OESA-2026-4652: firefox security update
Mozilla Firefox is an open-source web browser, designed for standards compliance, performance and portability. Security Fix(es):
Cryptographic issue in the Security Block-lists, Allow-lists, and other State component. This vulnerability was fixed in Firefox 158.0.1, Firefox ESR 153.5.1, Firefox ESR 115.43.1, Thunderbird 158.0.1, Thunderbird 153.5.1, and Firefox 158.0.2.(CVE-2026-113470)
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
openeuler/firefoxto a version that resolves this vulnerability.Fixed in 153.5.1-1.oe2403sp4 - Upgrade
Upgrade
Mozilla Firefoxto a version that resolves this vulnerability.Fixed in 158.0.1 - Upgrade
Upgrade
Mozilla Firefox ESRto a version that resolves this vulnerability.Fixed in 153.5.1 - Upgrade
Upgrade
Mozilla Firefox ESRto a version that resolves this vulnerability.Fixed in 115.43.1 - Upgrade
Upgrade
Mozilla Thunderbirdto a version that resolves this vulnerability.Fixed in 158.0.1 - Upgrade
Upgrade
Mozilla Thunderbirdto a version that resolves this vulnerability.Fixed in 153.5.1 - Upgrade
Upgrade
Mozilla Firefoxto a version that resolves this vulnerability.Fixed in 158.0.2
Event History
Frequently Asked Questions
What does an attacker need to exploit this issue?
The CVSS vector indicates that exploitation can be performed remotely with low attack complexity and no privileges, but it requires user interaction.
What is the expected impact if exploitation succeeds?
The reported impact is low confidentiality and low integrity impact. No availability impact is indicated.
Which releases include the fix?
The issue was fixed in Firefox 158.0.1 and 158.0.2, Firefox ESR 153.5.1, Firefox ESR 115.43.1, Thunderbird 158.0.1, and Thunderbird 153.5.1.