Improper Check for Certificate Revocation in Mozilla products - CVE-2026-113470

Vulnerability details

The vulnerability allows a remote attacker to potentially impersonate trusted websites and intercept sensitive communications using compromised certificates.

The vulnerability exists due to incomplete certificate revocation enforcement in the Security Block-lists, Allow-lists, and other State component when validating certificate chains involving compromised eMudhra intermediate certificates. A remote attacker can present a certificate chain relying on a compromised intermediate certificate to potentially have an untrusted connection accepted as trusted.

The affected scenario involves RemoteSettings being disabled by policy or otherwise unavailable.

Affected software

How to mitigate CVE-2026-113470

External References

• https://www.mozilla.org/en-US/security/advisories/mfsa2026-113/
• https://bugzilla.mozilla.org/show_bug.cgi?id=2083382
• https://www.mozilla.org/en-US/security/advisories/mfsa2026-112/
• https://www.mozilla.org/en-US/security/advisories/mfsa2026-111/

Related Security Bulletins

• Multiple vulnerabilities in Mozilla Firefox
• Debian update for firefox-esr