Firefox 158.0.1 Released with Important Security Fixes
Firefox 158.0.1 is rolling out with security fixes and several bug fixes.
The update addresses a compromise involving eight intermediate certificates issued by the eMudhra certificate authority. Because their private keys were exposed, someone with access to them could create certificates that browsers would trust for websites. Combined with the ability to intercept a connection, this could allow an attacker to impersonate a site and read or modify traffic.
Mozilla revoked the certificates on 17 October, shortly after learning of the compromise, using its background OneCRL system. Firefox 158.0.1 includes the revocation in the browser update as well, protecting users whose network policies or settings prevent OneCRL updates.
The release also fixes issues including websites jumping to the top during text selection, the built-in VPN failing to activate for some users, Firefox windows appearing on the wrong monitor in Linux multi-monitor setups, and some JPEG XL images displaying semi-transparent areas too dark.
The update is available now. Firefox will generally install it automatically, though users who installed it through a repository or alternative app store may need to update manually. Ubuntu users with the Firefox Snap will receive it in the background; it takes effect after restarting the app.