CVE-2026-113470: Vulnerability in Mozilla Firefox
Description
Mozilla Firefox addressed a vulnerability involving compromised intermediate eMudhra certificates by updating the OneCRL block list. This update ensures that clients block these compromised certificates even if RemoteSettings is disabled or unavailable. The issue was fixed in Firefox versions 158.0.1, ESR 153.5.1, and ESR 115.43.1.
Affected software
Mozilla
Firefox
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
Mozilla identified compromised intermediate eMudhra certificates and blocked them via the OneCRL mechanism on October 17. The block list was distributed to clients through RemoteSettings the same day. The update includes an enhanced OneCRL block list that enforces blocking of these compromised certificates regardless of RemoteSettings availability or policy settings. The vulnerability was remediated in Firefox 158.0.1, Firefox ESR 153.5.1, and Firefox ESR 115.43.1.
Potential Impact
The presence of compromised intermediate certificates could allow attackers to impersonate trusted entities or intercept secure communications if clients accepted these certificates. By blocking these certificates via OneCRL, Mozilla prevents such misuse. The update ensures protection even in network environments where RemoteSettings is disabled or unreachable.
Mitigation Recommendations
Users should update Firefox to version 158.0.1, Firefox ESR 153.5.1, or Firefox ESR 115.43.1 or later to receive the fix. The updated OneCRL block list is distributed automatically, including to clients with RemoteSettings disabled, ensuring mitigation without additional user action.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- mozilla
- Date Reserved
- 2026-10-20T08:27:10.793Z
- State
- PUBLISHED
- Vendor Advisory Urls
- [{"url":"https://www.mozilla.org/security/advisories/mfsa2026-111/","vendor":"Mozilla"},{"url":"https://www.mozilla.org/security/advisories/mfsa2026-112/","vendor":"Mozilla"},{"url":"https://www.mozilla.org/security/advisories/mfsa2026-113/","vendor":"Mozilla"}]
Threat ID: 6ad76a532cdf04f6562f8763
Added to database: 10/20/2026, 13:19:15 UTC
Last enriched: 10/20/2026, 13:33:23 UTC
Last updated: 10/20/2026, 13:33:23 UTC
Views: 4
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.