OESA-2026-4651: firefox security update

Q: Which installations should be updated?

The affected software listed is openEuler Firefox. The issue is fixed in Firefox 158.0.1 and 158.0.2, Firefox ESR 153.5.1, and Firefox ESR 115.43.1; Thunderbird fixes are also listed in the advisory.

Q: Does exploitation require authentication or user interaction?

The CVSS vector indicates that no privileges are required and the attack can be conducted over the network. However, user interaction is required.

Q: What is the potential impact if the issue is exploited?

The severity is medium with a CVSS score of 5.4. The vector indicates low impact to confidentiality and integrity, with no availability impact.

Published Oct 29, 2026

Updated

Mozilla Firefox is an open-source web browser, designed for standards compliance, performance and portability. Security Fix(es):

Cryptographic issue in the Security Block-lists, Allow-lists, and other State component. This vulnerability was fixed in Firefox 158.0.1, Firefox ESR 153.5.1, Firefox ESR 115.43.1, Thunderbird 158.0.1, Thunderbird 153.5.1, and Firefox 158.0.2.(CVE-2026-113470)

Affected Software

1 affected componentFixes available

openeuler/firefox<153.5.1-1.oe2403sp3

153.5.1-1.oe2403sp3

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade openeuler/firefox to a version that resolves this vulnerability.
Fixed in 153.5.1-1.oe2403sp3
Upgrade
Upgrade Firefox to a version that resolves this vulnerability.
Fixed in 158.0.2
Upgrade
Upgrade Firefox ESR to a version that resolves this vulnerability.
Fixed in 153.5.1
Upgrade
Upgrade Firefox ESR to a version that resolves this vulnerability.
Fixed in 115.43.1
Upgrade
Upgrade Thunderbird to a version that resolves this vulnerability.
Fixed in 158.0.1
Upgrade
Upgrade Thunderbird to a version that resolves this vulnerability.
Fixed in 153.5.1

Event History

Oct 29, 2026

Advisory Published

via OSV·09:04 AM

Data Sourced

via OSV·09:04 AM

DescriptionSeverityAffected Software

Child vulnerabilities

Contains the following vulnerabilities.

CVE-2026-113470

Frequently Asked Questions

Which installations should be updated?

The affected software listed is openEuler Firefox. The issue is fixed in Firefox 158.0.1 and 158.0.2, Firefox ESR 153.5.1, and Firefox ESR 115.43.1; Thunderbird fixes are also listed in the advisory.

Does exploitation require authentication or user interaction?

The CVSS vector indicates that no privileges are required and the attack can be conducted over the network. However, user interaction is required.

What is the potential impact if the issue is exploited?

The severity is medium with a CVSS score of 5.4. The vector indicates low impact to confidentiality and integrity, with no availability impact.

OESA-2026-4651: firefox security update

Affected Software

Remediation

Event History

Child vulnerabilities

Frequently Asked Questions

Which installations should be updated?

Does exploitation require authentication or user interaction?

What is the potential impact if the issue is exploited?

Company

Resources

Contact

Frequently Asked Questions

Which installations should be updated?

Does exploitation require authentication or user interaction?

What is the potential impact if the issue is exploited?