Vulnerability in Mozilla Firefox

[ Description ]Official description

Cryptographic issue in the Security Block-lists, Allow-lists, and other State component. This vulnerability was fixed in Firefox 158.0.1, Firefox ESR 153.5.1, Firefox ESR 115.43.1, Thunderbird 158.0.1, Thunderbird 153.5.1, and Firefox 158.0.2.

[ Fixes ]Fixes and patches

• Security bulletin: Mozilla mfsa2026-116Vendor patch or bulletin · CERT-FR · mozilla.org/en-US/security/advisories/mfsa2026-116, cited by CERT-FR CERTFR-2026-AVI-1361
• Security bulletin: Mozilla mfsa2026-115Vendor patch or bulletin · CERT-FR · mozilla.org/en-US/security/advisories/mfsa2026-115, cited by CERT-FR CERTFR-2026-AVI-1346
• Security bulletin: Mozilla mfsa2026-113Vendor patch or bulletin · CERT-FR · mozilla.org/en-US/security/advisories/mfsa2026-113, cited by CERT-FR CERTFR-2026-AVI-1346
• Security bulletin: Mozilla mfsa2026-114Vendor patch or bulletin · CERT-FR · mozilla.org/en-US/security/advisories/mfsa2026-114, cited by CERT-FR CERTFR-2026-AVI-1346
• Security bulletin: Mozilla mfsa2026-111Vendor patch or bulletin · CERT-FR · mozilla.org/en-US/security/advisories/mfsa2026-111, cited by CERT-FR CERTFR-2026-AVI-1346
• Security bulletin: Mozilla mfsa2026-112Vendor patch or bulletin · CERT-FR · mozilla.org/en-US/security/advisories/mfsa2026-112, cited by CERT-FR CERTFR-2026-AVI-1346

[ Advisories ]Government CERT advisories

• CERT-FR22 Oct 2026CERTFR-2026-AVI-1361

  Vulnerability in Mozilla products Translated from French

  A vulnerability has been discovered in Mozilla products. It allows an attacker to cause a security problem not specified by the vendor.

  CVE-2026-113470
• CERT-FR21 Oct 2026CERTFR-2026-AVI-1346

  Multiple vulnerabilities in Mozilla products Translated from French

  Multiple vulnerabilities have been discovered in Mozilla products. Some of them allow an attacker to cause arbitrary code execution, a breach of data confidentiality and denial of service.

  CVE-2026-113400CVE-2026-113470CVE-2026-113868+5 more CVEs
• BSI CERT-Bund20 Oct 2026WID-SEC-2026-4064

  Mozilla products (Thunderbird, Firefox ESR and Firefox): Multiple vulnerabilities Translated from German

  Risk highCVE-2026-113866CVE-2026-113470CVE-2026-113399+5 more CVEs

[ References ]References

• bugzilla.mozilla.org/show_bug.cgi
• www.mozilla.org/security/advisories/mfsa2026-111
• www.mozilla.org/security/advisories/mfsa2026-112
• www.mozilla.org/security/advisories/mfsa2026-113
• www.mozilla.org/security/advisories/mfsa2026-114
• www.mozilla.org/security/advisories/mfsa2026-115
• www.mozilla.org/security/advisories/mfsa2026-116
• www.openwall.com/lists/oss-security/2026/10/20/30
• lists.debian.org/debian-lts-announce/2026/10/msg00041.html