Firefox 158.0.1 Patches Security Flaws
The update addresses four vulnerabilities and revokes compromised eMudhra certificates to secure browser traffic.
Updated on Oct. 21, 2026 in Cybersecurity
Live Poll
Do you feel it is important to update your web browser immediately when security patches arrive?
Mozilla has released Firefox 158.0.1 to address four security vulnerabilities, including a denial-of-service flaw in the browser's PDF Viewer. The update also blocks compromised eMudhra intermediate certificates via the OneCRL block list, ensuring the security fix is applied even if Remote Settings are disabled.
Why it matters
The update secures browser communications by revoking trust in compromised certificate authorities and eliminates functional bugs that impacted file interactions and system stability. By hard-coding the block list update, Mozilla ensures protection for users who enforce strict enterprise security policies.
Firefox 158.0.1 incorporates four distinct security patches and a OneCRL update that forces the revocation of eMudhra intermediate certificates. This mechanism bypasses policy-based restrictions on Remote Settings to guarantee that the revoked trust list is active across all installations.
The players
Mozilla
The open-source organization behind the Firefox web browser and the Gecko rendering engine.
eMudhra
A digital identity and certificate authority provider whose intermediate certificates were identified as compromised.
The details
The update mitigates a denial-of-service vulnerability—a flaw that allows an attacker to crash a service or application—found in the PDF Viewer component. By updating the OneCRL list, the browser cross-references site certificates against a Mozilla-managed database of revoked or untrusted authorities. Additionally, the release includes targeted patches for platform-specific regressions, such as a Linux multi-monitor window placement error and a macOS file-dropping failure.
Timeline
October 17, 2026: Security rules formally blocked compromised eMudhra certificates.
October 20, 2026: Mozilla released Firefox 158.0.1 for general availability.
The Tech Race
Modern browsers rely on automated revocation lists to maintain trust in an increasingly fragmented certificate ecosystem. This release follows the established industry practice of using automated block lists to preemptively neutralize compromised certificate authorities.
Users can install the update immediately via official binaries or as a Flatpak from Flathub to resolve stability issues during printing and PDF saving. The update is effective globally, automatically correcting previous bugs that hindered text selection and file dragging on specific operating systems.
The takeaway
Users should verify they have received version 158.0.1 to ensure the OneCRL block list is active and security patches are applied. Monitor subsequent minor releases for additional fixes if you frequently utilize assistive technologies for printing or PDF workflows on Windows.
Further reading
For broader trends in browser safety and threat mitigation, explore the Cybersecurity section.
Live Poll
Do you feel it is important to update your web browser immediately when security patches arrive?
