--- a/security/sandbox/win/src/sandboxbroker/sandboxBroker.cpp
+++ b/security/sandbox/win/src/sandboxbroker/sandboxBroker.cpp
@@ -6,16 +6,17 @@
 
 #include "sandboxBroker.h"
 
 #include "base/win/windows_version.h"
 #include "sandbox/win/src/sandbox.h"
 #include "sandbox/win/src/sandbox_factory.h"
 #include "sandbox/win/src/security_level.h"
 #include "mozilla/sandboxing/sandboxLogging.h"
+#include "mozilla/ArrayUtils.h"
 
 namespace mozilla
 {
 
 sandbox::BrokerServices *SandboxBroker::sBrokerService = nullptr;
 
 SandboxBroker::SandboxBroker()
 {
@@ -190,16 +191,31 @@ SandboxBroker::SetSecurityLevelForConten
 
   // The content process needs to be able to duplicate shared memory to the
   // broker process, which are Section type handles.
   result = mPolicy->AddRule(sandbox::TargetPolicy::SUBSYS_HANDLES,
                             sandbox::TargetPolicy::HANDLES_DUP_BROKER,
                             L"Section");
   ret = ret && (sandbox::SBOX_ALL_OK == result);
 
+  // Add the policy for crash reporter annotations.
+  wchar_t crashDumpAnnotationPath[MAX_PATH + 1];
+  uint32_t pathLen = ::GetTempPathW(mozilla::ArrayLength(crashDumpAnnotationPath),
+                                    crashDumpAnnotationPath);
+  if (pathLen > 0 && pathLen < mozilla::ArrayLength(crashDumpAnnotationPath)) {
+    // GetTempPath path ends with \ and returns the length without the null.
+    if (swprintf_s(crashDumpAnnotationPath + pathLen,
+                   mozilla::ArrayLength(crashDumpAnnotationPath) - pathLen,
+                   L"GeckoChildCrash%u.extra", GetCurrentProcessId()) > 0) {
+      mPolicy->AddRule(sandbox::TargetPolicy::SUBSYS_FILES,
+                       sandbox::TargetPolicy::FILES_ALLOW_ANY,
+                       crashDumpAnnotationPath);
+    }
+  }
+
   return ret;
 }
 #endif
 
 bool
 SandboxBroker::SetSecurityLevelForPluginProcess(int32_t aSandboxLevel)
 {
   if (!mPolicy) {