Hacker News Reader

ESR is affected, so it's possibly as old as July 2019. Maybe older.

The vuln is via IonMonkey JIT parsing. It might be as old as that project, I hope we find out how far back it goes.