CVE-2026-113470

What it actually does

Cryptographic weakness in the handling of security block-lists, allow-lists, and related state permits an attacker to bypass intended restrictions, resulting in limited unauthorized disclosure and modification of protected resources when a user interacts with a malicious site.

Why it matters to the business

Organizations relying on Firefox or Thunderbird may experience increased risk of malware delivery or data exposure through bypassed security controls, requiring prompt patching to maintain browser-based protections across the user base.

How an attack unfolds

An attacker hosts a malicious web page or sends a crafted link that, when visited by a user, triggers the cryptographic flaw in list validation, allowing the attacker to inject or bypass block/allow entries and achieve limited access to otherwise restricted content or actions.

How to fix it

Upgrade Firefox to 158.0.1 or 158.0.2, Firefox ESR to 153.5.1 or 115.43.1, and Thunderbird to 158.0.1 or 153.5.1. Verify the installed version after update and restart the application.

How to confirm the fix worked

Confirm the browser or email client reports one of the listed fixed versions in the About dialog; retest known affected list behaviors in a controlled environment to ensure enforcement is restored.

Typical attack path

1. Attacker prepares a malicious webpage or email link designed to interact with the browser's security list mechanisms.
2. Victim is enticed to visit the page or open the link, satisfying the required user interaction condition.
3. The cryptographic weakness is triggered, permitting bypass of block-list or allow-list enforcement.
4. Attacker achieves limited read or write access to protected browser state or resources.

How to detect it

Review browser update logs and version telemetry for instances still running pre-fix releases; examine web proxy or endpoint logs for access to suspicious domains that could trigger list bypass attempts.

What your security team should do

• Prioritize deployment of the specified updates across all Firefox and Thunderbird instances within the next patching cycle.
• Monitor vendor advisories for any follow-on releases addressing related cryptographic components.
• Educate users on avoiding untrusted links until patches are applied.