Discussion
Some Firefox users on desktop haven’t received the OneCRL revocations, leaving them vulnerable to the recent eMudhra compromise. [1]
Firefox has an external system called Remote Settings that fetches data which needs to be updated regularly without requiring a full browser update. [2] It is also used for a very crucial purpose, OneCRL for fast certificate revocations/blocklisting.
1/3
@librewolf @mozilla Its FIINE they propably fired up that awesome AI at the office and it said that desktop is A OKAY 😂
While the latest version of LibreWolf fixes it, Firefox desktop itself and other desktop Firefox forks leave some users vulnerable because of this. Only Firefox Android has shipped a release containing this fix. [3] Please beware of this problem, which may seriously affect some users' security.
[1] https://emudhra.we-have-a-problem.com/
[2] https://remote-settings.readthedocs.io/en/latest/
[3] https://web.archive.org/web/20261022064212/https://www.firefox.com/en-US/firefox/android/158.0.2/releasenotes/
3/3
@oots I know. In fact, I believe I am the source for this toot. https://social.security.plumbing/@freddy/117477850448891431
We generally try to help, but it’s hard for forks that disable security features. Anyhow, @librewolf did the right thing in pushing a new release.
@freddy @oots You are not the source of the toot. Your toot also mistakenly claims that disabling the "Normandy" pref prevents Remote Settings from functioning and delivering the revocations, which is not true. I assume you are also including us with the statement "hard for forks that disable security features.", which is also not the case for us.
1/2
I think the criticism here was that the emudhra certs are removed *by update* *only* on Android. On other Firefox build targets (e.g. desktop), the emudhra certs are removed *only* through the remote settings mechanism.
Though upon reading https://blog.mozilla.org/security/2026/10/20/protecting-firefox-users-following-the-compromise-of-emudhra-intermediate-certificates/ , that doesn't seem correct, it should have happened in 158.0.1 ...
Maybe I misunderstood something. In that case: sorry for the confusion.
For most users that can access Remote Settings, there is no issue. However, some users may not be able to access it due to connection restrictions or other reasons, which would leave them vulnerable.
To counter this, Mozilla also ships the OneCRL data with browser releases, so users don't have to depend on Remote Settings. Unfortunately, the bundled data still requires an external sync event, which may just never happen if the user cannot access it, leaving them vulnerable.
2/3
Install Fedizen
Get the full app experience
@librewolf @mozilla cc: @dalias