freestanding::DllBlockInfoComparator comp(aLeafName);
+
+  size_t match = LowerBound(info, 0, infoNumEntries, comp);
+  bool builtinListHasLowerBound = match != infoNumEntries;
+  const DllBlockInfo* entry = nullptr;
+  BlockAction checkResult = BlockAction::Allow;
+  if (builtinListHasLowerBound) {
+    // There may be multiple entries on the list. Since LowerBound() returns
+    // the first entry that matches (if there are any matches),
+    // search forward from there.
+    while (match < infoNumEntries && (comp(info[match]) == 0)) {
+      entry = &info[match];
+      checkResult = CheckBlockInfo(entry, headers, version);
+      if (checkResult != BlockAction::Allow) {
+        break;
+      }
+      ++match;
+    }
+  }
+  mozilla::DebugOnly<bool> blockedByDynamicBlocklist = false;
+  // Make sure we handle a case that older versions are blocked by the static
+  // list, but the dynamic list blocks all versions.
+  if (checkResult == BlockAction::Allow) {
+    if (!mozilla::freestanding::gSharedSection.IsDisabled()) {
+      entry = mozilla::freestanding::gSharedSection.SearchBlocklist(aLeafName);
+      if (entry) {
+        checkResult = CheckBlockInfo(entry, headers, version);
+        blockedByDynamicBlocklist = checkResult != BlockAction::Allow;
+      }
+    }
+  }
+  if (checkResult == BlockAction::Allow) {
+    return BlockAction::Allow;
+  }
+
+  gBlockSet.Add(entry->mName, version);
+
+  if ((entry->mFlags & DllBlockInfoFlags::REDIRECT_TO_NOOP_ENTRYPOINT) &&
+      aK32Exports && RedirectToNoOpEntryPoint(headers, *aK32Exports)) {
+    MOZ_ASSERT(!blockedByDynamicBlocklist, "dynamic blocklist has redirect?");
+    return BlockAction::NoOpEntryPoint;
+  }
+
+  return checkResult;
+}
+
+namespace mozilla {
+namespace freestanding {
+
+CrossProcessDllInterceptor::FuncHookType<LdrLoadDllPtr> stub_LdrLoadDll;
+
+NTSTATUS NTAPI patched_LdrLoadDll(PWCHAR aDllPath, PULONG aFlags,
+                                  PUNICODE_STRING aDllName,
+                                  PHANDLE aOutHandle) {
+  ModuleLoadFrame frame(aDllName);
+
+  NTSTATUS ntStatus = stub_LdrLoadDll(aDllPath, aFlags, aDllName, aOutHandle);
+
+  return frame.SetLoadStatus(ntStatus, aOutHandle);
+}
+
+CrossProcessDllInterceptor::FuncHookType<NtMapViewOfSectionPtr>
+    stub_NtMapViewOfSection;
+
+// All the code for patched_NtMapViewOfSection that relies on checked stack
+// buffers (e.g. mbi, sectionFileName) should be put in this helper function
+// (see bug 1733532).
+MOZ_NEVER_INLINE NTSTATUS AfterMapViewOfExecutableSection(
+    HANDLE aProcess, PVOID* aBaseAddress, NTSTATUS aStubStatus) {
+  // We don't care about mappings that aren't MEM_IMAGE.
+  MEMORY_BASIC_INFORMATION mbi;
+  NTSTATUS ntStatus =
+      ::NtQueryVirtualMemory(aProcess, *aBaseAddress, MemoryBasicInformation,
+                             &mbi, sizeof(mbi), nullptr);
+  if (!NT_SUCCESS(ntStatus)) {
+    ::NtUnmapViewOfSection(aProcess, *aBaseAddress);
+    return STATUS_ACCESS_DENIED;
+  }
+  if (!(mbi.Type & MEM_IMAGE)) {
+    return aStubStatus;
+  }
+
+  // Get the section name
+  nt::MemorySectionNameBuf sectionFileName(
+      gLoaderPrivateAPI.GetSectionNameBuffer(*aBaseAddress));
+  if (sectionFileName.IsEmpty()) {
+    ::NtUnmapViewOfSection(aProcess, *aBaseAddress);
+    return STATUS_ACCESS_DENIED;
+  }
+
+  // Find the leaf name
+  UNICODE_STRING leafOnStack;
+  nt::GetLeafName(&leafOnStack, sectionFileName);
+
+  bool isInjectedDependent = false;
+  const UNICODE_STRING k32Name = MOZ_LITERAL_UNICODE_STRING(L"kernel32.dll");
+  Kernel32ExportsSolver* k32Exports = nullptr;
+  BlockAction blockAction;
+  // Trying to get the Kernel32Exports while loading kernel32.dll causes Firefox
+  // to crash. (but only during a profile-guided optimization run, oddly) We
+  // know we're never going to block kernel32.dll, so skip all this
+  if (::RtlCompareUnicodeString(&k32Name, &leafOnStack, TRUE) == 0) {
+    blockAction = BlockAction::Allow;
+  } else {
+    auto noSharedSectionReset{SharedSection::AutoNoReset()};
+    k32Exports = gSharedSection.GetKernel32Exports();
+    // Small optimization: Since loading a dependent module does not involve
+    // LdrLoadDll, we know isInjectedDependent is false if we hold a top frame.
+    if (k32Exports && !ModuleLoadFrame::ExistsTopFrame()) {
+      // Note that if a module is dependent but not injected, this means that
+      // the executable built against it, and it should be signed by Mozilla
+      // or Microsoft, so we don't need to worry about adding it to the list
+      // for CIG. (and users won't be able to block it) So the only special
+      // case here is a dependent module that has been injected.
+      isInjectedDependent = IsInjectedDependentModule(leafOnStack, *k32Exports);
+    }
+
+    if (isInjectedDependent) {
+      // Add an NT dv\path to the shared section so that a sandbox process can
+      // use it to bypass CIG.  In a sandbox process, this addition fails
+      // because we cannot map the section to a writable region, but it's
+      // ignorable because the paths have been added by the browser process.
+      Unused << SharedSection::AddDependentModule(sectionFileName);
+
+      bool attemptToBlockViaRedirect;
+#if defined(NIGHTLY_BUILD)
+      // We enable automatic DLL blocking only in Nightly for now
+      // because it caused a compat issue (bug 1682304 and 1704373).
+      attemptToBlockViaRedirect = true;
+      // We will set blockAction below in the if (attemptToBlockViaRedirect)
+      // block, but I guess the compiler isn't smart enough to figure
+      // that out and complains about an uninitialized variable :-(
+      blockAction = BlockAction::NoOpEntryPoint;
+#else
+      // Check blocklist
+      blockAction =
+          DetermineBlockAction(leafOnStack, *aBaseAddress, k32Exports);
+      // If we were going to block this dependent module, try redirection
+      // instead of blocking it, since blocking it would cause the .exe not to
+      // launch.
+      // Note tht Deny and Error both end up blocking the module in a
+      // straightforward way, so those are the cases in which we need
+      // to redirect instead.
+      attemptToBlockViaRedirect =
+          blockAction == BlockAction::Deny || blockAction == BlockAction::Error;
+#endif
+      if (attemptToBlockViaRedirect) {
+        // For a dependent module, try redirection instead of blocking it.
+        // If we fail, we reluctantly allow the module for free.
+        mozilla::nt::PEHeaders headers(*aBaseAddress);
+        blockAction = RedirectToNoOpEntryPoint(headers, *k32Exports)
+                          ? BlockAction::NoOpEntryPoint
+                          : BlockAction::Allow;
+      }
+    } else {
+      // Check blocklist
+      blockAction =
+          DetermineBlockAction(leafOnStack, *aBaseAddress, k32Exports);
+    }
+  }
+
+  ModuleLoadInfo::Status loadStatus = ModuleLoadInfo::Status::Blocked;
+
+  switch (blockAction) {
+    case BlockAction::Allow:
+      loadStatus = ModuleLoadInfo::Status::Loaded;
+      break;
+
+    case BlockAction::NoOpEntryPoint:
+      loadStatus = ModuleLoadInfo::Status::Redirected;
+      break;
+
+    case BlockAction::SubstituteLSP:
+      // The process heap needs to be available here because
+      // NotifyLSPSubstitutionRequired below copies a given string into
+      // the heap. We use a soft assert here, assuming LSP load always
+      // occurs after the heap is initialized.
+      MOZ_ASSERT(nt::RtlGetProcessHeap());
+
+      // Notify patched_LdrLoadDll that it will be necessary to perform
+      // a substitution before returning.
+      ModuleLoadFrame::NotifyLSPSubstitutionRequired(&leafOnStack);
+      break;
+
+    default:
+      break;
+  }
+
+  if (nt::RtlGetProcessHeap()) {
+    ModuleLoadFrame::NotifySectionMap(
+        nt::AllocatedUnicodeString(sectionFileName), *aBaseAddress, aStubStatus,
+        loadStatus, isInjectedDependent);
+  }
+
+  if (loadStatus == ModuleLoadInfo::Status::Loaded ||
+      loadStatus == ModuleLoadInfo::Status::Redirected) {
+    return aStubStatus;
+  }
+
+  ::NtUnmapViewOfSection(aProcess, *aBaseAddress);
+  return STATUS_ACCESS_DENIED;
+}
+
+// To preserve compatibility with third-parties, calling into this function
+// must not use checked stack buffers when reached through Thread32Next (see
+// bug 1733532). Hence this function is declared as MOZ_NO_STACK_PROTECTOR.
+// Ideally, all code relying on stack buffers should be put in the dedicated
+// helper function AfterMapViewOfExecutableImageSection, which does not have
+// the MOZ_NO_STACK_PROTECTOR attribute. The obi variable below is an
+// exception to this rule, as it is required to collect the information that
+// lets us decide whether we really need to go through the helper function.
+NTSTATUS NTAPI patched_NtMapViewOfSection(
+    HANDLE aSection, HANDLE aProcess, PVOID* aBaseAddress, ULONG_PTR aZeroBits,
+    SIZE_T aCommitSize, PLARGE_INTEGER aSectionOffset, PSIZE_T aViewSize,
+    SECTION_INHERIT aInheritDisposition, ULONG aAllocationType,
+    ULONG aProtectionFlags) {
+  // Save off the values currently in the out-pointers for later restoration if
+  // we decide not to permit this mapping.
+  auto const rollback =
+      [
+          // Avoid taking a reference to the stack frame, mostly out of
+          // paranoia. (The values of `aBaseAddress` et al. may have been
+          // crafted to point to our return address anyway...)
+          =,
+          // `NtMapViewOfSection` itself is mildly robust to invalid pointers;
+          // we can't easily do that, but we can at least check for `nullptr`.
+          baseAddress = aBaseAddress ? *aBaseAddress : nullptr,
+          sectionOffset = aSectionOffset ? *aSectionOffset : LARGE_INTEGER{},
+          viewSize = aViewSize ? *aViewSize : 0]() {
+        if (aBaseAddress) *aBaseAddress = baseAddress;
+        if (aSectionOffset) *aSectionOffset = sectionOffset;
+        if (aViewSize) *aViewSize = viewSize;
+      };
+
+  // We always map first, then we check for additional info after.
+  NTSTATUS stubStatus = stub_NtMapViewOfSection(
+      aSection, aProcess, aBaseAddress, aZeroBits, aCommitSize, aSectionOffset,
+      aViewSize, aInheritDisposition, aAllocationType, aProtectionFlags);
+  if (!NT_SUCCESS(stubStatus)) {
+    return stubStatus;
+  }
+
+  if (aProcess != nt::kCurrentProcess) {
+    // We're only interested in mapping for the current process.
+    return stubStatus;
+  }
+
+  PUBLIC_OBJECT_BASIC_INFORMATION obi;
+  NTSTATUS ntStatus = ::NtQueryObject(aSection, ObjectBasicInformation, &obi,
+                                      sizeof(obi), nullptr);
+  if (!NT_SUCCESS(ntStatus)) {
+    ::NtUnmapViewOfSection(aProcess, *aBaseAddress);
+    rollback();
+    return STATUS_ACCESS_DENIED;
+  }
+
+  // We don't care about sections for which the permission to map executable
+  // views was not asked at creation time. This early exit path is notably
+  // taken for:
+  //  - calls to LoadLibraryExW using LOAD_LIBRARY_AS_DATAFILE or
+  //    LOAD_LIBRARY_AS_IMAGE_RESOURCE (bug 1842088), thus allowing us to load
+  //    blocked DLLs for analysis without executing them;
+  //  - calls to Thread32Next (bug 1733532), thus avoiding the helper function
+  //    with stack cookie checks.
+  if (!(obi.GrantedAccess & SECTION_MAP_EXECUTE)) {
+    return stubStatus;
+  }
+
+  NTSTATUS rv =
+      AfterMapViewOfExecutableSection(aProcess, aBaseAddress, stubStatus);
+  if (FAILED(rv)) {
+    rollback();
+  }
+  return rv;
+}
+
+}  // namespace freestanding
+}  // namespace mozilla
diff --git a/browser/app/winlauncher/freestanding/DllBlocklist.h b/browser/app/winlauncher/freestanding/DllBlocklist.h
new file mode 100644
index 0000000000..c0ae1d255f
--- /dev/null
+++ b/browser/app/winlauncher/freestanding/DllBlocklist.h
@@ -0,0 +1,39 @@
+/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* vim: set ts=8 sts=2 et sw=2 tw=80: */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at https://mozilla.org/MPL/2.0/. */
+
+#ifndef mozilla_freestanding_DllBlocklist_h
+#define mozilla_freestanding_DllBlocklist_h
+
+#include "mozilla/Attributes.h"
+#include "mozilla/NativeNt.h"
+#include "nsWindowsDllInterceptor.h"
+#include "mozilla/WinHeaderOnlyUtils.h"
+
+namespace mozilla {
+namespace freestanding {
+
+NTSTATUS NTAPI patched_LdrLoadDll(PWCHAR aDllPath, PULONG aFlags,
+                                  PUNICODE_STRING aDllName, PHANDLE aOutHandle);
+
+MOZ_NO_STACK_PROTECTOR NTSTATUS NTAPI patched_NtMapViewOfSection(
+    HANDLE aSection, HANDLE aProcess, PVOID* aBaseAddress, ULONG_PTR aZeroBits,
+    SIZE_T aCommitSize, PLARGE_INTEGER aSectionOffset, PSIZE_T aViewSize,
+    SECTION_INHERIT aInheritDisposition, ULONG aAllocationType,
+    ULONG aProtectionFlags);
+
+using LdrLoadDllPtr = decltype(&::LdrLoadDll);
+
+extern CrossProcessDllInterceptor::FuncHookType<LdrLoadDllPtr> stub_LdrLoadDll;
+
+using NtMapViewOfSectionPtr = decltype(&::NtMapViewOfSection);
+
+extern CrossProcessDllInterceptor::FuncHookType<NtMapViewOfSectionPtr>
+    stub_NtMapViewOfSection;
+
+}  // namespace freestanding
+}  // namespace mozilla
+
+#endif  // mozilla_freestanding_DllBlocklist_h
diff --git a/browser/app/winlauncher/freestanding/Freestanding.h b/browser/app/winlauncher/freestanding/Freestanding.h
new file mode 100644
index 0000000000..03999f231e
--- /dev/null
+++ b/browser/app/winlauncher/freestanding/Freestanding.h
@@ -0,0 +1,67 @@
+/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* vim: set ts=8 sts=2 et sw=2 tw=80: */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at https://mozilla.org/MPL/2.0/. */
+
+#ifndef mozilla_freestanding_Freestanding_h
+#define mozilla_freestanding_Freestanding_h
+
+/**
+ * This header is automatically included in all source code residing in the
+ * /browser/app/winlauncher/freestanding directory.
+ */
+
+#if defined(__STDC_HOSTED__) && __STDC_HOSTED__ == 1
+#  error "This header should only be included by freestanding code"
+#endif  // defined(__STDC_HOSTED__) && __STDC_HOSTED__ == 1
+
+#define MOZ_USE_LAUNCHER_ERROR
+#include "mozilla/NativeNt.h"
+
+namespace mozilla {
+namespace freestanding {
+
+/**
+ * Since this library is the only part of firefox.exe that needs special
+ * treatment with respect to the heap, we implement |RtlNew| and |RtlDelete|
+ * to be used instead of |new| and |delete| for any heap allocations inside
+ * the freestanding library.
+ */
+template <typename T, typename... Args>
+inline static T* RtlNew(Args&&... aArgs) {
+  HANDLE processHeap = nt::RtlGetProcessHeap();
+  if (!processHeap) {
+    // Handle the case where the process heap is not initialized because
+    // passing nullptr to RtlAllocateHeap crashes the process.
+    return nullptr;
+  }
+
+  void* ptr = ::RtlAllocateHeap(processHeap, 0, sizeof(T));
+  if (!ptr) {
+    return nullptr;
+  }
+
+  return new (ptr) T(std::forward<Args>(aArgs)...);
+}
+
+template <typename T>
+inline static void RtlDelete(T* aPtr) {
+  if (!aPtr) {
+    return;
+  }
+
+  aPtr->~T();
+  ::RtlFreeHeap(nt::RtlGetProcessHeap(), 0, aPtr);
+}
+
+}  // namespace freestanding
+}  // namespace mozilla
+
+// Initialization code for all statically-allocated data in freestanding is
+// placed into a separate section. This allows us to initialize any
+// freestanding statics without needing to initialize everything else in this
+// binary.
+#pragma init_seg(".freestd$g")
+
+#endif  // mozilla_freestanding_Freestanding_h
diff --git a/browser/app/winlauncher/freestanding/LoaderPrivateAPI.cpp b/browser/app/winlauncher/freestanding/LoaderPrivateAPI.cpp
new file mode 100644
index 0000000000..266f2ec6a4
--- /dev/null
+++ b/browser/app/winlauncher/freestanding/LoaderPrivateAPI.cpp
@@ -0,0 +1,293 @@
+/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* vim: set ts=8 sts=2 et sw=2 tw=80: */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at https://mozilla.org/MPL/2.0/. */
+
+#include "LoaderPrivateAPI.h"
+
+#include "mozilla/Assertions.h"
+#include "mozilla/Types.h"
+#include "mozilla/Unused.h"
+#include "../DllBlocklistInit.h"
+#include "../ErrorHandler.h"
+#include "SharedSection.h"
+
+using GlobalInitializerFn = void(__cdecl*)(void);
+
+// Allocation of static initialization section for the freestanding library
+#pragma section(".freestd$a", read)
+__declspec(allocate(".freestd$a")) static const GlobalInitializerFn
+    FreeStdStart = reinterpret_cast<GlobalInitializerFn>(0);
+
+#pragma section(".freestd$z", read)
+__declspec(allocate(".freestd$z")) static const GlobalInitializerFn FreeStdEnd =
+    reinterpret_cast<GlobalInitializerFn>(0);
+
+namespace mozilla {
+namespace freestanding {
+
+static RTL_RUN_ONCE gRunOnce = RTL_RUN_ONCE_INIT;
+
+// The contract for this callback is identical to the InitOnceCallback from
+// Win32 land; we're just using ntdll-layer types instead.
+static ULONG NTAPI DoOneTimeInit(PRTL_RUN_ONCE aRunOnce, PVOID aParameter,
+                                 PVOID* aContext) {
+  // Invoke every static initializer in the .freestd section
+  const GlobalInitializerFn* cur = &FreeStdStart + 1;
+  while (cur < &FreeStdEnd) {
+    if (*cur) {
+      (*cur)();
+    }
+
+    ++cur;
+  }
+
+  return TRUE;
+}
+
+/**
+ * This observer is only used until the mozglue observer connects itself.
+ * All we do here is accumulate the module loads into a vector.
+ * As soon as mozglue connects, we call |Forward| on mozglue's LoaderObserver
+ * to pass our vector on for further processing. This object then becomes
+ * defunct.
+ */
+class MOZ_ONLY_USED_TO_AVOID_STATIC_CONSTRUCTORS DefaultLoaderObserver final
+    : public nt::LoaderObserver {
+ public:
+  constexpr DefaultLoaderObserver() : mModuleLoads(nullptr) {}
+
+  void OnBeginDllLoad(void** aContext,
+                      PCUNICODE_STRING aRequestedDllName) final {}
+  bool SubstituteForLSP(PCUNICODE_STRING aLSPLeafName,
+                        PHANDLE aOutHandle) final {
+    return false;
+  }
+  void OnEndDllLoad(void* aContext, NTSTATUS aNtStatus,
+                    ModuleLoadInfo&& aModuleLoadInfo) final;
+  void Forward(nt::LoaderObserver* aNext) final;
+  void OnForward(ModuleLoadInfoVec&& aInfo) final {
+    MOZ_ASSERT_UNREACHABLE("Not valid in freestanding::DefaultLoaderObserver");
+  }
+
+ private:
+  mozilla::nt::SRWLock mLock;
+  ModuleLoadInfoVec* mModuleLoads;
+};
+
+class MOZ_ONLY_USED_TO_AVOID_STATIC_CONSTRUCTORS LoaderPrivateAPIImp final
+    : public LoaderPrivateAPI {
+ public:
+  // LoaderAPI
+  ModuleLoadInfo ConstructAndNotifyBeginDllLoad(
+      void** aContext, PCUNICODE_STRING aRequestedDllName) final;
+  bool SubstituteForLSP(PCUNICODE_STRING aLSPLeafName,
+                        PHANDLE aOutHandle) final;
+  void NotifyEndDllLoad(void* aContext, NTSTATUS aLoadNtStatus,
+                        ModuleLoadInfo&& aModuleLoadInfo) final;
+  nt::AllocatedUnicodeString GetSectionName(void* aSectionAddr) final;
+  nt::LoaderAPI::InitDllBlocklistOOPFnPtr GetDllBlocklistInitFn() final;
+  nt::LoaderAPI::HandleLauncherErrorFnPtr GetHandleLauncherErrorFn() final;
+  nt::SharedSection* GetSharedSection() final;
+
+  // LoaderPrivateAPI
+  void NotifyBeginDllLoad(void** aContext,
+                          PCUNICODE_STRING aRequestedDllName) final;
+  void NotifyBeginDllLoad(ModuleLoadInfo& aModuleLoadInfo, void** aContext,
+                          PCUNICODE_STRING aRequestedDllName) final;
+  void SetObserver(nt::LoaderObserver* aNewObserver) final;
+  bool IsDefaultObserver() const final;
+  nt::MemorySectionNameBuf GetSectionNameBuffer(void* aSectionAddr) final;
+};
+
+static void Init() {
+  DebugOnly<NTSTATUS> ntStatus =
+      ::RtlRunOnceExecuteOnce(&gRunOnce, &DoOneTimeInit, nullptr, nullptr);
+  MOZ_ASSERT(NT_SUCCESS(ntStatus));
+}
+
+}  // namespace freestanding
+}  // namespace mozilla
+
+static mozilla::freestanding::DefaultLoaderObserver gDefaultObserver;
+static mozilla::freestanding::LoaderPrivateAPIImp gPrivateAPI;
+
+static mozilla::nt::SRWLock gLoaderObserverLock;
+static mozilla::nt::LoaderObserver* gLoaderObserver = &gDefaultObserver;
+
+namespace mozilla {
+namespace freestanding {
+
+LoaderPrivateAPI& gLoaderPrivateAPI = gPrivateAPI;
+
+void DefaultLoaderObserver::OnEndDllLoad(void* aContext, NTSTATUS aNtStatus,
+                                         ModuleLoadInfo&& aModuleLoadInfo) {
+  // If the DLL load failed, or if the DLL was loaded by a previous request
+  // and thus was not mapped by this request, we do not save the ModuleLoadInfo.
+  if (!NT_SUCCESS(aNtStatus) || !aModuleLoadInfo.WasMapped()) {
+    return;
+  }
+
+  nt::AutoExclusiveLock lock(mLock);
+  if (!mModuleLoads) {
+    mModuleLoads = RtlNew<ModuleLoadInfoVec>();
+    if (!mModuleLoads) {
+      return;
+    }
+  }
+
+  Unused << mModuleLoads->emplaceBack(
+      std::forward<ModuleLoadInfo>(aModuleLoadInfo));
+}
+
+/**
+ * Pass mModuleLoads's data off to |aNext| for further processing.
+ */
+void DefaultLoaderObserver::Forward(nt::LoaderObserver* aNext) {
+  MOZ_ASSERT(aNext);
+  if (!aNext) {
+    return;
+  }
+
+  ModuleLoadInfoVec* moduleLoads = nullptr;
+
+  {  // Scope for lock
+    nt::AutoExclusiveLock lock(mLock);
+    moduleLoads = mModuleLoads;
+    mModuleLoads = nullptr;
+  }
+
+  if (!moduleLoads) {
+    return;
+  }
+
+  aNext->OnForward(std::move(*moduleLoads));
+  RtlDelete(moduleLoads);
+}
+
+ModuleLoadInfo LoaderPrivateAPIImp::ConstructAndNotifyBeginDllLoad(
+    void** aContext, PCUNICODE_STRING aRequestedDllName) {
+  ModuleLoadInfo loadInfo(aRequestedDllName);
+
+  NotifyBeginDllLoad(loadInfo, aContext, aRequestedDllName);
+
+  return loadInfo;
+}
+
+bool LoaderPrivateAPIImp::SubstituteForLSP(PCUNICODE_STRING aLSPLeafName,
+                                           PHANDLE aOutHandle) {
+  nt::AutoSharedLock lock(gLoaderObserverLock);
+  return gLoaderObserver->SubstituteForLSP(aLSPLeafName, aOutHandle);
+}
+
+void LoaderPrivateAPIImp::NotifyEndDllLoad(void* aContext,
+                                           NTSTATUS aLoadNtStatus,
+                                           ModuleLoadInfo&& aModuleLoadInfo) {
+  aModuleLoadInfo.SetEndLoadTimeStamp();
+
+  if (NT_SUCCESS(aLoadNtStatus)) {
+    aModuleLoadInfo.CaptureBacktrace();
+  }
+
+  nt::AutoSharedLock lock(gLoaderObserverLock);
+
+  // We need to notify the observer that the DLL load has ended even when
+  // |aLoadNtStatus| indicates a failure. This is to ensure that any resources
+  // acquired by the observer during OnBeginDllLoad are cleaned up.
+  gLoaderObserver->OnEndDllLoad(aContext, aLoadNtStatus,
+                                std::move(aModuleLoadInfo));
+}
+
+nt::AllocatedUnicodeString LoaderPrivateAPIImp::GetSectionName(
+    void* aSectionAddr) {
+  const HANDLE kCurrentProcess = reinterpret_cast<HANDLE>(-1);
+
+  nt::MemorySectionNameBuf buf;
+  NTSTATUS ntStatus =
+      ::NtQueryVirtualMemory(kCurrentProcess, aSectionAddr, MemorySectionName,
+                             &buf, sizeof(buf), nullptr);
+  if (!NT_SUCCESS(ntStatus)) {
+    return nt::AllocatedUnicodeString();
+  }
+
+  return nt::AllocatedUnicodeString(&buf.mSectionFileName);
+}
+
+nt::LoaderAPI::InitDllBlocklistOOPFnPtr
+LoaderPrivateAPIImp::GetDllBlocklistInitFn() {
+  return &InitializeDllBlocklistOOP;
+}
+
+nt::LoaderAPI::HandleLauncherErrorFnPtr
+LoaderPrivateAPIImp::GetHandleLauncherErrorFn() {
+  return &HandleLauncherError;
+}
+
+nt::SharedSection* LoaderPrivateAPIImp::GetSharedSection() {
+  return &gSharedSection;
+}
+
+nt::MemorySectionNameBuf LoaderPrivateAPIImp::GetSectionNameBuffer(
+    void* aSectionAddr) {
+  const HANDLE kCurrentProcess = reinterpret_cast<HANDLE>(-1);
+
+  nt::MemorySectionNameBuf buf;
+  NTSTATUS ntStatus =
+      ::NtQueryVirtualMemory(kCurrentProcess, aSectionAddr, MemorySectionName,
+                             &buf, sizeof(buf), nullptr);
+  if (!NT_SUCCESS(ntStatus)) {
+    return nt::MemorySectionNameBuf();
+  }
+
+  return buf;
+}
+
+void LoaderPrivateAPIImp::NotifyBeginDllLoad(
+    void** aContext, PCUNICODE_STRING aRequestedDllName) {
+  nt::AutoSharedLock lock(gLoaderObserverLock);
+  gLoaderObserver->OnBeginDllLoad(aContext, aRequestedDllName);
+}
+
+void LoaderPrivateAPIImp::NotifyBeginDllLoad(
+    ModuleLoadInfo& aModuleLoadInfo, void** aContext,
+    PCUNICODE_STRING aRequestedDllName) {
+  NotifyBeginDllLoad(aContext, aRequestedDllName);
+  aModuleLoadInfo.SetBeginLoadTimeStamp();
+}
+
+void LoaderPrivateAPIImp::SetObserver(nt::LoaderObserver* aNewObserver) {
+  nt::LoaderObserver* prevLoaderObserver = nullptr;
+
+  nt::AutoExclusiveLock lock(gLoaderObserverLock);
+
+  MOZ_ASSERT(aNewObserver);
+  if (!aNewObserver) {
+    // This is unlikely, but we always want a valid observer, so use the
+    // gDefaultObserver if necessary.
+    gLoaderObserver = &gDefaultObserver;
+    return;
+  }
+
+  prevLoaderObserver = gLoaderObserver;
+  gLoaderObserver = aNewObserver;
+
+  MOZ_ASSERT(prevLoaderObserver);
+  if (!prevLoaderObserver) {
+    return;
+  }
+
+  // Now that we have a new observer, the previous observer must forward its
+  // data on to the new observer for processing.
+  prevLoaderObserver->Forward(aNewObserver);
+}
+
+bool LoaderPrivateAPIImp::IsDefaultObserver() const {
+  nt::AutoSharedLock lock(gLoaderObserverLock);
+  return gLoaderObserver == &gDefaultObserver;
+}
+
+void EnsureInitialized() { Init(); }
+
+}  // namespace freestanding
+}  // namespace mozilla
diff --git a/browser/app/winlauncher/freestanding/LoaderPrivateAPI.h b/browser/app/winlauncher/freestanding/LoaderPrivateAPI.h
new file mode 100644
index 0000000000..f21472d689
--- /dev/null
+++ b/browser/app/winlauncher/freestanding/LoaderPrivateAPI.h
@@ -0,0 +1,62 @@
+/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* vim: set ts=8 sts=2 et sw=2 tw=80: */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at https://mozilla.org/MPL/2.0/. */
+
+#ifndef mozilla_freestanding_LoaderPrivateAPI_h
+#define mozilla_freestanding_LoaderPrivateAPI_h
+
+#include "mozilla/LoaderAPIInterfaces.h"
+
+namespace mozilla {
+namespace freestanding {
+
+/**
+ * This part of the API is available only to the launcher process.
+ */
+class NS_NO_VTABLE LoaderPrivateAPI : public nt::LoaderAPI {
+ public:
+  /**
+   * Notify the nt::LoaderObserver that a module load is beginning
+   */
+  virtual void NotifyBeginDllLoad(void** aContext,
+                                  PCUNICODE_STRING aRequestedDllName) = 0;
+  /**
+   * Notify the nt::LoaderObserver that a module load is beginning and set the
+   * begin load timestamp on |aModuleLoadInfo|.
+   */
+  virtual void NotifyBeginDllLoad(ModuleLoadInfo& aModuleLoadInfo,
+                                  void** aContext,
+                                  PCUNICODE_STRING aRequestedDllName) = 0;
+
+  /**
+   * Set a new nt::LoaderObserver to be used by the launcher process. NB: This
+   * should only happen while the current process is still single-threaded!
+   */
+  virtual void SetObserver(nt::LoaderObserver* aNewObserver) = 0;
+
+  /**
+   * Returns true if the current nt::LoaderObserver is the launcher process's
+   * built-in observer.
+   */
+  virtual bool IsDefaultObserver() const = 0;
+
+  /**
+   * Returns the name of a given mapped section address as a local instance of
+   * nt::MemorySectionNameBuf.  This does not involve heap allocation.
+   */
+  virtual nt::MemorySectionNameBuf GetSectionNameBuffer(void* aSectionAddr) = 0;
+};
+
+/**
+ * Ensures that any statics in the freestanding library are initialized.
+ */
+void EnsureInitialized();
+
+extern LoaderPrivateAPI& gLoaderPrivateAPI;
+
+}  // namespace freestanding
+}  // namespace mozilla
+
+#endif  // mozilla_freestanding_LoaderPrivateAPI_h
diff --git a/browser/app/winlauncher/freestanding/ModuleLoadFrame.cpp b/browser/app/winlauncher/freestanding/ModuleLoadFrame.cpp
new file mode 100644
index 0000000000..3aa043b8c7
--- /dev/null
+++ b/browser/app/winlauncher/freestanding/ModuleLoadFrame.cpp
@@ -0,0 +1,144 @@
+/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* vim: set ts=8 sts=2 et sw=2 tw=80: */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at https://mozilla.org/MPL/2.0/. */
+
+#include "ModuleLoadFrame.h"
+
+#include "LoaderPrivateAPI.h"
+
+namespace mozilla {
+namespace freestanding {
+
+ModuleLoadFrame::ModuleLoadFrame(PCUNICODE_STRING aRequestedDllName)
+    : mPrev(sTopFrame.get()),
+      mContext(nullptr),
+      mLSPSubstitutionRequired(false),
+      mLoadNtStatus(STATUS_UNSUCCESSFUL),
+      mLoadInfo(aRequestedDllName) {
+  EnsureInitialized();
+  sTopFrame.set(this);
+
+  gLoaderPrivateAPI.NotifyBeginDllLoad(mLoadInfo, &mContext, aRequestedDllName);
+}
+
+ModuleLoadFrame::ModuleLoadFrame(nt::AllocatedUnicodeString&& aSectionName,
+                                 const void* aMapBaseAddr, NTSTATUS aNtStatus,
+                                 ModuleLoadInfo::Status aLoadStatus,
+                                 bool aIsDependent)
+    : mPrev(sTopFrame.get()),
+      mContext(nullptr),
+      mLSPSubstitutionRequired(false),
+      mLoadNtStatus(aNtStatus),
+      mLoadInfo(std::move(aSectionName), aMapBaseAddr, aLoadStatus,
+                aIsDependent) {
+  sTopFrame.set(this);
+
+  gLoaderPrivateAPI.NotifyBeginDllLoad(&mContext, mLoadInfo.mSectionName);
+}
+
+ModuleLoadFrame::~ModuleLoadFrame() {
+  gLoaderPrivateAPI.NotifyEndDllLoad(mContext, mLoadNtStatus,
+                                     std::move(mLoadInfo));
+  sTopFrame.set(mPrev);
+}
+
+/* static */
+void ModuleLoadFrame::NotifyLSPSubstitutionRequired(
+    PCUNICODE_STRING aLeafName) {
+  ModuleLoadFrame* topFrame = sTopFrame.get();
+  if (!topFrame) {
+    return;
+  }
+
+  topFrame->SetLSPSubstitutionRequired(aLeafName);
+}
+
+void ModuleLoadFrame::SetLSPSubstitutionRequired(PCUNICODE_STRING aLeafName) {
+  MOZ_ASSERT(!mLoadInfo.mBaseAddr);
+  if (mLoadInfo.mBaseAddr) {
+    // If mBaseAddr is not null then |this| has already seen a module load. This
+    // should not be the case for a LSP substitution, so we bail.
+    return;
+  }
+
+  // Save aLeafName, as it will be used by SetLoadStatus when invoking
+  // SubstituteForLSP
+  mLoadInfo.mRequestedDllName = aLeafName;
+  mLSPSubstitutionRequired = true;
+}
+
+/* static */
+void ModuleLoadFrame::NotifySectionMap(
+    nt::AllocatedUnicodeString&& aSectionName, const void* aMapBaseAddr,
+    NTSTATUS aMapNtStatus, ModuleLoadInfo::Status aLoadStatus,
+    bool aIsDependent) {
+  ModuleLoadFrame* topFrame = sTopFrame.get();
+  if (!topFrame) {
+    // The only time that this data is useful is during initial mapping of
+    // the executable's dependent DLLs. If mozglue is present then
+    // IsDefaultObserver will return false, indicating that we are beyond
+    // initial process startup.
+    if (gLoaderPrivateAPI.IsDefaultObserver()) {
+      OnBareSectionMap(std::move(aSectionName), aMapBaseAddr, aMapNtStatus,
+                       aLoadStatus, aIsDependent);
+    }
+    return;
+  }
+
+  topFrame->OnSectionMap(std::move(aSectionName), aMapBaseAddr, aMapNtStatus,
+                         aLoadStatus, aIsDependent);
+}
+
+/* static */
+bool ModuleLoadFrame::ExistsTopFrame() { return !!sTopFrame.get(); }
+
+void ModuleLoadFrame::OnSectionMap(nt::AllocatedUnicodeString&& aSectionName,
+                                   const void* aMapBaseAddr,
+                                   NTSTATUS aMapNtStatus,
+                                   ModuleLoadInfo::Status aLoadStatus,
+                                   bool aIsDependent) {
+  if (mLoadInfo.mBaseAddr) {
+    // If mBaseAddr is not null then |this| has already seen a module load. This
+    // means that we are witnessing a bare section map.
+    OnBareSectionMap(std::move(aSectionName), aMapBaseAddr, aMapNtStatus,
+                     aLoadStatus, aIsDependent);
+    return;
+  }
+
+  mLoadInfo.mSectionName = std::move(aSectionName);
+  mLoadInfo.mBaseAddr = aMapBaseAddr;
+  mLoadInfo.mStatus = aLoadStatus;
+}
+
+/* static */
+void ModuleLoadFrame::OnBareSectionMap(
+    nt::AllocatedUnicodeString&& aSectionName, const void* aMapBaseAddr,
+    NTSTATUS aMapNtStatus, ModuleLoadInfo::Status aLoadStatus,
+    bool aIsDependent) {
+  // We call the special constructor variant that is used for bare mappings.
+  ModuleLoadFrame frame(std::move(aSectionName), aMapBaseAddr, aMapNtStatus,
+                        aLoadStatus, aIsDependent);
+}
+
+NTSTATUS ModuleLoadFrame::SetLoadStatus(NTSTATUS aNtStatus,
+                                        PHANDLE aOutHandle) {
+  mLoadNtStatus = aNtStatus;
+
+  if (!mLSPSubstitutionRequired) {
+    return aNtStatus;
+  }
+
+  if (!gLoaderPrivateAPI.SubstituteForLSP(mLoadInfo.mRequestedDllName,
+                                          aOutHandle)) {
+    return aNtStatus;
+  }
+
+  return STATUS_SUCCESS;
+}
+
+SafeThreadLocal<ModuleLoadFrame*> ModuleLoadFrame::sTopFrame;
+
+}  // namespace freestanding
+}  // namespace mozilla
diff --git a/browser/app/winlauncher/freestanding/ModuleLoadFrame.h b/browser/app/winlauncher/freestanding/ModuleLoadFrame.h
new file mode 100644
index 0000000000..51a179db99
--- /dev/null
+++ b/browser/app/winlauncher/freestanding/ModuleLoadFrame.h
@@ -0,0 +1,97 @@
+/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* vim: set ts=8 sts=2 et sw=2 tw=80: */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at https://mozilla.org/MPL/2.0/. */
+
+#ifndef mozilla_freestanding_ModuleLoadFrame_h
+#define mozilla_freestanding_ModuleLoadFrame_h
+
+#include "mozilla/LoaderAPIInterfaces.h"
+#include "mozilla/NativeNt.h"
+#include "mozilla/ThreadLocal.h"
+
+#include "SafeThreadLocal.h"
+
+namespace mozilla {
+namespace freestanding {
+
+/**
+ * This class holds information about a DLL load at a particular frame in the
+ * current thread's stack. Each instance adds itself to a thread-local linked
+ * list of ModuleLoadFrames, enabling us to query information about the
+ * previous module load on the stack.
+ */
+class MOZ_RAII ModuleLoadFrame final {
+ public:
+  /**
+   * This constructor is for use by the LdrLoadDll hook.
+   */
+  explicit ModuleLoadFrame(PCUNICODE_STRING aRequestedDllName);
+  ~ModuleLoadFrame();
+
+  static void NotifyLSPSubstitutionRequired(PCUNICODE_STRING aLeafName);
+
+  /**
+   * This static method is called by the NtMapViewOfSection hook.
+   */
+  static void NotifySectionMap(nt::AllocatedUnicodeString&& aSectionName,
+                               const void* aMapBaseAddr, NTSTATUS aMapNtStatus,
+                               ModuleLoadInfo::Status aLoadStatus,
+                               bool aIsDependent);
+  static bool ExistsTopFrame();
+
+  /**
+   * Called by the LdrLoadDll hook to indicate the status of the load and for
+   * us to provide a substitute output handle if necessary.
+   */
+  NTSTATUS SetLoadStatus(NTSTATUS aNtStatus, PHANDLE aOutHandle);
+
+  ModuleLoadFrame(const ModuleLoadFrame&) = delete;
+  ModuleLoadFrame(ModuleLoadFrame&&) = delete;
+  ModuleLoadFrame& operator=(const ModuleLoadFrame&) = delete;
+  ModuleLoadFrame& operator=(ModuleLoadFrame&&) = delete;
+
+ private:
+  /**
+   * Called by OnBareSectionMap to construct a frame for a bare load.
+   */
+  ModuleLoadFrame(nt::AllocatedUnicodeString&& aSectionName,
+                  const void* aMapBaseAddr, NTSTATUS aNtStatus,
+                  ModuleLoadInfo::Status aLoadStatus, bool aIsDependent);
+
+  void SetLSPSubstitutionRequired(PCUNICODE_STRING aLeafName);
+  void OnSectionMap(nt::AllocatedUnicodeString&& aSectionName,
+                    const void* aMapBaseAddr, NTSTATUS aMapNtStatus,
+                    ModuleLoadInfo::Status aLoadStatus, bool aIsDependent);
+
+  /**
+   * A "bare" section mapping is one that was mapped without the code passing
+   * through a call to ntdll!LdrLoadDll. This method is invoked when we detect
+   * that condition.
+   */
+  static void OnBareSectionMap(nt::AllocatedUnicodeString&& aSectionName,
+                               const void* aMapBaseAddr, NTSTATUS aMapNtStatus,
+                               ModuleLoadInfo::Status aLoadStatus,
+                               bool aIsDependent);
+
+ private:
+  // Link to the previous frame
+  ModuleLoadFrame* mPrev;
+  // Pointer to context managed by the nt::LoaderObserver implementation
+  void* mContext;
+  // Set to |true| when we need to block a WinSock LSP
+  bool mLSPSubstitutionRequired;
+  // NTSTATUS code from the |LdrLoadDll| call
+  NTSTATUS mLoadNtStatus;
+  // Telemetry information that will be forwarded to the nt::LoaderObserver
+  ModuleLoadInfo mLoadInfo;
+
+  // Head of the linked list
+  static SafeThreadLocal<ModuleLoadFrame*> sTopFrame;
+};
+
+}  // namespace freestanding
+}  // namespace mozilla
+
+#endif  // mozilla_freestanding_ModuleLoadFrame_h
diff --git a/browser/app/winlauncher/freestanding/SafeThreadLocal.h b/browser/app/winlauncher/freestanding/SafeThreadLocal.h
new file mode 100644
index 0000000000..e4b869f649
--- /dev/null
+++ b/browser/app/winlauncher/freestanding/SafeThreadLocal.h
@@ -0,0 +1,96 @@
+/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* vim: set ts=8 sts=2 et sw=2 tw=80: */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at https://mozilla.org/MPL/2.0/. */
+
+#ifndef mozilla_freestanding_SafeThreadLocal_h
+#define mozilla_freestanding_SafeThreadLocal_h
+
+#include <type_traits>
+
+#include "mozilla/NativeNt.h"
+#include "mozilla/ThreadLocal.h"
+
+namespace mozilla {
+namespace freestanding {
+
+// We cannot fall back to the Tls* APIs because kernel32 might not have been
+// loaded yet.
+#if defined(__MINGW32__) && !defined(HAVE_THREAD_TLS_KEYWORD)
+#  error "This code requires the compiler to have native TLS support"
+#endif  // defined(__MINGW32__) && !defined(HAVE_THREAD_TLS_KEYWORD)
+
+/**
+ * This class holds data as a thread-local variable, or as a global variable
+ * if the thread local storage is not initialized yet.  It should be safe
+ * because in that early stage we assume there is no more than a single thread.
+ */
+template <typename T>
+class SafeThreadLocal final {
+  static MOZ_THREAD_LOCAL(T) sThreadLocal;
+  static T sGlobal;
+  static bool sIsTlsUsed;
+
+  // In normal cases, TLS is always available and the class uses sThreadLocal
+  // without changing sMainThreadId.  So sMainThreadId is likely to be 0.
+  //
+  // If TLS is not available, we use sGlobal instead and update sMainThreadId
+  // so that that thread keeps using sGlobal even after TLS is initialized
+  // later.
+  static DWORD sMainThreadId;
+
+  // Need non-inline accessors to prevent the compiler from generating code
+  // accessing sThreadLocal before checking a condition.
+  MOZ_NEVER_INLINE static void SetGlobalValue(T aValue) { sGlobal = aValue; }
+  MOZ_NEVER_INLINE static T GetGlobalValue() { return sGlobal; }
+
+ public:
+  static void set(T aValue) {
+    static_assert(std::is_pointer_v<T>,
+                  "SafeThreadLocal must be used with a pointer");
+
+    if (sMainThreadId == mozilla::nt::RtlGetCurrentThreadId()) {
+      SetGlobalValue(aValue);
+    } else if (sIsTlsUsed) {
+      MOZ_ASSERT(mozilla::nt::RtlGetThreadLocalStoragePointer(),
+                 "Once TLS is used, TLS should be available till the end.");
+      sThreadLocal.set(aValue);
+    } else if (mozilla::nt::RtlGetThreadLocalStoragePointer()) {
+      sIsTlsUsed = true;
+      sThreadLocal.set(aValue);
+    } else {
+      MOZ_ASSERT(sMainThreadId == 0,
+                 "A second thread cannot be created before TLS is available.");
+      sMainThreadId = mozilla::nt::RtlGetCurrentThreadId();
+      SetGlobalValue(aValue);
+    }
+  }
+
+  static T get() {
+    if (sMainThreadId == mozilla::nt::RtlGetCurrentThreadId()) {
+      return GetGlobalValue();
+    } else if (sIsTlsUsed) {
+      return sThreadLocal.get();
+    }
+    return GetGlobalValue();
+  }
+};
+
+template <typename T>
+MOZ_THREAD_LOCAL(T)
+SafeThreadLocal<T>::sThreadLocal;
+
+template <typename T>
+T SafeThreadLocal<T>::sGlobal = nullptr;
+
+template <typename T>
+bool SafeThreadLocal<T>::sIsTlsUsed = false;
+
+template <typename T>
+DWORD SafeThreadLocal<T>::sMainThreadId = 0;
+
+}  // namespace freestanding
+}  // namespace mozilla
+
+#endif  // mozilla_freestanding_SafeThreadLocal_h
diff --git a/browser/app/winlauncher/freestanding/SharedSection.cpp b/browser/app/winlauncher/freestanding/SharedSection.cpp
new file mode 100644
index 0000000000..eab0074f60
--- /dev/null
+++ b/browser/app/winlauncher/freestanding/SharedSection.cpp
@@ -0,0 +1,368 @@
+/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* vim: set ts=8 sts=2 et sw=2 tw=80: */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at https://mozilla.org/MPL/2.0/. */
+
+#include "SharedSection.h"
+
+#include <algorithm>
+#include "CheckForCaller.h"
+#include "mozilla/BinarySearch.h"
+
+namespace {
+
+bool AddString(mozilla::Span<wchar_t> aBuffer, const UNICODE_STRING& aStr) {
+  size_t offsetElements = 0;
+  while (offsetElements < aBuffer.Length()) {
+    UNICODE_STRING uniStr;
+    ::RtlInitUnicodeString(&uniStr, aBuffer.data() + offsetElements);
+
+    if (uniStr.Length == 0) {
+      // Reached to the array's last item.
+      break;
+    }
+
+    if (::RtlCompareUnicodeString(&uniStr, &aStr, TRUE) == 0) {
+      // Already included in the array.
+      return true;
+    }
+
+    // Go to the next string.
+    offsetElements += uniStr.MaximumLength / sizeof(wchar_t);
+  }
+
+  // Ensure enough space including the last empty string at the end.
+  if (offsetElements * sizeof(wchar_t) + aStr.Length + sizeof(wchar_t) +
+          sizeof(wchar_t) >
+      aBuffer.LengthBytes()) {
+    return false;
+  }
+
+  auto newStr = aBuffer.Subspan(offsetElements);
+  memcpy(newStr.data(), aStr.Buffer, aStr.Length);
+  memset(newStr.data() + aStr.Length / sizeof(wchar_t), 0, sizeof(wchar_t));
+  return true;
+}
+
+}  // anonymous namespace
+
+namespace mozilla {
+namespace freestanding {
+
+SharedSection gSharedSection;
+
+// Why don't we use ::GetProcAddress?
+// If the export table of kernel32.dll is tampered in the current process,
+// we cannot transfer an RVA because the function pointed by the RVA may not
+// exist in a target process.
+// We can use ::GetProcAddress with additional check to detect tampering, but
+// FindExportAddressTableEntry fits perfectly here because it returns nullptr
+// if the target entry is outside the image, which means it's tampered or
+// forwarded to another DLL.
+#define INIT_FUNCTION(exports, name)                                 \
+  do {                                                               \
+    auto rvaToFunction = exports.FindExportAddressTableEntry(#name); \
+    if (!rvaToFunction) {                                            \
+      return;                                                        \
+    }                                                                \
+    m##name = reinterpret_cast<decltype(m##name)>(*rvaToFunction);   \
+  } while (0)
+
+#define RESOLVE_FUNCTION(base, name)             \
+  m##name = reinterpret_cast<decltype(m##name)>( \
+      base + reinterpret_cast<uintptr_t>(m##name))
+
+void Kernel32ExportsSolver::Init() {
+  interceptor::MMPolicyInProcess policy;
+  auto k32Exports = nt::PEExportSection<interceptor::MMPolicyInProcess>::Get(
+      ::GetModuleHandleW(L"kernel32.dll"), policy);
+  if (!k32Exports) {
+    return;
+  }
+
+  // Please make sure these functions are not forwarded to another DLL.
+  INIT_FUNCTION(k32Exports, FlushInstructionCache);
+  INIT_FUNCTION(k32Exports, GetModuleHandleW);
+  INIT_FUNCTION(k32Exports, GetSystemInfo);
+  INIT_FUNCTION(k32Exports, VirtualProtect);
+}
+
+bool Kernel32ExportsSolver::Resolve() {
+  const UNICODE_STRING k32Name = MOZ_LITERAL_UNICODE_STRING(L"kernel32.dll");
+
+  // We cannot use GetModuleHandleW because this code can be called
+  // before IAT is resolved.
+  auto k32Module = nt::GetModuleHandleFromLeafName(k32Name);
+  if (k32Module.isErr()) {
+    // Probably this is called before kernel32.dll is loaded.
+    return false;
+  }
+
+  uintptr_t k32Base =
+      nt::PEHeaders::HModuleToBaseAddr<uintptr_t>(k32Module.unwrap());
+
+  RESOLVE_FUNCTION(k32Base, FlushInstructionCache);
+  RESOLVE_FUNCTION(k32Base, GetModuleHandleW);
+  RESOLVE_FUNCTION(k32Base, GetSystemInfo);
+  RESOLVE_FUNCTION(k32Base, VirtualProtect);
+
+  return true;
+}
+
+HANDLE SharedSection::sSectionHandle = nullptr;
+SharedSection::Layout* SharedSection::sWriteCopyView = nullptr;
+RTL_RUN_ONCE SharedSection::sEnsureOnce = RTL_RUN_ONCE_INIT;
+nt::SRWLock SharedSection::sLock;
+
+void SharedSection::Reset(HANDLE aNewSectionObject) {
+  nt::AutoExclusiveLock{sLock};
+  if (sWriteCopyView) {
+    nt::AutoMappedView view(sWriteCopyView);
+    sWriteCopyView = nullptr;
+    ::RtlRunOnceInitialize(&sEnsureOnce);
+  }
+
+  if (sSectionHandle != aNewSectionObject) {
+    if (sSectionHandle) {
+      ::CloseHandle(sSectionHandle);
+    }
+    sSectionHandle = aNewSectionObject;
+  }
+}
+
+void SharedSection::ConvertToReadOnly() {
+  if (!sSectionHandle) {
+    return;
+  }
+
+  HANDLE readonlyHandle;
+  if (!::DuplicateHandle(nt::kCurrentProcess, sSectionHandle,
+                         nt::kCurrentProcess, &readonlyHandle, GENERIC_READ,
+                         FALSE, 0)) {
+    return;
+  }
+
+  Reset(readonlyHandle);
+}
+
+LauncherVoidResult SharedSection::Init() {
+  static_assert(
+      kSharedViewSize >= sizeof(Layout),
+      "kSharedViewSize is too small to represent SharedSection::Layout.");
+
+  HANDLE section =
+      ::CreateFileMappingW(INVALID_HANDLE_VALUE, nullptr, PAGE_READWRITE, 0,
+                           kSharedViewSize, nullptr);
+  if (!section) {
+    return LAUNCHER_ERROR_FROM_LAST();
+  }
+  Reset(section);
+
+  // The initial contents of the pages in a file mapping object backed by
+  // the operating system paging file are 0 (zero).  No need to zero it out
+  // ourselves.
+  // https://docs.microsoft.com/en-us/windows/win32/api/memoryapi/nf-memoryapi-createfilemappingw
+  nt::AutoMappedView writableView(sSectionHandle, PAGE_READWRITE);
+  if (!writableView) {
+    return LAUNCHER_ERROR_FROM_LAST();
+  }
+
+  Layout* view = writableView.as<Layout>();
+  view->mK32Exports.Init();
+  view->mState = Layout::State::kInitialized;
+  // Leave view->mDependentModulePathArrayStart to be zero to indicate
+  // we can add blocklist entries
+  return Ok();
+}
+
+LauncherVoidResult SharedSection::AddDependentModule(PCUNICODE_STRING aNtPath) {
+  nt::AutoMappedView writableView(sSectionHandle, PAGE_READWRITE);
+  if (!writableView) {
+    return LAUNCHER_ERROR_FROM_WIN32(::RtlGetLastWin32Error());
+  }
+
+  Layout* view = writableView.as<Layout>();
+  if (!view->mDependentModulePathArrayStart) {
+    // This is the first time AddDependentModule is called.  We set the initial
+    // value to mDependentModulePathArrayStart, which *closes* the blocklist.
+    // After this, AddBlocklist is no longer allowed.
+    view->mDependentModulePathArrayStart =
+        FIELD_OFFSET(Layout, mFirstBlockEntry) + sizeof(DllBlockInfo);
+  }
+
+  if (!AddString(view->GetDependentModules(), *aNtPath)) {
+    return LAUNCHER_ERROR_FROM_WIN32(ERROR_INSUFFICIENT_BUFFER);
+  }
+
+  return Ok();
+}
+
+LauncherVoidResult SharedSection::SetBlocklist(
+    const DynamicBlockList& aBlocklist, bool isDisabled) {
+  if (!aBlocklist.GetPayloadSize()) {
+    return Ok();
+  }
+
+  nt::AutoMappedView writableView(sSectionHandle, PAGE_READWRITE);
+  if (!writableView) {
+    return LAUNCHER_ERROR_FROM_WIN32(::RtlGetLastWin32Error());
+  }
+
+  Layout* view = writableView.as<Layout>();
+  if (view->mDependentModulePathArrayStart > 0) {
+    // If the dependent module array is already available, we must not update
+    // the blocklist.
+    return LAUNCHER_ERROR_FROM_WIN32(ERROR_INVALID_STATE);
+  }
+
+  view->mBlocklistIsDisabled = isDisabled ? 1 : 0;
+  uintptr_t bufferEnd = reinterpret_cast<uintptr_t>(view) + kSharedViewSize;
+  size_t bytesCopied = aBlocklist.CopyTo(
+      view->mFirstBlockEntry,
+      bufferEnd - reinterpret_cast<uintptr_t>(view->mFirstBlockEntry));
+  if (!bytesCopied) {
+    return LAUNCHER_ERROR_FROM_WIN32(ERROR_INSUFFICIENT_BUFFER);
+  }
+
+  // Setting mDependentModulePathArrayStart to a non-zero value means
+  // we no longer accept blocklist entries
+  // Just to be safe, make sure we don't overwrite mFirstBlockEntry even
+  // if there are no entries.
+  view->mDependentModulePathArrayStart =
+      FIELD_OFFSET(Layout, mFirstBlockEntry) +
+      std::max(bytesCopied, sizeof(DllBlockInfo));
+  return Ok();
+}
+
+/* static */
+ULONG NTAPI SharedSection::EnsureWriteCopyViewOnce(PRTL_RUN_ONCE, PVOID,
+                                                   PVOID*) {
+  if (!sWriteCopyView) {
+    nt::AutoMappedView view(sSectionHandle, PAGE_WRITECOPY);
+    if (!view) {
+      return TRUE;
+    }
+    sWriteCopyView = view.as<Layout>();
+    view.release();
+  }
+  return sWriteCopyView->Resolve() ? TRUE : FALSE;
+}
+
+SharedSection::Layout* SharedSection::EnsureWriteCopyView(
+    bool requireKernel32Exports /*= false */) {
+  ::RtlRunOnceExecuteOnce(&sEnsureOnce, &EnsureWriteCopyViewOnce, nullptr,
+                          nullptr);
+  if (!sWriteCopyView) {
+    return nullptr;
+  }
+  auto requiredState = requireKernel32Exports
+                           ? Layout::State::kResolved
+                           : Layout::State::kLoadedDynamicBlocklistEntries;
+  return sWriteCopyView->mState >= requiredState ? sWriteCopyView : nullptr;
+}
+
+bool SharedSection::Layout::Resolve() {
+  if (mState == State::kResolved) {
+    return true;
+  }
+  if (mState == State::kUninitialized) {
+    return false;
+  }
+  if (mState == State::kInitialized) {
+    if (!mNumBlockEntries) {
+      uintptr_t arrayBase = reinterpret_cast<uintptr_t>(mFirstBlockEntry);
+      uint32_t numEntries = 0;
+      for (DllBlockInfo* entry = mFirstBlockEntry;
+           entry->mName.Length && numEntries < GetMaxNumBlockEntries();
+           ++entry) {
+        entry->mName.Buffer = reinterpret_cast<wchar_t*>(
+            arrayBase + reinterpret_cast<uintptr_t>(entry->mName.Buffer));
+        ++numEntries;
+      }
+      mNumBlockEntries = numEntries;
+      // Sort by name so that we can binary-search
+      std::sort(mFirstBlockEntry, mFirstBlockEntry + mNumBlockEntries,
+                [](const DllBlockInfo& a, const DllBlockInfo& b) {
+                  return ::RtlCompareUnicodeString(&a.mName, &b.mName, TRUE) <
+                         0;
+                });
+    }
+    mState = State::kLoadedDynamicBlocklistEntries;
+  }
+
+  if (!mK32Exports.Resolve()) {
+    return false;
+  }
+
+  mState = State::kResolved;
+  return true;
+}
+
+Span<wchar_t> SharedSection::Layout::GetDependentModules() {
+  if (!mDependentModulePathArrayStart) {
+    return nullptr;
+  }
+  return Span<wchar_t>(
+      reinterpret_cast<wchar_t*>(reinterpret_cast<uintptr_t>(this) +
+                                 mDependentModulePathArrayStart),
+      (kSharedViewSize - mDependentModulePathArrayStart) / sizeof(wchar_t));
+}
+
+bool SharedSection::Layout::IsDisabled() const {
+  return !!mBlocklistIsDisabled;
+}
+
+const DllBlockInfo* SharedSection::Layout::SearchBlocklist(
+    const UNICODE_STRING& aLeafName) const {
+  MOZ_ASSERT(mState >= State::kLoadedDynamicBlocklistEntries);
+  DllBlockInfoComparator comp(aLeafName);
+  size_t match;
+  if (!BinarySearchIf(mFirstBlockEntry, 0, mNumBlockEntries, comp, &match)) {
+    return nullptr;
+  }
+  return &mFirstBlockEntry[match];
+}
+
+Kernel32ExportsSolver* SharedSection::GetKernel32Exports() {
+  Layout* writeCopyView = EnsureWriteCopyView(true);
+  return writeCopyView ? &writeCopyView->mK32Exports : nullptr;
+}
+
+Span<const wchar_t> SharedSection::GetDependentModules() {
+  Layout* writeCopyView = EnsureWriteCopyView();
+  return writeCopyView ? writeCopyView->GetDependentModules() : nullptr;
+}
+
+Span<const DllBlockInfo> SharedSection::GetDynamicBlocklist() {
+  Layout* writeCopyView = EnsureWriteCopyView();
+  return writeCopyView ? writeCopyView->GetModulePathArray() : nullptr;
+}
+
+const DllBlockInfo* SharedSection::SearchBlocklist(
+    const UNICODE_STRING& aLeafName) {
+  Layout* writeCopyView = EnsureWriteCopyView();
+  return writeCopyView ? writeCopyView->SearchBlocklist(aLeafName) : nullptr;
+}
+
+bool SharedSection::IsDisabled() {
+  Layout* writeCopyView = EnsureWriteCopyView();
+  return writeCopyView ? writeCopyView->IsDisabled() : false;
+}
+
+LauncherVoidResult SharedSection::TransferHandle(
+    nt::CrossExecTransferManager& aTransferMgr, DWORD aDesiredAccess,
+    HANDLE* aDestinationAddress) {
+  HANDLE remoteHandle;
+  if (!::DuplicateHandle(nt::kCurrentProcess, sSectionHandle,
+                         aTransferMgr.RemoteProcess(), &remoteHandle,
+                         aDesiredAccess, FALSE, 0)) {
+    return LAUNCHER_ERROR_FROM_LAST();
+  }
+
+  return aTransferMgr.Transfer(aDestinationAddress, &remoteHandle,
+                               sizeof(remoteHandle));
+}
+
+}  // namespace freestanding
+}  // namespace mozilla
diff --git a/browser/app/winlauncher/freestanding/SharedSection.h b/browser/app/winlauncher/freestanding/SharedSection.h
new file mode 100644
index 0000000000..4c3d1b8ef8
--- /dev/null
+++ b/browser/app/winlauncher/freestanding/SharedSection.h
@@ -0,0 +1,212 @@
+/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* vim: set ts=8 sts=2 et sw=2 tw=80: */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at https://mozilla.org/MPL/2.0/. */
+
+#ifndef mozilla_freestanding_SharedSection_h
+#define mozilla_freestanding_SharedSection_h
+
+#include "mozilla/DynamicBlocklist.h"
+#include "mozilla/glue/SharedSection.h"
+#include "mozilla/NativeNt.h"
+#include "mozilla/interceptor/MMPolicies.h"
+
+// clang-format off
+#define MOZ_LITERAL_UNICODE_STRING(s)                                        \
+  {                                                                          \
+    /* Length of the string in bytes, less the null terminator */            \
+    sizeof(s) - sizeof(wchar_t),                                             \
+    /* Length of the string in bytes, including the null terminator */       \
+    sizeof(s),                                                               \
+    /* Pointer to the buffer */                                              \
+    const_cast<wchar_t*>(s)                                                  \
+  }
+// clang-format on
+
+namespace mozilla {
+namespace freestanding {
+class SharedSectionTestHelper;
+
+struct DllBlockInfoComparator {
+  explicit DllBlockInfoComparator(const UNICODE_STRING& aTarget)
+      : mTarget(&aTarget) {}
+
+  int operator()(const DllBlockInfo& aVal) const {
+    return static_cast<int>(
+        ::RtlCompareUnicodeString(mTarget, &aVal.mName, TRUE));
+  }
+
+  PCUNICODE_STRING mTarget;
+};
+
+// This class calculates RVAs of kernel32's functions and transfers them
+// to a target process, where the transferred RVAs are resolved into
+// function addresses so that the target process can use them after
+// kernel32.dll is loaded and before IAT is resolved.
+struct MOZ_TRIVIAL_CTOR_DTOR Kernel32ExportsSolver final
+    : interceptor::MMPolicyInProcessEarlyStage::Kernel32Exports {
+  void Init();
+  bool Resolve();
+};
+
+// This class manages a section which is created in the launcher process and
+// mapped in the browser process and the sandboxed processes.  The section's
+// layout is represented as SharedSection::Layout.
+//
+// (1) Kernel32's functions required for MMPolicyInProcessEarlyStage
+//     Formatted as Kernel32ExportsSolver.
+//
+// (2) Various flags and offsets
+//
+// (3) Entries in the dynamic blocklist, in DllBlockInfo format. There
+//     are mNumBlockEntries of these, followed by one that has mName.Length
+//     of 0. Note that the strings that contain
+//     the names of the entries in the blocklist are stored concatenated
+//     after the last entry. The mName pointers in each DllBlockInfo point
+//     to these strings correctly in Resolve(), so clients don't need
+//     to do anything special to read these strings.
+//
+// (4) Array of NT paths of the executable's dependent modules
+//     Formatted as a null-delimited wide-character string set ending with
+//     an empty string. These entries start at offset
+//     mDependentModulePathArrayStart (in bytes) from the beginning
+//     of the structure
+//
+// +--------------------------------------------------------------+
+// | (1) | FlushInstructionCache                                  |
+// |     | GetModuleHandleW                                       |
+// |     | GetSystemInfo                                          |
+// |     | VirtualProtect                                         |
+// |     | State [kUninitialized|kInitialized|kResolved]          |
+// +--------------------------------------------------------------+
+// | (2) | (flags and offsets)                                    |
+// +--------------------------------------------------------------+
+// | (3) | <DllBlockInfo for first entry in dynamic blocklist>    |
+// |     | <DllBlockInfo for second entry in dynamic blocklist>   |
+// |     | ...                                                    |
+// |     | <DllBlockInfo for last entry in dynamic blocklist>     |
+// |     | <DllBlockInfo with mName.Length of 0>                  |
+// |     | L"string1.dllstring2.dll...stringlast.dll"             |
+// +--------------------------------------------------------------+
+// | (4) | L"NT path 1"                                           |
+// |     | L"NT path 2"                                           |
+// |     | ...                                                    |
+// |     | L""                                                    |
+// +--------------------------------------------------------------+
+class MOZ_TRIVIAL_CTOR_DTOR SharedSection final : public nt::SharedSection {
+  struct Layout final {
+    enum class State {
+      kUninitialized,
+      kInitialized,
+      kLoadedDynamicBlocklistEntries,
+      kResolved,
+    } mState;
+
+    Kernel32ExportsSolver mK32Exports;
+    // 1 if the blocklist is disabled, 0 otherwise.
+    // If the blocklist is disabled, the entries are still loaded to make it
+    // easy for the user to remove any they don't want, but none of the DLLs
+    // here are actually blocked.
+    // Stored as a uint32_t for alignment reasons.
+    uint32_t mBlocklistIsDisabled;
+    // The offset, in bytes, from the beginning of the Layout structure to the
+    // first dependent module entry.
+    // When the Layout object is created, this value is 0, indicating that no
+    // dependent modules have been added and it is safe to add DllBlockInfo
+    // entries.
+    // After this value is set to something non-0, no more DllBlockInfo entries
+    // can be added.
+    uint32_t mDependentModulePathArrayStart;
+    // The number of blocklist entries.
+    uint32_t mNumBlockEntries;
+    DllBlockInfo mFirstBlockEntry[1];
+
+    Span<DllBlockInfo> GetModulePathArray() {
+      return Span<DllBlockInfo>(
+          mFirstBlockEntry,
+          (kSharedViewSize - (reinterpret_cast<uintptr_t>(mFirstBlockEntry) -
+                              reinterpret_cast<uintptr_t>(this))) /
+              sizeof(DllBlockInfo));
+    }
+    // Can be used to make sure we don't step past the end of the shared memory
+    // section.
+    static constexpr uint32_t GetMaxNumBlockEntries() {
+      return (kSharedViewSize - (offsetof(Layout, mFirstBlockEntry))) /
+             sizeof(DllBlockInfo);
+    }
+    Layout() = delete;  // disallow instantiation
+    bool Resolve();
+    bool IsDisabled() const;
+    const DllBlockInfo* SearchBlocklist(const UNICODE_STRING& aLeafName) const;
+    Span<wchar_t> GetDependentModules();
+  };
+
+  // As we define a global variable of this class and use it in our blocklist
+  // which is excuted in a process's early stage.  If we have a complex dtor,
+  // the static initializer tries to register that dtor with onexit() of
+  // ucrtbase.dll which is not loaded yet, resulting in crash.  Thus, we have
+  // a raw handle and a pointer as a static variable and manually release them
+  // by calling Reset() where possible.
+  static HANDLE sSectionHandle;
+  static Layout* sWriteCopyView;
+  static RTL_RUN_ONCE sEnsureOnce;
+
+  // The sLock lock guarantees that while it is held, sSectionHandle will not
+  // change nor get closed, sEnsureOnce will not get reinitialized, and
+  // sWriteCopyView will not change nor get unmapped once initialized. We take
+  // sLock on paths that could run concurrently with ConvertToReadOnly(). This
+  // method is only called on the main process, and very early, so the only
+  // real risk here should be threads started by third-party products reaching
+  // our patched_NtMapViewOfSection (see bug 1850969).
+  static nt::SRWLock sLock;
+
+  static ULONG NTAPI EnsureWriteCopyViewOnce(PRTL_RUN_ONCE, PVOID, PVOID*);
+  static Layout* EnsureWriteCopyView(bool requireKernel32Exports = false);
+
+  static constexpr size_t kSharedViewSize = 0x1000;
+
+  // For test use only
+  friend class SharedSectionTestHelper;
+
+ public:
+  // Replace |sSectionHandle| with a given handle.
+  static void Reset(HANDLE aNewSectionObject = sSectionHandle);
+
+  static inline nt::AutoSharedLock AutoNoReset() {
+    return nt::AutoSharedLock{sLock};
+  }
+
+  // Replace |sSectionHandle| with a new readonly handle.
+  static void ConvertToReadOnly();
+
+  // Create a new writable section and initialize the Kernel32ExportsSolver
+  // part.
+  static LauncherVoidResult Init();
+
+  // Append a new string to the |sSectionHandle|
+  static LauncherVoidResult AddDependentModule(PCUNICODE_STRING aNtPath);
+  static LauncherVoidResult SetBlocklist(const DynamicBlockList& aBlocklist,
+                                         bool isDisabled);
+
+  // Map |sSectionHandle| to a copy-on-write page and return a writable pointer
+  // to each structure, or null if Layout failed to resolve exports.
+  Kernel32ExportsSolver* GetKernel32Exports();
+  Span<const wchar_t> GetDependentModules() final override;
+  Span<const DllBlockInfo> GetDynamicBlocklist() final override;
+
+  static bool IsDisabled();
+  static const DllBlockInfo* SearchBlocklist(const UNICODE_STRING& aLeafName);
+
+  // Transfer |sSectionHandle| to a process associated with |aTransferMgr|.
+  static LauncherVoidResult TransferHandle(
+      nt::CrossExecTransferManager& aTransferMgr, DWORD aDesiredAccess,
+      HANDLE* aDestinationAddress = &sSectionHandle);
+};
+
+extern SharedSection gSharedSection;
+
+}  // namespace freestanding
+}  // namespace mozilla
+
+#endif  // mozilla_freestanding_SharedSection_h
diff --git a/browser/app/winlauncher/freestanding/gen_ntdll_freestanding_lib.py b/browser/app/winlauncher/freestanding/gen_ntdll_freestanding_lib.py
new file mode 100644
index 0000000000..d9fe86d78e
--- /dev/null
+++ b/browser/app/winlauncher/freestanding/gen_ntdll_freestanding_lib.py
@@ -0,0 +1,28 @@
+# -*- Mode: python; indent-tabs-mode: nil; tab-width: 40 -*-
+# vim: set filetype=python:
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at http://mozilla.org/MPL/2.0/.
+
+import os
+import subprocess
+import tempfile
+
+
+def main(output_fd, def_file, llvm_dlltool, *llvm_dlltool_args):
+    # llvm-dlltool can't output to stdout, so we create a temp file, use that
+    # to write out the lib, and then copy it over to output_fd
+    (tmp_fd, tmp_output) = tempfile.mkstemp()
+    os.close(tmp_fd)
+
+    try:
+        cmd = [llvm_dlltool]
+        cmd.extend(llvm_dlltool_args)
+        cmd += ["-d", def_file, "-l", tmp_output]
+
+        subprocess.check_call(cmd)
+
+        with open(tmp_output, "rb") as tmplib:
+            output_fd.write(tmplib.read())
+    finally:
+        os.remove(tmp_output)
diff --git a/browser/app/winlauncher/freestanding/moz.build b/browser/app/winlauncher/freestanding/moz.build
new file mode 100644
index 0000000000..7a43d9a104
--- /dev/null
+++ b/browser/app/winlauncher/freestanding/moz.build
@@ -0,0 +1,56 @@
+# -*- Mode: python; indent-tabs-mode: nil; tab-width: 40 -*-
+# vim: set filetype=python:
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at http://mozilla.org/MPL/2.0/.
+
+Library("winlauncher-freestanding")
+
+FORCE_STATIC_LIB = True
+
+# Our patched NtMapViewOfSection can be called before the process's import
+# table is populated.  Don't let the compiler insert any instrumentation
+# that might call an import.
+NO_PGO = True
+
+UNIFIED_SOURCES += [
+    "DllBlocklist.cpp",
+    "LoaderPrivateAPI.cpp",
+    "ModuleLoadFrame.cpp",
+    "SharedSection.cpp",
+]
+
+# This library must be compiled in a freestanding environment, as its code must
+# not assume that it has access to any runtime libraries.
+if CONFIG["CC_TYPE"] == "clang-cl":
+    CXXFLAGS += ["-Xclang"]
+
+CXXFLAGS += [
+    "-ffreestanding",
+]
+
+# Forcibly include Freestanding.h into all source files in this library.
+if CONFIG["CC_TYPE"] == "clang-cl":
+    CXXFLAGS += ["-FI"]
+else:
+    CXXFLAGS += ["-include"]
+
+CXXFLAGS += [SRCDIR + "/Freestanding.h"]
+
+OS_LIBS += [
+    "ntdll",
+    "ntdll_freestanding",
+]
+
+if CONFIG["COMPILE_ENVIRONMENT"] and CONFIG["LLVM_DLLTOOL"]:
+    GeneratedFile(
+        "%sntdll_freestanding.%s" % (CONFIG["LIB_PREFIX"], CONFIG["LIB_SUFFIX"]),
+        script="gen_ntdll_freestanding_lib.py",
+        inputs=["ntdll_freestanding.def"],
+        flags=[CONFIG["LLVM_DLLTOOL"]] + CONFIG["LLVM_DLLTOOL_FLAGS"],
+    )
+
+DisableStlWrapping()
+
+with Files("**"):
+    BUG_COMPONENT = ("Firefox", "Launcher Process")
diff --git a/browser/app/winlauncher/freestanding/ntdll_freestanding.def b/browser/app/winlauncher/freestanding/ntdll_freestanding.def
new file mode 100644
index 0000000000..6e5e2685fe
--- /dev/null
+++ b/browser/app/winlauncher/freestanding/ntdll_freestanding.def
@@ -0,0 +1,25 @@
+; This Source Code Form is subject to the terms of the Mozilla Public
+; License, v. 2.0. If a copy of the MPL was not distributed with this
+; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+
+LIBRARY ntdll
+
+; When we compile with -freestanding, the compiler still requires implementation
+; of the four functions listed below.
+;
+; We could implement our own naive versions of these functions, but that
+; solution is less than ideal since the implementations must be extern and are
+; thus picked up by the entire firefox.exe binary. This denies the rest of
+; firefox.exe the benefit of optimized implementations. On Windows the
+; sandbox is linked into firefox.exe, so we cannot just shrug and
+; assume that a naive implementation will not have any effect on anything.
+;
+; There are, however, optimized implementations of these functions that are
+; exported by ntdll.dll. OTOH, they are not included in the ntdll.lib
+; import library. This .def file is used to build an import library that "fills
+; in the blanks" and allows us to link into the ntdll implementations.
+EXPORTS
+    memcmp
+    memcpy
+    memmove
+    memset
diff --git a/browser/app/winlauncher/moz.build b/browser/app/winlauncher/moz.build
new file mode 100644
index 0000000000..f2f321ae0c
--- /dev/null
+++ b/browser/app/winlauncher/moz.build
@@ -0,0 +1,61 @@
+# -*- Mode: python; indent-tabs-mode: nil; tab-width: 40 -*-
+# vim: set filetype=python:
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at http://mozilla.org/MPL/2.0/.
+
+Library("winlauncher")
+
+FORCE_STATIC_LIB = True
+
+UNIFIED_SOURCES += [
+    "/ipc/mscom/COMWrappers.cpp",
+    "/ipc/mscom/ProcessRuntime.cpp",
+    "/toolkit/xre/WinTokenUtils.cpp",
+    "/widget/windows/WindowsConsole.cpp",
+    "DllBlocklistInit.cpp",
+    "ErrorHandler.cpp",
+    "LauncherProcessWin.cpp",
+    "LaunchUnelevated.cpp",
+    "NtLoaderAPI.cpp",
+]
+
+OS_LIBS += [
+    "oleaut32",
+    "ole32",
+    "rpcrt4",
+    "version",
+]
+
+DIRS += [
+    "freestanding",
+]
+
+USE_LIBS += [
+    "winlauncher-freestanding",
+]
+
+TEST_DIRS += [
+    "test",
+]
+
+if CONFIG["MOZ_LAUNCHER_PROCESS"]:
+    LOCAL_INCLUDES += [
+        "/other-licenses/nsis/Contrib/CityHash/cityhash",
+        "/toolkit/mozapps/update/common",
+    ]
+    UNIFIED_SOURCES += [
+        "/other-licenses/nsis/Contrib/CityHash/cityhash/city.cpp",
+        "/toolkit/mozapps/update/common/commonupdatedir.cpp",
+        "/toolkit/xre/LauncherRegistryInfo.cpp",
+    ]
+
+for var in ("MOZ_APP_BASENAME", "MOZ_APP_VENDOR", "MOZ_APP_DISPLAYNAME"):
+    DEFINES[var] = '"%s"' % CONFIG[var]
+
+DEFINES["MOZ_USE_LAUNCHER_ERROR"] = 1
+
+DisableStlWrapping()
+
+with Files("**"):
+    BUG_COMPONENT = ("Firefox", "Launcher Process")
diff --git a/browser/app/winlauncher/test/TestCrossProcessWin.cpp b/browser/app/winlauncher/test/TestCrossProcessWin.cpp
new file mode 100644
index 0000000000..fa212b30c2
--- /dev/null
+++ b/browser/app/winlauncher/test/TestCrossProcessWin.cpp
@@ -0,0 +1,703 @@
+/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* vim: set ts=8 sts=2 et sw=2 tw=80: */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at https://mozilla.org/MPL/2.0/. */
+
+#include <thread>
+#include <winternl.h>
+
+#define MOZ_USE_LAUNCHER_ERROR
+
+#include <atomic>
+#include <thread>
+#include "freestanding/SharedSection.cpp"
+#include "mozilla/CmdLineAndEnvUtils.h"
+#include "mozilla/DynamicBlocklist.h"
+#include "mozilla/NativeNt.h"
+#include "mozilla/Vector.h"
+
+#define DLL_BLOCKLIST_ENTRY(name, ...) \
+  {MOZ_LITERAL_UNICODE_STRING(L##name), __VA_ARGS__},
+#define DLL_BLOCKLIST_STRING_TYPE UNICODE_STRING
+
+#include "mozilla/WindowsDllBlocklistLauncherDefs.h"
+
+const wchar_t kChildArg[] = L"--child";
+const char* kTestDependentModulePaths[] = {
+    "\\Device\\HarddiskVolume4\\Windows\\system32\\A B C",
+    "\\Device\\HarddiskVolume4\\Windows\\system32\\a b c.dll",
+    "\\Device\\HarddiskVolume4\\Windows\\system32\\A B C.exe",
+    "\\Device\\HarddiskVolume4\\Windows\\system32\\X Y Z.dll",
+    "\\Device\\HarddiskVolume1\\a b C",
+    "\\Device\\HarddiskVolume2\\A b c.DLL",
+    "\\Device\\HarddiskVolume3\\A B c.exe",
+    "\\Device\\HarddiskVolume4\\X y Z.dll",
+};
+const wchar_t kExpectedDependentModules[] =
+    L"A B C\0"
+    L"a b c.dll\0"
+    L"A B C.exe\0"
+    L"X Y Z.dll\0";
+
+const UNICODE_STRING kStringNotInBlocklist =
+    MOZ_LITERAL_UNICODE_STRING(L"Test_NotInBlocklist.dll");
+const UNICODE_STRING kTestDependentModuleString =
+    MOZ_LITERAL_UNICODE_STRING(L"Test_DependentModule.dll");
+
+using namespace mozilla;
+using namespace mozilla::freestanding;
+
+// clang-format off
+const DllBlockInfo kDllBlocklistShort[] = {
+  // The entries do not have to be sorted.
+  DLL_BLOCKLIST_ENTRY("X Y Z_Test", MAKE_VERSION(1, 2, 65535, 65535),
+                      DllBlockInfoFlags::BLOCK_WIN8_AND_OLDER)
+  DLL_BLOCKLIST_ENTRY("\u30E9\u30FC\u30E1\u30F3_Test")
+  DLL_BLOCKLIST_ENTRY("Avmvirtualsource_Test.ax", MAKE_VERSION(1, 0, 0, 3),
+                      DllBlockInfoFlags::BROWSER_PROCESS_ONLY)
+  DLL_BLOCKLIST_ENTRY("1ccelerator_Test.dll", MAKE_VERSION(3, 2, 1, 6))
+  DLL_BLOCKLIST_ENTRY("atkdx11disp_Test.dll", DllBlockInfo::ALL_VERSIONS)
+  {},
+};
+// clang-format on
+
+namespace mozilla::freestanding {
+class SharedSectionTestHelper {
+ public:
+  static constexpr size_t GetModulePathArraySize() {
+    return SharedSection::kSharedViewSize -
+           (offsetof(SharedSection::Layout, mFirstBlockEntry) +
+            sizeof(DllBlockInfo));
+  }
+};
+}  // namespace mozilla::freestanding
+
+class TempFile final {
+  wchar_t mFullPath[MAX_PATH + 1];
+
+ public:
+  TempFile() : mFullPath{0} {
+    wchar_t tempDir[MAX_PATH + 1];
+    DWORD len = ::GetTempPathW(ArrayLength(tempDir), tempDir);
+    if (!len) {
+      return;
+    }
+
+    len = ::GetTempFileNameW(tempDir, L"blocklist", 0, mFullPath);
+    if (!len) {
+      return;
+    }
+  }
+
+  operator const wchar_t*() const { return mFullPath[0] ? mFullPath : nullptr; }
+};
+
+template <typename T, int N>
+void PrintLauncherError(const LauncherResult<T>& aResult,
+                        const char (&aMsg)[N]) {
+  const LauncherError& err = aResult.inspectErr();
+  printf("TEST-FAILED | TestCrossProcessWin | %s - %lx at %s:%d\n", aMsg,
+         err.mError.AsHResult(), err.mFile, err.mLine);
+}
+
+#define VERIFY_FUNCTION_RESOLVED(mod, exports, name)            \
+  do {                                                          \
+    if (reinterpret_cast<FARPROC>(exports->m##name) !=          \
+        ::GetProcAddress(mod, #name)) {                         \
+      printf(                                                   \
+          "TEST-FAILED | TestCrossProcessWin | "                \
+          "Kernel32ExportsSolver::" #name " did not match.\n"); \
+      return false;                                             \
+    }                                                           \
+  } while (0)
+
+static bool VerifySharedSection(SharedSection& aSharedSection) {
+  Kernel32ExportsSolver* k32Exports = aSharedSection.GetKernel32Exports();
+  if (!k32Exports) {
+    printf(
+        "TEST-FAILED | TestCrossProcessWin | Failed to map a shared section\n");
+    return false;
+  }
+
+  HMODULE k32mod = ::GetModuleHandleW(L"kernel32.dll");
+  VERIFY_FUNCTION_RESOLVED(k32mod, k32Exports, FlushInstructionCache);
+  VERIFY_FUNCTION_RESOLVED(k32mod, k32Exports, GetModuleHandleW);
+  VERIFY_FUNCTION_RESOLVED(k32mod, k32Exports, GetSystemInfo);
+  VERIFY_FUNCTION_RESOLVED(k32mod, k32Exports, VirtualProtect);
+
+  Span<const wchar_t> modulesArray = aSharedSection.GetDependentModules();
+  bool matched = memcmp(modulesArray.data(), kExpectedDependentModules,
+                        sizeof(kExpectedDependentModules)) == 0;
+  if (!matched) {
+    // Print actual strings on error
+    for (const wchar_t* p = modulesArray.data(); *p;) {
+      printf("%p: %S\n", p, p);
+      while (*p) {
+        ++p;
+      }
+      ++p;
+    }
+    return false;
+  }
+
+  for (const DllBlockInfo* info = kDllBlocklistShort; info->mName.Buffer;
+       ++info) {
+    const DllBlockInfo* matched = aSharedSection.SearchBlocklist(info->mName);
+    if (!matched) {
+      printf(
+          "TEST-FAILED | TestCrossProcessWin | No blocklist entry match for "
+          "entry in blocklist.\n");
+      return false;
+    }
+  }
+
+  if (aSharedSection.SearchBlocklist(kStringNotInBlocklist)) {
+    printf(
+        "TEST-FAILED | TestCrossProcessWin | Found blocklist entry match for "
+        "something not in the blocklist.\n");
+  }
+
+  if (aSharedSection.IsDisabled()) {
+    printf("TEST-FAILED | TestCrossProcessWin | Wrong disabled value.\n");
+  }
+
+  return true;
+}
+
+static bool TestAddString() {
+  wchar_t testBuffer[3] = {0};
+  UNICODE_STRING ustr;
+
+  // This makes |testBuffer| full.
+  ::RtlInitUnicodeString(&ustr, L"a");
+  if (!AddString(testBuffer, ustr)) {
+    printf(
+        "TEST-FAILED | TestCrossProcessWin | "
+        "AddString failed.\n");
+    return false;
+  }
+
+  // Adding a string to a full buffer should fail.
+  ::RtlInitUnicodeString(&ustr, L"b");
+  if (AddString(testBuffer, ustr)) {
+    printf(
+        "TEST-FAILED | TestCrossProcessWin | "
+        "AddString caused OOB memory access.\n");
+    return false;
+  }
+
+  bool matched = memcmp(testBuffer, L"a\0", sizeof(testBuffer)) == 0;
+  if (!matched) {
+    printf(
+        "TEST-FAILED | TestCrossProcessWin | "
+        "AddString wrote wrong values.\n");
+    return false;
+  }
+
+  return true;
+}
+
+// Convert |aBlockEntries|, which is an array ending with an empty instance
+// of DllBlockInfo, to DynamicBlockList by storing it to a temp file, loading
+// as DynamicBlockList, and deleting the temp file.
+static DynamicBlockList ConvertStaticBlocklistToDynamic(
+    const DllBlockInfo aBlockEntries[]) {
+  size_t originalLength = 0;
+  CheckedUint32 totalStringLen = 0;
+  for (const DllBlockInfo* entry = aBlockEntries; entry->mName.Length;
+       ++entry) {
+    totalStringLen += entry->mName.Length;
+    MOZ_RELEASE_ASSERT(totalStringLen.isValid());
+    ++originalLength;
+  }
+
+  // Pack all strings in this buffer without null characters
+  UniquePtr<uint8_t[]> stringBuffer =
+      MakeUnique<uint8_t[]>(totalStringLen.value());
+
+  // The string buffer is placed immediately after the array of DllBlockInfo
+  const size_t stringBufferOffset = (originalLength + 1) * sizeof(DllBlockInfo);
+
+  // Entries in the dynamic blocklist do have to be sorted,
+  // unlike in the static blocklist.
+  UniquePtr<DllBlockInfo[]> sortedBlockEntries =
+      MakeUnique<DllBlockInfo[]>(originalLength);
+  memcpy(sortedBlockEntries.get(), aBlockEntries,
+         sizeof(DllBlockInfo) * originalLength);
+  std::sort(sortedBlockEntries.get(), sortedBlockEntries.get() + originalLength,
+            [](const DllBlockInfo& a, const DllBlockInfo& b) {
+              return ::RtlCompareUnicodeString(&a.mName, &b.mName, TRUE) < 0;
+            });
+
+  Vector<DllBlockInfo> copied;
+  Unused << copied.resize(originalLength + 1);  // aBlockEntries + sentinel
+
+  size_t currentStringOffset = 0;
+  for (size_t i = 0; i < originalLength; ++i) {
+    copied[i].mMaxVersion = sortedBlockEntries[i].mMaxVersion;
+    copied[i].mFlags = sortedBlockEntries[i].mFlags;
+
+    // Copy the module's name to the string buffer and store its offset
+    // in mName.Buffer
+    memcpy(stringBuffer.get() + currentStringOffset,
+           sortedBlockEntries[i].mName.Buffer,
+           sortedBlockEntries[i].mName.Length);
+    copied[i].mName.Buffer =
+        reinterpret_cast<wchar_t*>(stringBufferOffset + currentStringOffset);
+    // Only keep mName.Length and leave mName.MaximumLength to be zero
+    copied[i].mName.Length = sortedBlockEntries[i].mName.Length;
+
+    currentStringOffset += sortedBlockEntries[i].mName.Length;
+  }
+
+  TempFile blocklistFile;
+  nsAutoHandle file(::CreateFileW(blocklistFile, GENERIC_WRITE, FILE_SHARE_READ,
+                                  nullptr, CREATE_ALWAYS, FILE_ATTRIBUTE_NORMAL,
+                                  nullptr));
+  MOZ_RELEASE_ASSERT(file);
+
+  DynamicBlockListBase::FileHeader header;
+  header.mSignature = DynamicBlockListBase::kSignature;
+  header.mFileVersion = DynamicBlockListBase::kCurrentVersion;
+  header.mPayloadSize =
+      sizeof(DllBlockInfo) * copied.length() + totalStringLen.value();
+
+  DWORD written = 0;
+  MOZ_RELEASE_ASSERT(
+      ::WriteFile(file.get(), &header, sizeof(header), &written, nullptr));
+  MOZ_RELEASE_ASSERT(::WriteFile(file.get(), copied.begin(),
+                                 sizeof(DllBlockInfo) * copied.length(),
+                                 &written, nullptr));
+  MOZ_RELEASE_ASSERT(::WriteFile(file.get(), stringBuffer.get(),
+                                 totalStringLen.value(), &written, nullptr));
+
+  DynamicBlockList blockList(blocklistFile);
+  ::DeleteFileW(blocklistFile);
+  return blockList;
+}
+
+const DynamicBlockList gFullList =
+    ConvertStaticBlocklistToDynamic(gWindowsDllBlocklist);
+const DynamicBlockList gShortList =
+    ConvertStaticBlocklistToDynamic(kDllBlocklistShort);
+
+static bool TestDependentModules() {
+  LauncherVoidResult result = gSharedSection.Init();
+  if (result.isErr()) {
+    PrintLauncherError(result, "SharedSection::Init failed");
+    return false;
+  }
+
+  constexpr size_t sizeInBytes =
+      SharedSectionTestHelper::GetModulePathArraySize();
+  UniquePtr<uint8_t[]> bufferData = MakeUnique<uint8_t[]>(sizeInBytes);
+  Span<uint8_t> buffer(bufferData, sizeInBytes);
+  memset(buffer.data(), 0x88, buffer.size());
+
+  // Try to add a long string that does not fit in the section,
+  // since there's no room for the NULL character to indicate the final string.
+  UNICODE_STRING ustr;
+  ustr.Buffer = reinterpret_cast<wchar_t*>(buffer.data());
+  ustr.Length = ustr.MaximumLength = buffer.size();
+
+  result = gSharedSection.AddDependentModule(&ustr);
+  if (result.isOk() || result.inspectErr() != WindowsError::FromWin32Error(
+                                                  ERROR_INSUFFICIENT_BUFFER)) {
+    printf(
+        "TEST-FAILED | TestCrossProcessWin | "
+        "Adding a too long string should fail.\n");
+    return false;
+  }
+
+  result = gSharedSection.Init();
+  if (result.isErr()) {
+    PrintLauncherError(result, "SharedSection::Init failed");
+    return false;
+  }
+
+  // Keep adding a single-char string until it fails and
+  // make sure no crash.
+  // We want to make sure no strings match any earlier strings so
+  // we can get the expected count. This is a little tricky since
+  // it includes case-insensitivity, so start at the "CJK Unified Ideographs
+  // Extension A" block of Unicode, which has no two characters that compare
+  // equal under a case insensitive comparison.
+  *(reinterpret_cast<wchar_t*>(buffer.data())) = 0x3400;
+  ustr.Length = ustr.MaximumLength = sizeof(wchar_t);
+  wchar_t numberOfStringsAdded = 0;
+  while (gSharedSection.AddDependentModule(&ustr).isOk()) {
+    ++numberOfStringsAdded;
+    // Make sure the string doesn't match any earlier strings
+    wchar_t oldValue = *(reinterpret_cast<wchar_t*>(buffer.data()));
+    *(reinterpret_cast<wchar_t*>(buffer.data())) = oldValue + 1;
+  }
+
+  int numberOfCharactersInBuffer =
+      SharedSectionTestHelper::GetModulePathArraySize() / sizeof(wchar_t);
+  // Each string is two characters long (one "real" character and a null), but
+  // the whole buffer needs an additional null at the end.
+  int expectedNumberOfStringsAdded = (numberOfCharactersInBuffer - 1) / 2;
+  if (numberOfStringsAdded != expectedNumberOfStringsAdded) {
+    printf(
+        "TEST-FAILED | TestCrossProcessWin | "
+        "Added %d dependent strings before failing (expected %d).\n",
+        static_cast<int>(numberOfStringsAdded), expectedNumberOfStringsAdded);
+    return false;
+  }
+
+  // SetBlocklist is not allowed after AddDependentModule
+  result = gSharedSection.SetBlocklist(gShortList, false);
+  if (result.isOk() || result.inspectErr() !=
+                           WindowsError::FromWin32Error(ERROR_INVALID_STATE)) {
+    printf(
+        "TEST-FAILED | TestCrossProcessWin | "
+        "SetBlocklist is not allowed after AddDependentModule\n");
+    return false;
+  }
+
+  gSharedSection.Reset();
+  return true;
+}
+
+static bool TestDynamicBlocklist() {
+  if (!gFullList.GetPayloadSize() || !gShortList.GetPayloadSize()) {
+    printf(
+        "TEST-FAILED | TestCrossProcessWin | DynamicBlockList::LoadFile "
+        "failed\n");
+    return false;
+  }
+
+  LauncherVoidResult result = gSharedSection.Init();
+  if (result.isErr()) {
+    PrintLauncherError(result, "SharedSection::Init failed");
+    return false;
+  }
+
+  // Set gShortList, and gShortList
+  // 1. Setting gShortList succeeds
+  // 2. Next try to set gShortList fails
+  result = gSharedSection.SetBlocklist(gShortList, false);
+  if (result.isErr()) {
+    PrintLauncherError(result, "SetBlocklist(gShortList) failed");
+    return false;
+  }
+  result = gSharedSection.SetBlocklist(gShortList, false);
+  if (result.isOk() || result.inspectErr() !=
+                           WindowsError::FromWin32Error(ERROR_INVALID_STATE)) {
+    printf(
+        "TEST-FAILED | TestCrossProcessWin | "
+        "SetBlocklist is allowed only once\n");
+    return false;
+  }
+
+  result = gSharedSection.Init();
+  if (result.isErr()) {
+    PrintLauncherError(result, "SharedSection::Init failed");
+    return false;
+  }
+
+  // Add gFullList and gShortList
+  // 1. Adding gFullList always fails because it doesn't fit the section
+  // 2. Adding gShortList succeeds because no entry is added yet
+  MOZ_RELEASE_ASSERT(
+      gFullList.GetPayloadSize() >
+          SharedSectionTestHelper::GetModulePathArraySize(),
+      "Test assumes gFullList is too big to fit in shared section");
+  result = gSharedSection.SetBlocklist(gFullList, false);
+  if (result.isOk() || result.inspectErr() != WindowsError::FromWin32Error(
+                                                  ERROR_INSUFFICIENT_BUFFER)) {
+    printf(
+        "TEST-FAILED | TestCrossProcessWin | "
+        "SetBlocklist(gFullList) should fail\n");
+    return false;
+  }
+  result = gSharedSection.SetBlocklist(gShortList, false);
+  if (result.isErr()) {
+    PrintLauncherError(result, "SetBlocklist(gShortList) failed");
+    return false;
+  }
+
+  // AddDependentModule is allowed after SetBlocklist
+  result = gSharedSection.AddDependentModule(&kTestDependentModuleString);
+  if (result.isErr()) {
+    PrintLauncherError(result, "SharedSection::AddDependentModule failed");
+    return false;
+  }
+
+  gSharedSection.Reset();
+  return true;
+}
+
+class ChildProcess final {
+  nsAutoHandle mChildProcess;
+  nsAutoHandle mChildMainThread;
+  DWORD mProcessId;
+
+ public:
+  // The following variables are updated from the parent process via
+  // WriteProcessMemory while the process is suspended as a part of
+  // TestWithChildProcess().
+  //
+  // Having both a non-const and a const is important because a constant
+  // is separately placed in the .rdata section which is read-only, so
+  // the region's attribute needs to be changed before modifying data via
+  // WriteProcessMemory.
+  // The keyword "volatile" is needed for a constant, otherwise the compiler
+  // evaluates a constant as a literal without fetching data from memory.
+  static HMODULE sExecutableImageBase;
+  static volatile const DWORD sReadOnlyProcessId;
+
+  static int Main() {
+    SRWLOCK lock = SRWLOCK_INIT;
+    ::AcquireSRWLockExclusive(&lock);
+
+    Vector<std::thread> threads;
+    std::atomic<bool> success = true;
+    for (int i = 0; i < 10; ++i) {
+      Unused << threads.emplaceBack(
+          [&success](SRWLOCK* aLock) {
+            // All threads call GetKernel32Exports(), but only the first thread
+            // maps a write-copy section and populates it.
+            ::AcquireSRWLockShared(aLock);
+            if (gSharedSection.GetKernel32Exports() == nullptr) {
+              success = false;
+            }
+            ::ReleaseSRWLockShared(aLock);
+          },
+          &lock);
+    }
+
+    // Wait a msec for all threads to be ready and release the lock
+    ::Sleep(1);
+    ::ReleaseSRWLockExclusive(&lock);
+
+    for (auto& thread : threads) {
+      thread.join();
+    }
+
+    if (!success) {
+      printf(
+          "TEST-FAILED | TestCrossProcessWin | "
+          "GetKernel32Exports() returned null.\n");
+      return 1;
+    }
+
+    if (sExecutableImageBase != ::GetModuleHandle(nullptr)) {
+      printf(
+          "TEST-FAILED | TestCrossProcessWin | "
+          "sExecutableImageBase is expected to be %p, but actually was %p.\n",
+          ::GetModuleHandle(nullptr), sExecutableImageBase);
+      return 1;
+    }
+
+    if (sReadOnlyProcessId != ::GetCurrentProcessId()) {
+      printf(
+          "TEST-FAILED | TestCrossProcessWin | "
+          "sReadOnlyProcessId is expected to be %lx, but actually was %lx.\n",
+          ::GetCurrentProcessId(), sReadOnlyProcessId);
+      return 1;
+    }
+
+    if (!VerifySharedSection(gSharedSection)) {
+      return 1;
+    }
+
+    // Test a scenario to transfer a transferred section as a readonly handle
+    gSharedSection.ConvertToReadOnly();
+
+    // AddDependentModule fails as the handle is readonly.
+    LauncherVoidResult result =
+        gSharedSection.AddDependentModule(&kTestDependentModuleString);
+    if (result.inspectErr() !=
+        WindowsError::FromWin32Error(ERROR_ACCESS_DENIED)) {
+      PrintLauncherError(result, "The readonly section was writable");
+      return 1;
+    }
+
+    if (!VerifySharedSection(gSharedSection)) {
+      return 1;
+    }
+
+    return 0;
+  }
+
+  ChildProcess(const wchar_t* aExecutable, const wchar_t* aOption)
+      : mProcessId(0) {
+    const wchar_t* childArgv[] = {aExecutable, aOption};
+    auto cmdLine(
+        mozilla::MakeCommandLine(mozilla::ArrayLength(childArgv), childArgv));
+
+    STARTUPINFOW si = {sizeof(si)};
+    PROCESS_INFORMATION pi;
+    BOOL ok =
+        ::CreateProcessW(aExecutable, cmdLine.get(), nullptr, nullptr, FALSE,
+                         CREATE_SUSPENDED, nullptr, nullptr, &si, &pi);
+    if (!ok) {
+      printf(
+          "TEST-FAILED | TestCrossProcessWin | "
+          "CreateProcessW falied - %08lx.\n",
+          GetLastError());
+      return;
+    }
+
+    mProcessId = pi.dwProcessId;
+
+    mChildProcess.own(pi.hProcess);
+    mChildMainThread.own(pi.hThread);
+  }
+
+  ~ChildProcess() { ::TerminateProcess(mChildProcess, 0); }
+
+  operator HANDLE() const { return mChildProcess; }
+  DWORD GetProcessId() const { return mProcessId; }
+
+  bool ResumeAndWaitUntilExit() {
+    if (::ResumeThread(mChildMainThread) == 0xffffffff) {
+      printf(
+          "TEST-FAILED | TestCrossProcessWin | "
+          "ResumeThread failed - %08lx\n",
+          GetLastError());
+      return false;
+    }
+
+    if (::WaitForSingleObject(mChildProcess, 60000) != WAIT_OBJECT_0) {
+      printf(
+          "TEST-FAILED | TestCrossProcessWin | "
+          "Unexpected result from WaitForSingleObject\n");
+      return false;
+    }
+
+    DWORD exitCode;
+    if (!::GetExitCodeProcess(mChildProcess, &exitCode)) {
+      printf(
+          "TEST-FAILED | TestCrossProcessWin | "
+          "GetExitCodeProcess failed - %08lx\n",
+          GetLastError());
+      return false;
+    }
+
+    return exitCode == 0;
+  }
+};
+
+HMODULE ChildProcess::sExecutableImageBase = 0;
+volatile const DWORD ChildProcess::sReadOnlyProcessId = 0;
+
+int wmain(int argc, wchar_t* argv[]) {
+  printf("Process: %-8lx Base: %p\n", ::GetCurrentProcessId(),
+         ::GetModuleHandle(nullptr));
+
+  if (argc == 2 && wcscmp(argv[1], kChildArg) == 0) {
+    return ChildProcess::Main();
+  }
+
+  ChildProcess childProcess(argv[0], kChildArg);
+  if (!childProcess) {
+    return 1;
+  }
+
+  if (!TestAddString()) {
+    return 1;
+  }
+
+  if (!TestDependentModules()) {
+    return 1;
+  }
+
+  if (!TestDynamicBlocklist()) {
+    return 1;
+  }
+
+  LauncherResult<HMODULE> remoteImageBase =
+      nt::GetProcessExeModule(childProcess);
+  if (remoteImageBase.isErr()) {
+    PrintLauncherError(remoteImageBase, "nt::GetProcessExeModule failed");
+    return 1;
+  }
+
+  nt::CrossExecTransferManager transferMgr(childProcess);
+  if (!transferMgr) {
+    printf(
+        "TEST-FAILED | TestCrossProcessWin | "
+        "CrossExecTransferManager instantiation failed.\n");
+    return 1;
+  }
+
+  LauncherVoidResult result =
+      transferMgr.Transfer(&ChildProcess::sExecutableImageBase,
+                           &remoteImageBase.inspect(), sizeof(HMODULE));
+  if (result.isErr()) {
+    PrintLauncherError(result, "ChildProcess::WriteData(Imagebase) failed");
+    return 1;
+  }
+
+  DWORD childPid = childProcess.GetProcessId();
+
+  DWORD* readOnlyData = const_cast<DWORD*>(&ChildProcess::sReadOnlyProcessId);
+  result = transferMgr.Transfer(readOnlyData, &childPid, sizeof(DWORD));
+  if (result.isOk()) {
+    printf(
+        "TEST-UNEXPECTED | TestCrossProcessWin | "
+        "A constant was located in a writable section.");
+    return 1;
+  }
+
+  AutoVirtualProtect prot =
+      transferMgr.Protect(readOnlyData, sizeof(uint32_t), PAGE_READWRITE);
+  if (!prot) {
+    printf(
+        "TEST-FAILED | TestCrossProcessWin | "
+        "VirtualProtect failed - %08lx\n",
+        prot.GetError().AsHResult());
+    return 1;
+  }
+
+  result = transferMgr.Transfer(readOnlyData, &childPid, sizeof(DWORD));
+  if (result.isErr()) {
+    PrintLauncherError(result, "ChildProcess::WriteData(PID) failed");
+    return 1;
+  }
+
+  result = gSharedSection.Init();
+  if (result.isErr()) {
+    PrintLauncherError(result, "SharedSection::Init failed");
+    return 1;
+  }
+
+  result = gSharedSection.SetBlocklist(gShortList, false);
+  if (result.isErr()) {
+    PrintLauncherError(result, "SetBlocklist(gShortList) failed");
+    return false;
+  }
+
+  for (const char* testString : kTestDependentModulePaths) {
+    // Test AllocatedUnicodeString(const char*) that is used
+    // in IsDependentModule()
+    nt::AllocatedUnicodeString depModule(testString);
+    UNICODE_STRING depModuleLeafName;
+    nt::GetLeafName(&depModuleLeafName, depModule);
+    result = gSharedSection.AddDependentModule(&depModuleLeafName);
+    if (result.isErr()) {
+      PrintLauncherError(result, "SharedSection::AddDependentModule failed");
+      return 1;
+    }
+  }
+
+  result =
+      gSharedSection.TransferHandle(transferMgr, GENERIC_READ | GENERIC_WRITE);
+  if (result.isErr()) {
+    PrintLauncherError(result, "SharedSection::TransferHandle failed");
+    return 1;
+  }
+
+  // Close the section in the parent process before resuming the child process
+  gSharedSection.Reset(nullptr);
+
+  if (!childProcess.ResumeAndWaitUntilExit()) {
+    return 1;
+  }
+
+  printf("TEST-PASS | TestCrossProcessWin | All checks passed\n");
+  return 0;
+}
diff --git a/browser/app/winlauncher/test/TestSafeThreadLocal.cpp b/browser/app/winlauncher/test/TestSafeThreadLocal.cpp
new file mode 100644
index 0000000000..31af93c375
--- /dev/null
+++ b/browser/app/winlauncher/test/TestSafeThreadLocal.cpp
@@ -0,0 +1,84 @@
+/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* vim: set ts=8 sts=2 et sw=2 tw=80: */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at https://mozilla.org/MPL/2.0/. */
+
+#define MOZ_USE_LAUNCHER_ERROR
+
+#include "freestanding/SafeThreadLocal.h"
+
+#include "mozilla/NativeNt.h"
+#include "nsWindowsHelpers.h"
+
+#include <process.h>
+#include <stdio.h>
+
+// Need a non-inline function to bypass compiler optimization that the thread
+// local storage pointer is cached in a register before accessing a thread-local
+// variable.
+MOZ_NEVER_INLINE PVOID SwapThreadLocalStoragePointer(PVOID aNewValue) {
+  auto oldValue = mozilla::nt::RtlGetThreadLocalStoragePointer();
+  mozilla::nt::RtlSetThreadLocalStoragePointerForTestingOnly(aNewValue);
+  return oldValue;
+}
+
+static mozilla::freestanding::SafeThreadLocal<int*> gTheStorage;
+
+// Need non-inline functions to bypass compiler optimization that the thread
+// local storage pointer is cached in a register before accessing a thread-local
+// variable. See bug 1803322 for a motivating example.
+MOZ_NEVER_INLINE int* getTheStorage() { return gTheStorage.get(); }
+MOZ_NEVER_INLINE void setTheStorage(int* p) { gTheStorage.set(p); }
+
+static unsigned int __stdcall TestNonMainThread(void* aArg) {
+  for (int i = 0; i < 100; ++i) {
+    setTheStorage(&i);
+    if (getTheStorage() != &i) {
+      printf(
+          "TEST-FAILED | TestSafeThreadLocal | "
+          "A value is not correctly stored in the thread-local storage.\n");
+      return 1;
+    }
+  }
+  return 0;
+}
+
+extern "C" int wmain(int argc, wchar_t* argv[]) {
+  int dummy = 0x1234;
+
+  auto origHead = SwapThreadLocalStoragePointer(nullptr);
+  // Setting gTheStorage when TLS is null.
+  setTheStorage(&dummy);
+  SwapThreadLocalStoragePointer(origHead);
+
+  nsAutoHandle handles[8];
+  for (auto& handle : handles) {
+    handle.own(reinterpret_cast<HANDLE>(
+        ::_beginthreadex(nullptr, 0, TestNonMainThread, nullptr, 0, nullptr)));
+  }
+
+  for (int i = 0; i < 100; ++i) {
+    if (getTheStorage() != &dummy) {
+      printf(
+          "TEST-FAILED | TestSafeThreadLocal | "
+          "A value is not correctly stored in the global scope.\n");
+      return 1;
+    }
+  }
+
+  for (auto& handle : handles) {
+    ::WaitForSingleObject(handle, INFINITE);
+
+#if !defined(MOZ_ASAN)
+    // ASAN builds under Windows 11 can have unexpected thread exit codes.
+    // See bug 1798796
+    DWORD exitCode;
+    if (!::GetExitCodeThread(handle, &exitCode) || exitCode) {
+      return 1;
+    }
+#endif  // !defined(MOZ_ASAN)
+  }
+
+  return 0;
+}
diff --git a/browser/app/winlauncher/test/TestSameBinary.cpp b/browser/app/winlauncher/test/TestSameBinary.cpp
new file mode 100644
index 0000000000..2cb45f546f
--- /dev/null
+++ b/browser/app/winlauncher/test/TestSameBinary.cpp
@@ -0,0 +1,255 @@
+/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* vim: set ts=8 sts=2 et sw=2 tw=80: */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at https://mozilla.org/MPL/2.0/. */
+
+#define MOZ_USE_LAUNCHER_ERROR
+
+#include <stdio.h>
+#include <stdlib.h>
+
+#include <utility>
+
+#include "SameBinary.h"
+#include "mozilla/ArrayUtils.h"
+#include "mozilla/Assertions.h"
+#include "mozilla/CmdLineAndEnvUtils.h"
+#include "mozilla/NativeNt.h"
+#include "mozilla/Unused.h"
+#include "mozilla/Vector.h"
+#include "mozilla/WinHeaderOnlyUtils.h"
+#include "nsWindowsHelpers.h"
+
+#define EXPECT_SAMEBINARY_IS(expected, option, message)                \
+  do {                                                                 \
+    mozilla::LauncherResult<bool> isSame =                             \
+        mozilla::IsSameBinaryAsParentProcess(option);                  \
+    if (isSame.isErr()) {                                              \
+      PrintLauncherError(isSame,                                       \
+                         "IsSameBinaryAsParentProcess returned error " \
+                         "when we were expecting success.");           \
+      return 1;                                                        \
+    }                                                                  \
+    if (isSame.unwrap() != expected) {                                 \
+      PrintErrorMsg(message);                                          \
+      return 1;                                                        \
+    }                                                                  \
+  } while (0)
+
+/**
+ * This test involves three processes:
+ *   1. The "Monitor" process, which is executed by |MonitorMain|. This process
+ *      is responsible for integrating with the test harness, so it spawns the
+ *      "Parent" process (2), and then waits for the other two processes to
+ *      finish.
+ *   2. The "Parent" process, which is executed by |ParentMain|. This process
+ *      creates the "Child" process (3) and then waits indefinitely.
+ *   3. The "Child" process, which is executed by |ChildMain| and carries out
+ *      the actual test. It terminates the Parent process during its execution,
+ *      using the Child PID as the Parent process's exit code. This serves as a
+ *      hacky yet effective way to signal to the Monitor process which PID it
+ *      should wait on to ensure that the Child process has exited.
+ */
+
+static const char kMsgStart[] = "TEST-FAILED | SameBinary | ";
+
+inline void PrintErrorMsg(const char* aMsg) {
+  printf("%s%s\n", kMsgStart, aMsg);
+}
+
+inline void PrintWinError(const char* aMsg) {
+  mozilla::WindowsError err(mozilla::WindowsError::FromLastError());
+  printf("%s%s: %S\n", kMsgStart, aMsg, err.AsString().get());
+}
+
+template <typename T>
+inline void PrintLauncherError(const mozilla::LauncherResult<T>& aResult,
+                               const char* aMsg = nullptr) {
+  const char* const kSep = aMsg ? ": " : "";
+  const char* msg = aMsg ? aMsg : "";
+  const mozilla::LauncherError& err = aResult.inspectErr();
+  printf("%s%s%s%S (%s:%d)\n", kMsgStart, msg, kSep,
+         err.mError.AsString().get(), err.mFile, err.mLine);
+}
+
+static int ChildMain(DWORD aExpectedParentPid) {
+  mozilla::LauncherResult<DWORD> parentPid = mozilla::nt::GetParentProcessId();
+  if (parentPid.isErr()) {
+    PrintLauncherError(parentPid);
+    return 1;
+  }
+
+  if (parentPid.inspect() != aExpectedParentPid) {
+    PrintErrorMsg("Unexpected mismatch of parent PIDs");
+    return 1;
+  }
+
+  const DWORD kAccess = PROCESS_QUERY_LIMITED_INFORMATION | PROCESS_TERMINATE;
+  nsAutoHandle parentProcess(
+      ::OpenProcess(kAccess, FALSE, parentPid.inspect()));
+  if (!parentProcess) {
+    PrintWinError("Unexpectedly failed to call OpenProcess on parent");
+    return 1;
+  }
+
+  EXPECT_SAMEBINARY_IS(
+      true, mozilla::ImageFileCompareOption::Default,
+      "IsSameBinaryAsParentProcess returned incorrect result for identical "
+      "binaries");
+  EXPECT_SAMEBINARY_IS(
+      true, mozilla::ImageFileCompareOption::CompareNtPathsOnly,
+      "IsSameBinaryAsParentProcess(CompareNtPathsOnly) returned incorrect "
+      "result for identical binaries");
+
+  // Total hack, but who cares? We'll set the parent's exit code as our PID
+  // so that the monitor process knows who to wait for!
+  if (!::TerminateProcess(parentProcess.get(), ::GetCurrentProcessId())) {
+    PrintWinError("Unexpected failure in TerminateProcess");
+    return 1;
+  }
+
+  // Close our handle to the parent process so that no references are held.
+  ::CloseHandle(parentProcess.disown());
+
+  // Querying a pid on a terminated process may still succeed some time after
+  // that process has been terminated. For the purposes of this test, we'll poll
+  // the OS until we cannot succesfully open the parentPid anymore.
+  const uint32_t kMaxAttempts = 100;
+  uint32_t curAttempt = 0;
+  while (HANDLE p = ::OpenProcess(PROCESS_QUERY_LIMITED_INFORMATION, FALSE,
+                                  parentPid.inspect())) {
+    ::CloseHandle(p);
+    ::Sleep(100);
+    ++curAttempt;
+    if (curAttempt >= kMaxAttempts) {
+      PrintErrorMsg(
+          "Exhausted retry attempts waiting for parent pid to become invalid");
+      return 1;
+    }
+  }
+
+  EXPECT_SAMEBINARY_IS(
+      false, mozilla::ImageFileCompareOption::Default,
+      "IsSameBinaryAsParentProcess returned incorrect result for dead parent "
+      "process");
+  EXPECT_SAMEBINARY_IS(
+      false, mozilla::ImageFileCompareOption::CompareNtPathsOnly,
+      "IsSameBinaryAsParentProcess(CompareNtPathsOnly) returned incorrect "
+      "result for dead parent process");
+
+  return 0;
+}
+
+static nsReturnRef<HANDLE> CreateSelfProcess(int argc, wchar_t* argv[]) {
+  nsAutoHandle empty;
+
+  DWORD myPid = ::GetCurrentProcessId();
+
+  wchar_t strPid[11] = {};
+#if defined(__MINGW32__)
+  _ultow(myPid, strPid, 16);
+#else
+  if (_ultow_s(myPid, strPid, 16)) {
+    PrintErrorMsg("_ultow_s failed");
+    return empty.out();
+  }
+#endif  // defined(__MINGW32__)
+
+  wchar_t* extraArgs[] = {strPid};
+
+  auto cmdLine = mozilla::MakeCommandLine(
+      argc, argv, mozilla::ArrayLength(extraArgs), extraArgs);
+  if (!cmdLine) {
+    PrintErrorMsg("MakeCommandLine failed");
+    return empty.out();
+  }
+
+  STARTUPINFOW si = {sizeof(si)};
+  PROCESS_INFORMATION pi;
+  BOOL ok =
+      ::CreateProcessW(argv[0], cmdLine.get(), nullptr, nullptr, FALSE,
+                       CREATE_UNICODE_ENVIRONMENT, nullptr, nullptr, &si, &pi);
+  if (!ok) {
+    PrintWinError("CreateProcess failed");
+    return empty.out();
+  }
+
+  nsAutoHandle proc(pi.hProcess);
+  nsAutoHandle thd(pi.hThread);
+
+  return proc.out();
+}
+
+static int ParentMain(int argc, wchar_t* argv[]) {
+  nsAutoHandle childProc(CreateSelfProcess(argc, argv));
+  if (!childProc) {
+    return 1;
+  }
+
+  if (::WaitForSingleObject(childProc.get(), INFINITE) != WAIT_OBJECT_0) {
+    PrintWinError(
+        "Unexpected result from WaitForSingleObject on child process");
+    return 1;
+  }
+
+  MOZ_ASSERT_UNREACHABLE("This process should be terminated by now");
+  return 0;
+}
+
+static int MonitorMain(int argc, wchar_t* argv[]) {
+  // In this process, "parent" means the process that will be running
+  // ParentMain, which is our child process (confusing, I know...)
+  nsAutoHandle parentProc(CreateSelfProcess(argc, argv));
+  if (!parentProc) {
+    return 1;
+  }
+
+  if (::WaitForSingleObject(parentProc.get(), 60000) != WAIT_OBJECT_0) {
+    PrintWinError("Unexpected result from WaitForSingleObject on parent");
+    return 1;
+  }
+
+  DWORD childPid;
+  if (!::GetExitCodeProcess(parentProc.get(), &childPid)) {
+    PrintWinError("GetExitCodeProcess failed");
+    return 1;
+  }
+
+  nsAutoHandle childProc(::OpenProcess(SYNCHRONIZE, FALSE, childPid));
+  if (!childProc) {
+    // Nothing to wait on anymore, which is OK.
+    return 0;
+  }
+
+  // We want no more references to parentProc
+  ::CloseHandle(parentProc.disown());
+
+  if (::WaitForSingleObject(childProc.get(), 60000) != WAIT_OBJECT_0) {
+    PrintWinError("Unexpected result from WaitForSingleObject on child");
+    return 1;
+  }
+
+  return 0;
+}
+
+extern "C" int wmain(int argc, wchar_t* argv[]) {
+  if (argc == 3) {
+    return ChildMain(wcstoul(argv[2], nullptr, 16));
+  }
+
+  if (!mozilla::SetArgv0ToFullBinaryPath(argv)) {
+    return 1;
+  }
+
+  if (argc == 1) {
+    return MonitorMain(argc, argv);
+  }
+
+  if (argc == 2) {
+    return ParentMain(argc, argv);
+  }
+
+  PrintErrorMsg("Unexpected argc");
+  return 1;
+}
diff --git a/browser/app/winlauncher/test/moz.build b/browser/app/winlauncher/test/moz.build
new file mode 100644
index 0000000000..a8503ddf55
--- /dev/null
+++ b/browser/app/winlauncher/test/moz.build
@@ -0,0 +1,30 @@
+# -*- Mode: python; indent-tabs-mode: nil; tab-width: 40 -*-
+# vim: set filetype=python:
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at http://mozilla.org/MPL/2.0/.
+
+DisableStlWrapping()
+
+GeckoCppUnitTests(
+    [
+        "TestCrossProcessWin",
+        "TestSafeThreadLocal",
+        "TestSameBinary",
+    ],
+    linkage=None,
+)
+
+LOCAL_INCLUDES += [
+    "/browser/app/winlauncher",
+]
+
+OS_LIBS += [
+    "ntdll",
+]
+
+if CONFIG["CC_TYPE"] in ("gcc", "clang"):
+    # This allows us to use wmain as the entry point on mingw
+    LDFLAGS += [
+        "-municode",
+    ]