CVE-2026-113470

A flaw was found in Firefox. When dynamic updates for certificate revocation lists are disabled or unavailable, the browser relies on built-in data that fails to block certain compromised intermediate Certificate Authority (CA) certificates. A remote attacker could exploit this flaw using fraudulent certificates to impersonate trusted websites and intercept encrypted network traffic.

This vulnerability is rated as having Moderate impact because exploitation requires an attacker in a privileged man-in-the-middle network position to present fraudulent certificates issued by compromised intermediate keys. Under standard configurations, Firefox automatically synchronizes certificate blocklists via RemoteSettings, which delivers revocation entries dynamically. Consequently, exposure is limited to systems operating in air-gapped environments or where background synchronization is restricted by enterprise policy.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.