Mozilla's advisory MFSA 2026-111 (Oct 20) lists four fixes in Firefox 158.0.1: CVE-2026-113399 (incorrect boundary conditions in SVG, high), CVE-2026-113470 (high), CVE-2026-113400 (uninitialized memory in cubeb audio/video, moderate) and CVE-2026-113401 (PDF viewer DoS, low). No exploitation is reported.

CVE-2026-113470 is the follow-up to the eMudhra weak-key intermediates: Mozilla pushed the OneCRL block via Remote Settings on Oct 17, and this release bakes the block list into the browser so it holds even when Remote Settings is disabled by policy or unreachable. That matters for locked-down enterprise fleets that turn Remote Settings off.

Do now: push Firefox 158.0.1 (and Thunderbird 158.0.1, which per the CVE record also carries the SVG fix), prioritising managed fleets with Remote Settings disabled.