CVE-2026-113470
published 2026-10-20CVE-2026-113470: Cryptographic issue in the Security Block-lists, Allow-lists, and other State component. This vulnerability was fixed in Firefox 158.0.1, Firefox ESR 153.5.1…
PriorityP427medium5.4CVSS 3.1
AVNACLPRNUIRSUCLILAN
EPSS
0.46%
39.8th percentile
Cryptographic issue in the Security Block-lists, Allow-lists, and other State component. This vulnerability was fixed in Firefox 158.0.1, Firefox ESR 153.5.1, Firefox ESR 115.43.1, Thunderbird 158.0.1, Thunderbird 153.5.1, and Firefox 158.0.2.
Affected
11 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| electron | electron | >= 0 < 42.11.16 | 42.11.16 |
| electron | electron | >= 43.0.0-alpha.1 < 43.8.1 | 43.8.1 |
| electron | electron | >= 44.0.0-alpha.1 < 44.9.1 | 44.9.1 |
| electron | electron | >= 45.0.0-alpha.1 < 45.0.0-beta.6 | 45.0.0-beta.6 |
| mozilla | firefox | < Firefox 158.0.2 | Firefox 158.0.2 |
| mozilla | firefox | < Firefox 158.0.1 | Firefox 158.0.1 |
| mozilla | firefox | — | — |
| mozilla | firefox_esr | < Firefox ESR 115.43.1 | Firefox ESR 115.43.1 |
| mozilla | firefox_esr | < Firefox ESR 153.5.1 | Firefox ESR 153.5.1 |
| mozilla | thunderbird | < Thunderbird 158.0.1 | Thunderbird 158.0.1 |
| mozilla | thunderbird | < Thunderbird 153.5.1 | Thunderbird 153.5.1 |
CVSS provenance
nvdv3.15.4MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
ghsa5.4MEDIUM
vendor_redhat5.4MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
firefox: Firefox: Website spoofing via failure to block compromised intermediate certificates
vendor_redhat·2026-10-20·CVSS 5.4
CVE-2026-113470 [MEDIUM] CWE-295 firefox: Firefox: Website spoofing via failure to block compromised intermediate certificates
firefox: Firefox: Website spoofing via failure to block compromised intermediate certificates
A flaw was found in Firefox. When dynamic updates for certificate revocation lists are disabled or unavailable, the browser relies on built-in data that fails to block certain compromised intermediate Certificate Authority (CA) certificates. A remote attacker could exploit this flaw using fraudulent certificates to impersonate trusted websites and intercept encrypted network traffic.
Package: firefox (Red Hat Enterprise Linux 10) - Fix deferred
Package: firefox (Red Hat Enterprise Linux 7) - Fix deferred
Package: firefox (Red Hat Enterprise Linux 8) - Fix deferred
Package: firefox (Red Hat Enterprise Linux 9) - Fix deferred
Mozilla
Mozilla Foundation Security Advisory 2026-113: CVE-2026-113470
vendor_mozilla
CVE-2026-113470 Mozilla Foundation Security Advisory 2026-113: CVE-2026-113470
Mozilla Foundation Security Advisory 2026-113
CVE: CVE-2026-113470
Product: Firefox ESR
Impact: high
Fixed in: Firefox ESR 115.43.1
Mozilla
Mozilla Foundation Security Advisory 2026-114: CVE-2026-113470
vendor_mozilla
CVE-2026-113470 Mozilla Foundation Security Advisory 2026-114: CVE-2026-113470
Mozilla Foundation Security Advisory 2026-114
CVE: CVE-2026-113470
Product: Thunderbird
Impact: low
Fixed in: Thunderbird 158.0.1
Mozilla
Mozilla Foundation Security Advisory 2026-116: CVE-2026-113470
vendor_mozilla·CVSS 5.4
CVE-2026-113470 [MEDIUM] Mozilla Foundation Security Advisory 2026-116: CVE-2026-113470
Mozilla Foundation Security Advisory 2026-116
CVE: CVE-2026-113470
Product: Firefox
Impact: high
Fixed in: Firefox 158.0.2
Mozilla
Mozilla Foundation Security Advisory 2026-115: CVE-2026-113470
vendor_mozilla
CVE-2026-113470 Mozilla Foundation Security Advisory 2026-115: CVE-2026-113470
Mozilla Foundation Security Advisory 2026-115
CVE: CVE-2026-113470
Product: Thunderbird
Impact: high
Fixed in: Thunderbird 153.5.1
Mozilla
Mozilla Foundation Security Advisory 2026-111: CVE-2026-113470
vendor_mozilla
CVE-2026-113470 Mozilla Foundation Security Advisory 2026-111: CVE-2026-113470
Mozilla Foundation Security Advisory 2026-111
CVE: CVE-2026-113470
Product: Firefox
Impact: low
Fixed in: Firefox 158.0.1
Mozilla
Mozilla Foundation Security Advisory 2026-112: CVE-2026-113470
vendor_mozilla
CVE-2026-113470 Mozilla Foundation Security Advisory 2026-112: CVE-2026-113470
Mozilla Foundation Security Advisory 2026-112
CVE: CVE-2026-113470
Product: Firefox ESR
Impact: high
Fixed in: Firefox ESR 153.5.1
GHSA
Electron: Mitigation for compromised eMudhra intermediate certificates
ghsa·2026-10-23·CVSS 5.4
CVE-2026-115570 [MEDIUM] CWE-299 Electron: Mitigation for compromised eMudhra intermediate certificates
Electron: Mitigation for compromised eMudhra intermediate certificates
### Impact
A set of eMudhra intermediate certificates were compromised and are being blocked by browsers and other TLS clients. This Electron update adds the same block to both Chromium networking and Node.js `tls`, `https` and `fetch`. On earlier versions, an attacker holding a certificate issued through these intermediates and able to intercept network traffic could impersonate a TLS server to an app.
Apps are only affected if they make TLS connections over a network an attacker can intercept. Apps that make no network connections are not affected.
Other software has shipped the same mitigation, including Go (CVE-2026-111943) and Firefox (CVE-2026-113470).
### Workarounds
There are no app side workarounds, you m
GHSA
Mozilla blocked compromised intermediate eMudhra certificates via OneCRL on the 17th of October which was distributed to clients via RemoteSettings the same day.
ghsa_unreviewed·2026-10-20
CVE-2026-113470 [MEDIUM] CWE-295 Mozilla blocked compromised intermediate eMudhra certificates via OneCRL on the 17th of October which was distributed to clients via RemoteSettings the same day.
Mozilla blocked compromised intermediate eMudhra certificates via OneCRL on the 17th of October which was distributed to clients via RemoteSettings the same day. This update contains the updated OneCRL block list, ensuring clients will block the compromised certificates even if RemoteSettings is disabled by policy or otherwise unavailable in the user's network environment. This vulnerability was fixed in Firefox 158.0.1, Firefox ESR 153.5.1, and Firefox ESR 115.43.1.
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2026-113470 firefox: Firefox: Website spoofing via failure to block compromised intermediate certificates [fedora-all]
bugzilla·2026-10-21·CVSS 5.4
CVE-2026-113470 [MEDIUM] CVE-2026-113470 firefox: Firefox: Website spoofing via failure to block compromised intermediate certificates [fedora-all]
CVE-2026-113470 firefox: Firefox: Website spoofing via failure to block compromised intermediate certificates [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Mozilla blocked compromised intermediate eMudhra certificates via OneCRL on the 17th of October which was distributed to clients via RemoteSettings the same day. This update contains the updated OneCRL block list, ensuring clients will block the compromised certificates even if RemoteSettings is disabled by policy or otherwise unavailable in the user's network environment. This vulnerability was fixed in Firefox 158.0.1, Firefox ESR 153.5.1, and F
Bugzilla
CVE-2026-113470 firefox: Firefox: Website spoofing via failure to block compromised intermediate certificates
bugzilla·2026-10-20·CVSS 5.4
CVE-2026-113470 [MEDIUM] CVE-2026-113470 firefox: Firefox: Website spoofing via failure to block compromised intermediate certificates
CVE-2026-113470 firefox: Firefox: Website spoofing via failure to block compromised intermediate certificates
Mozilla blocked compromised intermediate eMudhra certificates via OneCRL on the 17th of October which was distributed to clients via RemoteSettings the same day. This update contains the updated OneCRL block list, ensuring clients will block the compromised certificates even if RemoteSettings is disabled by policy or otherwise unavailable in the user's network environment. This vulnerability was fixed in Firefox 158.0.1, Firefox ESR 153.5.1, and Firefox ESR 115.43.1.
Hackernews
Eight eMudhra CA Keys Compromised, Triggering Emergency Fixes Across Browsers and Software
blogs_hackernews·2026-10-20
CVE-2026-111943 Eight eMudhra CA Keys Compromised, Triggering Emergency Fixes Across Browsers and Software
Home
Threat Intelligence
Vulnerabilities
Cyber Attacks
Webinars
Expert Insights
Awards
Webinars
Awards
Free eBooks
About THN
Jobs
Advertise with us
## Eight eMudhra CA Keys Compromised, Triggering Emergency Fixes Across Browsers and Software
The private keys of eight eMudhra intermediate certificate authority (CA) certificates are compromised, Mozilla and Google's Chrome Root Program confirms on October 20.
An intermediate CA signs the certificates that websites present, so anyone holding one of these keys could issue a certificate for any website that a browser would accept.
A researcher reported the compromise to the root programs on the evening of October 17, and Chrome and Firefox blocked the eight certificates within hours, after Chrome verified the findings.
No TLS
https://bugzilla.mozilla.org/show_bug.cgi?id=2084311https://www.mozilla.org/security/advisories/mfsa2026-111/https://www.mozilla.org/security/advisories/mfsa2026-112/https://www.mozilla.org/security/advisories/mfsa2026-113/https://www.mozilla.org/security/advisories/mfsa2026-114/https://www.mozilla.org/security/advisories/mfsa2026-115/https://www.mozilla.org/security/advisories/mfsa2026-116/http://www.openwall.com/lists/oss-security/2026/10/20/30https://lists.debian.org/debian-lts-announce/2026/10/msg00041.html
2026-10-20
Published