The change for phone users
Firefox users on Android have a follow-up security update to check. Mozilla’s October 21 release notes for version 158.0.2 identify a startup problem: some clients were not immediately applying a certificate blocklist supplied with the browser. The update addresses that gap.
The background is a report that private keys for eight eMudhra intermediate certificates had been compromised. Mozilla says it distributed blocks through OneCRL on October 17 and issued additional browser releases on October 20 for configurations that might not receive those blocks. The Android follow-up came the next day.
What this establishes
Mozilla’s response describes the danger of fraudulent website certificates when an attacker can intercept a connection. It does not establish that every Firefox user was attacked. The Android release is separate from the desktop and extended-support releases; readers should check the update offered for their own platform.
CGH perspective
A useful next step is to confirm the installed browser version through the normal app update channel. For a managed fleet, record which devices have received the fix instead of assuming a published update has reached every phone. This incident also illustrates why a browser’s background security data and its application version are separate things to track. CGH has not reproduced the incident or independently tested the remediation.