Mozilla Foundation Security Advisory 2026-112
Security Vulnerabilities fixed in Firefox ESR 153.5.1
- Announced
- October 20, 2026
- Impact
- high
- Products
- Firefox ESR
- Fixed in
-
- Firefox ESR 153.5.1
Note: We have changed how we publish advisories. We no longer roll all internally identified memory safety vulnerabilities into a single CVE and are now issuing an advisory for every individual bug.
#CVE-2026-113470: Cryptographic issue in the Security Block-lists, Allow-lists, and other State component
- Reporter
- Wayne
- Impact
- high
Description
Mozilla blocked compromised intermediate eMudhra certificates via OneCRL on the 17th of October which was distributed to clients via RemoteSettings the same day. This update contains the updated OneCRL block list, ensuring clients will block the compromised certificates even if RemoteSettings is disabled by policy or otherwise unavailable in the user's network environment.