Mozilla Foundation Security Advisory 2026-111
Security Vulnerabilities fixed in Firefox 158.0.1
- Announced
- October 20, 2026
- Impact
- high
- Products
- Firefox
- Fixed in
-
- Firefox 158.0.1
Note: We have changed how we publish advisories. We no longer roll all internally identified memory safety vulnerabilities into a single CVE and are now issuing an advisory for every individual bug.
#CVE-2026-113399: Incorrect boundary conditions in the SVG component
- Reporter
- Mozilla
- Impact
- high
References
#CVE-2026-113470: Cryptographic issue in the Security Block-lists, Allow-lists, and other State component
- Reporter
- Wayne
- Impact
- high
Description
Mozilla blocked compromised intermediate eMudhra certificates via OneCRL on the 17th of October which was distributed to clients via RemoteSettings the same day. This update contains the updated OneCRL block list, ensuring clients will block the compromised certificates even if RemoteSettings is disabled by policy or otherwise unavailable in the user's network environment.
References
#CVE-2026-113400: Uninitialized memory in the Audio/Video: cubeb component
- Reporter
- Mozilla
- Impact
- moderate
References
#CVE-2026-113401: Denial-of-service in the PDF Viewer component
- Reporter
- Ahmed Hesham
- Impact
- low