Mozilla reported a cryptographic flaw within the management of Security Block‑lists, Allow‑lists, and related state components. The flaw permits a compromised intermediate certificate to be treated as trusted, enabling an attacker to construct forged certificate chains. If an affected browser or client receives a RemoteSettings update containing the block‑list, revoked certificates are blocked, but systems that do not receive or apply the update continue to accept the malicious certificates, creating a window for man‑in‑the‑middle attacks, credential theft, or other public‑key‑infrastructure exploits.

Firefox versions prior to 158.0.1, ESR 153.5.1, and ESR 115.43.1 were affected. Thunderbird versions older than 158.0.1 and 153.5.1 also were affected. The update that resolves the issue is available in Firefox 158.0.1 and the specified ESR branches, and in Thunderbird 158.0.1 and 153.5.1; older builds remain vulnerable.

The CVSS score for this vulnerability is 5.4, indicating a moderate risk. Because compromised intermediate certificates are still considered trusted until the OneCRL block list is applied, an attacker who controls such a certificate can use it to convincingly impersonate legitimate sites. This oversight allows potential man‑in‑the‑middle, credential‑theft, or other attacks that rely on the trust chain of public key infrastructure. Clients that receive the update will block the revoked certificates automatically; those that do not remain vulnerable. The EPSS score is < 1%, and the vulnerability is not listed in KEV.