Mozilla Updates Firefox and ESR for Certificate Blocklist and Component Flaws
Tech GuruQuick Answer
Mozilla released Firefox 158.0.1, Firefox ESR 153.5.1, and Firefox ESR 115.43.1. The updates embed the OneCRL block for compromised intermediate eMudhra certificates even where RemoteSettings is unavailable or disabled; the rapid-release build also fixes SVG, audio/video, and PDF Viewer flaws.
Update Each Managed Firefox Stream
What to do now: Inventory Firefox release channels, confirm the installed build against the matching Mozilla advisory, deploy 158.0.1, ESR 153.5.1, or ESR 115.43.1 as applicable, validate policy and certificate behavior, and retain deployment evidence.
Last verified: October 20, 2026 UTC. Recheck the advisory for the installed release stream before changing production.
Scope And Authority
| Product scope | Firefox 158, Firefox ESR 153, and Firefox ESR 115 |
|---|---|
| Advisories | MFSA 2026-111 / MFSA 2026-112 / MFSA 2026-113 |
| CVEs | CVE-2026-113399, CVE-2026-113400, CVE-2026-113401, CVE-2026-113470 |
| Authoritative release date | October 20, 2026 |
| Authority revision date | October 20, 2026 (initial publication; no later revision identified) |
| Affected versions | Firefox before 158.0.1, Firefox ESR 153 before 153.5.1, and Firefox ESR 115 before 115.43.1, within the advisory-specific scope. |
| Fixed versions | Firefox 158.0.1, Firefox ESR 153.5.1, or Firefox ESR 115.43.1, as applicable |
| Authority impact | High |
| CVSS base score | Not provided by the authority |
| CVSS severity | Not provided by the authority |
| Exploitation status | Not stated by Mozilla; no exploitation claim is inferred. |
What Changed
Mozilla published three high-impact advisories. All three fixed streams embed an updated OneCRL blocklist for compromised intermediate eMudhra certificates; Firefox 158.0.1 also addresses an SVG boundary flaw, uninitialized audio/video memory, and a PDF Viewer denial of service.
What To Validate Now
- Inventory. Locate managed and unmanaged Firefox installations; record the release channel, installed version, update policy, RemoteSettings policy, owner, and management platform.
- Establish applicability. Match each installation to MFSA 2026-111, MFSA 2026-112, or MFSA 2026-113. Do not apply a fixed version from one release stream to a different stream.
- Update. Use Mozilla's supported distribution or enterprise software channel to install Firefox 158.0.1, Firefox ESR 153.5.1, or Firefox ESR 115.43.1, according to the existing channel.
- Validate. Confirm the resulting version, restart state, enterprise policy application, trusted update source, and representative browsing, certificate-validation, media, SVG, and PDF workflows.
- Retain evidence. Preserve asset and owner identifiers, release channel, before-and-after versions, update-policy state, change approval, deployment output, restart and functional validation results, and any exception or rollback record.
Operational Cautions
Mozilla says the OneCRL certificate block was distributed through RemoteSettings on October 17; these builds also embed it for clients where RemoteSettings is disabled by policy or unavailable. Do not treat RemoteSettings delivery as proof that the installed browser binary is current. Mozilla did not publish a CVSS base score or claim exploitation in these advisories.
Evidence To Retain
- Exact Firefox release channel, installed version, update and RemoteSettings policy state, device and owner, management platform, and accountable change owner.
- UTC timestamps, approved change record, trusted package or installer source, deployment output, resulting version, restart state, and representative workflow tests.
- Certificate-validation results and any update, policy, compatibility, exception, remediation, or rollback records.
Related TechGeeks Resources
Authoritative References
Correction policy: If Mozilla changes affected versions, fixed versions, impact, exploitation information, mitigations, or required action, TechGeeks will update this notice and its verification date.
