CVE-2026-113470: Cryptographic issue in the Security Block-lists, Allow-lists, and other State component
Mozilla blocked compromised intermediate eMudhra certificates via OneCRL on the 17th of October which was distributed to clients via RemoteSettings the same day. This update contains the updated OneCRL block list, ensuring clients will block the compromised certificates even if RemoteSettings is disabled by policy or otherwise unavailable in the user's network environment.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 158.0.1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 153.5.1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 115.43.1 - Upgrade
Upgrade
Firefoxto a version that resolves this vulnerability.Fixed in 158.0.1 - Upgrade
Upgrade
Firefox ESRto a version that resolves this vulnerability.Fixed in 153.5.1 - Upgrade
Upgrade
Firefox ESRto a version that resolves this vulnerability.Fixed in 115.43.1 - Upgrade
Upgrade
Thunderbirdto a version that resolves this vulnerability.Fixed in 158.0.1 - Upgrade
Upgrade
Thunderbirdto a version that resolves this vulnerability.Fixed in 153.5.1
Event History
Parent advisories
This vulnerability appears in the following advisories.
Peer vulnerabilities
Found alongside the following vulnerabilities.
Frequently Asked Questions
Which deployments are most likely to remain exposed?
Firefox clients that have not received the updated OneCRL block list are exposed, particularly where RemoteSettings is disabled by policy or unavailable on the network. The fixed releases include the block list locally so those clients block the compromised intermediate eMudhra certificates.
What does an attacker need to exploit this issue?
The issue concerns compromised intermediate eMudhra certificates. Exploitation would require use of one of those compromised certificates against a client that does not yet have the updated OneCRL block list.
What should be done if RemoteSettings is disabled or unavailable?
Update to Firefox 158.0.1, Firefox ESR 153.5.1, or Firefox ESR 115.43.1. These releases include the updated OneCRL block list and do not depend on RemoteSettings distribution.