Firefox 158.0.1: install today for the baked-in certificate block

If you already jumped to Firefox 158.0 after mid-October, you are not done. On October 20, 2026, Mozilla shipped Firefox 158.0.1 on the Release channel with a high-impact security advisory and a short list of everyday fixes.

This is a follow-up to our Firefox 158.0 security note. Same major train. Newer build. New security set. It also hardens the eMudhra intermediate CA compromise response inside the browser itself. Check about:support again.

What Mozilla shipped

Mozilla’s Firefox 158.0.1 release notes (first offered October 20, 2026) list:

• An updated OneCRL block list for compromised eMudhra intermediate certificates (Mozilla first pushed the block through Remote Settings on October 17; this build carries the list itself, so the block holds even if Remote Settings is turned off or cannot be reached)
• A fix for pages scrolling back to the top when selecting text
• A Windows crash fix when printing or saving a page as PDF while a screen reader or other assistive technology is running
• A Linux multi-monitor fix for windows opening on the wrong display
• A fix that could prevent the built-in VPN from turning on for some users
• A macOS fix for files dragged into Firefox from other apps not landing on the page
• Various security fixes

The security details are in MFSA 2026-111 (announced October 20, 2026, impact high), fixed in Firefox 158.0.1:

• CVE-2026-113399: incorrect boundary conditions in the SVG component (high)
• CVE-2026-113470: cryptographic issue in the security block-list component, covering the eMudhra OneCRL update (high)
• CVE-2026-113400: uninitialized memory in the Audio/Video cubeb component (moderate)
• CVE-2026-113401: denial-of-service in the PDF Viewer component (low)

You do not need a scavenger hunt through Bugzilla. If about:support still shows plain 158.0, move to 158.0.1.

Why 158.0 is not enough anymore

Firefox 158.0 already carried a large October 13 security advisory. That install still matters. It does not include this October 20 set.

The eMudhra piece is the easy miss. Mozilla blocked the weak intermediates through Remote Settings on October 17. Remote Settings is how Firefox pulls many block lists while you browse. 158.0.1 also ships the updated OneCRL list inside the build, so the block still applies if Remote Settings is turned off by a policy or is unavailable on the network you use. Pair that with staying current on Chrome, Edge, Safari, and your phone OS, as covered in our eMudhra home-reader note.

Same habit every time:

1. Update
2. Fully quit and relaunch
3. Prove it with about:support

Downloaded is not running. The version line is the receipt.

How to update and verify on your computer

1. Open Firefox on the computer you actually browse with.
2. Check for updates.
   • Windows / Linux: Menu (three lines) → Help → About Firefox.
   • macOS: Firefox menu → About Firefox.
3. Stay on the About window until the download finishes. Firefox often says it is downloading or ready to restart.
4. Restart to update when prompted. Do not click Later and keep working in old windows.
5. Fully quit if the version still looks old. Close every Firefox window. On Windows, confirm in Task Manager that no firefox.exe helpers are left. On Mac, use Firefox → Quit Firefox. Then open Firefox again.
6. Verify with about:support. Type that into the address bar. On the Application Basics block, read Version. You want 158.0.1 (or a newer 158.0.x if Mozilla already moved past it).
7. Repeat on other home computers that still run Firefox, including a laptop that stays open for days and any shared family machine.

If About Firefox says an update is coming but will not offer 158.0.1 yet, wait for your Release roll to reach you, then force the check again. Prefer Mozilla’s own download links if a stuck profile update loop refuses to move.

Android Firefox is a separate store update

Desktop Release notes are for the computer browser. On phones, Mozilla published a matching high-impact advisory for Firefox for Android 158.0.2 (MFSA 2026-116, announced October 21, 2026), which also covers CVE-2026-113470 (the certificate block-list issue). A desktop update does not patch the phone app. Open Google Play (or your usual store), update Firefox, then open the app once so the new build launches.

Everyday fixes worth knowing

After you are patched, the non-security items in the 158.0.1 notes may explain annoyances you hit this week:

• Text selection jumping the page back to the top
• Windows print/PDF save crashes with assistive technology running
• Linux windows appearing on the wrong monitor
• Built-in VPN failing to turn on
• macOS drag-and-drop from other apps into Firefox failing

None of those replace the security update. They are bonus reasons to leave 158.0 behind.

Do this / don’t do that

Do

• Force About Firefox, relaunch, and confirm about:support shows 158.0.1.
• Treat MFSA 2026-111 as a patch signal, not a reading assignment.
• Update Firefox on Android separately if that is where you browse.
• If you run ESR on purpose, watch Mozilla’s ESR advisories separately. This article is for normal Release-channel home users.

Don’t

• Do not assume a Windows reboot alone applied 158.0.1 if about:support still shows 158.0.
• Do not leave old Firefox windows or background helpers running after an update prompt.
• Do not click through certificate warnings or turn off certificate checks because one site failed once.
• Do not assume updating Firefox also updated Chrome, Edge, Brave, or Safari.

Bottom line

Firefox 158.0.1 hit Release on October 20, 2026 with MFSA 2026-111 (high impact, including SVG and the eMudhra OneCRL bake-in) plus everyday fixes (release notes). This is beyond the earlier Firefox 158.0 package. On your home PC or Mac: open About Firefox, install, fully quit and relaunch, then confirm about:support shows 158.0.1. That is the whole job.

Image: Official Firefox browser logo (firefox.com) on a dark purple field.