October 22, 2026. Mozilla has added a Firefox for Android update to its response to compromised eMudhra certificate keys. Version 158.0.2, released October 21, addresses clients that did not immediately apply the bundled OneCRL blocklist after startup.
What Mozilla blocked
Mozilla says it received a report on October 17 that private keys for eight intermediate certificates had been compromised. With the ability to intercept a connection, an attacker could use fraudulent certificates to impersonate websites.
The affected certificates were blocked through OneCRL. Mozilla says distribution to normally configured Firefox installations finished within three hours, without requiring a browser restart.
Its October 20 releases—Firefox 158.0.1 for desktop and Android, plus ESR 115.43.1 and 153.5.1—also carried protection for users whose custom settings could prevent the automatic update. The Android follow-up is the newer relevant release.
Check your own installation
Android users should check their usual app store for Firefox updates. Desktop and managed ESR users should use the update channel appropriate to their installation. These version numbers describe Mozilla’s response; they are not a reason to downgrade a newer build.
Keep certificate warnings intact. A browser warning should be investigated through the affected service or administrator rather than bypassed to finish a login.
Source: Mozilla’s security advisory, including its October 21 update.
Featured photo: Zulfugar Karimov / Unsplash, used under the Unsplash License. Illustrative Firefox app photograph.
