Loading vulnerability…
Incomplete blocking of compromised eMudhra certificates in Firefox and Thunderbird
CVE-2026-113470 is a certificate-blocklist issue in the Security Block-lists, Allow-lists, and other State component of Mozilla Firefox and Thunderbird. Clients missing an updated OneCRL blocklist may continue trusting certificate chains involving compromised eMudhra intermediate certificates, particularly when RemoteSettings is disabled by policy or unavailable on the network. Mozilla distributed the certificate blocks through RemoteSettings on October 17, 2026. Fixed application releases bundle the updated blocklist so the compromised certificates are rejected independently of RemoteSettings availability. Continued trust could enable certificate-based impersonation and interception of encrypted connections.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Affected clients may accept certificates chaining to compromised eMudhra intermediates, potentially enabling trusted-site or service impersonation and interception or modification of encrypted communications. Exploitation could compromise the confidentiality and integrity of information exchanged over those connections. No known exploits are identified, and no direct availability impact is established.
If you can’t patch tonight, do this now.
Pending application updates, ensure RemoteSettings is enabled, permitted by policy, and reachable, and verify that clients have received the OneCRL certificate blocks distributed on October 17, 2026. Clients that already received those blocks are protected against the identified compromised intermediates. Where RemoteSettings cannot operate, install a fixed release containing the bundled blocklist; no separate workaround is specified for those environments.
Patch, then assume compromise.
Upgrade desktop Firefox to 158.0.1 or later, Firefox for Android to 158.0.2 or later, Firefox ESR to 153.5.1 or 115.43.1 or later within the corresponding branch, and Thunderbird to 158.0.1 or 153.5.1 or later within the corresponding branch. Firefox 158.0.2 is also identified as a fixed release and is the recommended minimum in newer desktop scanner checks. Debian stable users should update firefox-esr to 153.5.1esr-1~deb13u1 or a later security-fixed package. On Oracle Linux 8, 9, and 10, install the ca-certificates updates associated with ELSA-2026-500449, ELSA-2026-500450, and ELSA-2026-500451, respectively. Some distribution packages are identified as having no planned vendor fix despite upstream fixes being available.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
32 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.