diff --git a/firefox-140.3.1esr.source.tar.xz b/firefox-140.4.0esr.source.tar.xz
similarity index 32%
rename from firefox-140.3.1esr.source.tar.xz
rename to firefox-140.4.0esr.source.tar.xz
index 6020b6d5798669ea6d467f58bca9515633fb94e9..c12231bce1afe2ffccb6fb555adcb47e405e5a4c 100644
--- a/firefox-140.3.1esr.source.tar.xz
+++ b/firefox-140.4.0esr.source.tar.xz
@@ -1,3 +1,3 @@
 version https://git-lfs.github.com/spec/v1
-oid sha256:0b43b3a1c4f40765d96eb2094d38838f5d01b7280ad8b9b0a17612bed9c36735
-size 634713368
+oid sha256:49f20673171046bc7b64f4caa340c46e1e105b9107f0ef68b7a94f379bcea4f7
+size 639276460
diff --git a/firefox-langpacks-140.3.1esr.tar.xz b/firefox-langpacks-140.4.0esr.tar.xz
similarity index 32%
rename from firefox-langpacks-140.3.1esr.tar.xz
rename to firefox-langpacks-140.4.0esr.tar.xz
index c9143c9bec57026261d60f3a1a8fd2dd1066d292..490fe7932f4ebc68b056fbb060140ca154a67486 100644
--- a/firefox-langpacks-140.3.1esr.tar.xz
+++ b/firefox-langpacks-140.4.0esr.tar.xz
@@ -1,3 +1,3 @@
 version https://git-lfs.github.com/spec/v1
-oid sha256:82dc20fa74ea0ae47f227fd1f8ffee4147ff23efeaecb93f32ee2f9d621286f5
-size 33508096
+oid sha256:50bd29d5cc5d58864ce1ed51b4821a71a06a4ee9e57c075b4375476a70e61f8c
+size 33475680
diff --git a/firefox.spec b/firefox.spec
index 3284b52d5fd1ab9d57b4956668e6e04aeeee092c..2bf573945f023bd2acb118faa732465ada427207 100644
--- a/firefox.spec
+++ b/firefox.spec
@@ -51,8 +51,8 @@
 
 Summary:        Mozilla Firefox Web browser
 Name:           firefox
-Version:        140.3.1
-Release:        2
+Version:        140.4.0
+Release:        1
 URL:            https://www.mozilla.org/firefox/
 License:        MPL-1.1 or GPL-2.0-or-later or LGPL-2.0-or-later
 Source0:        https://ftp.mozilla.org/pub/firefox/releases/%{version}esr/source/firefox-%{version}esr.source.tar.xz
@@ -1011,6 +1011,11 @@ gtk-update-icon-cache %{_datadir}/icons/hicolor &>/dev/null || :
 %endif
 
 %changelog
+* Mon Oct 13 2025 Funda Wang <fundawang@yeah.net> - 140.4.0-1
+- update to 140.4.0
+- fix CVE-2025-11708, CVE-2025-11709, CVE-2025-11710, CVE-2025-11711,
+  CVE-2025-11712, CVE-2025-11713, CVE-2025-11714, CVE-2025-11715
+
 * Sat Oct 11 2025 wangkai <13474090681@163.com> - 140.3.1-2
 - Disable use_gcc_ts marco