Updated: 27 October 2026. Mozilla has provided several protection paths following compromised eMudhra intermediate certificates. Distinguish automatically delivered revocations, the bundled list and the Android startup fix; do not disable certificate verification.
Which installation?
For Firefox users and managed workstations: desktop 158.0.1 release notes dated 20 October describe a bundled OneCRL list for clients where policy or network conditions prevent Remote Settings delivery [1]. Android 158.0.2, released 21 October, additionally fixes installation of the predistributed list at startup [2]. Advisory CVE-2026-113470 is rated high [3]. Do not apply the Android version number to desktop or iOS. Mozilla dates the incident to 17 October. Its security blog of 20 October, updated 21 October, distinguishes ordinary OneCRL delivery from additional browser updates. It also lists ESR 115.43.1 and 153.5.1 as fixes released then. ESR users should not switch to Release for this guide: check the currently supported channel for their platform with IT [5].
Prepare without losing data
You need access to version information and the approved update route; involve IT for managed devices. Save important open work and check available recovery or profile backups before updating. Initial diagnosis requires no reinstall, profile reset or certificate import.
Five safe checks
- Identify the installation: record operating system, Firefox channel and running version. On desktop use Help → About Firefox; on Android use the app's version information. Keep ESR, Release, Beta and other Mozilla-based applications separate.
- Use the official updater, or the package manager/IT deployment for managed desktop installations. On Android use the trusted store or existing managed distribution. 158.0.1 and Android 158.0.2 are the documented correction versions here, not reasons to skip later approved security updates [1][2].
- Finish the update and restart Firefox normally after saving work. Applying the bundled OneCRL list at startup is precisely the Android correction; a store listing alone does not verify the version actually running [2].
- Do not disable Remote Settings, certificate verification or company policies as an experiment. Ask IT about the normal update route if it is unavailable. Do not import unknown root certificates or bypass warnings with exceptions.
- After restarting, recheck the version and update completion. Open a known trusted HTTPS page normally. If a certificate warning persists, stop and report hostname, time and exact error code to IT, without confidential URL parameters. Do not enter credentials while the warning remains.
Verification and recovery
Success here means the intended approved version is running and update completion is confirmed. A normally loading website does not prove every compromised certificate path is blocked. Controlled revocation testing was not performed for this article. Do not roll back to an insecure old browser; retain data, pause production use if needed and arrange supported recovery with IT.
Limits
OneCRL can distribute certificate revocations separately from a full browser update [4]. The bundled list covers a different delivery route, not all future security fixes or other browsers, TLS libraries and servers. A padlock is not comprehensive proof of security. Source-based guidance, not a hands-on Firefox/Android test. No affiliate links.