fidzu : thunderbird

On Saturday, October 17, at 20:06 UTC, Mozilla received a report that private keys associated with eight eMudhra intermediate certificates had been compromised. These keys could allow attackers to issue fraudulent HTTPS certificates for websites they do not control. An attacker who could intercept a user's connection could use those certificates to impersonate websites and potentially read or modify traffic.

Mozilla engineers responded immediately, blocking the affected certificates in Firefox using OneCRL, Mozilla's centralized list of revoked certificates. OneCRL delivers this protection without requiring users to update or restart Firefox.

By 22:59 UTC that same day, in less than 3 hours after we received the report, the updated OneCRL distribution was complete for all Firefox users with standard configurations.

Today, we are also releasing Firefox 158.0.1 for Desktop and Android, along with Firefox ESR 115.43.1 and Firefox ESR 153.5.1. These releases will distribute this protection for a minority of users whose custom settings may have prevented them from receiving the OneCRL update.

We are also updating the trusted certificate list in NSS (NSS 3.131.1) to remove the root certificate that signed the affected intermediates. Firefox is already protected through OneCRL, but this additional update helps protect other applications that use Mozilla's trust store or versions derived from it and do not receive OneCRL updates.

Mozilla believes everyone has a fundamental right to security and privacy online. We remain committed to defending those rights and acting quickly to protect users.

Transparency is essential to trust. We will share more information as soon as circumstances allow.

The post Protecting Firefox users following the compromise of eMudhra intermediate certificates appeared first on Mozilla Security Blog.

20 Oct 2026 12:54pm GMT

Mobile browsers are a key gateway to the internet for 56 million people in the UK. Smartphone users spend around half an hour a day in these apps, and opening a browser is the most common way they look up information online.

Yet most people are using a smartphone browser that was preinstalled and set as the default for them, without ever being asked which browser they would actually prefer.

Mozilla believes people deserve an active choice in the tools they depend on every day, which is why the latest proposals from the UK Competition and Markets Authority (CMA) matter. We welcome the CMA's plans to give people a choice of search service and are asking it to consult on browser choice now, so both screens can launch together.

On September 23rd, the CMA published updated plans that would require Google to show people in the UK a choice of search service on new Android devices, covering the default search app and home-screen search widget as well as Chrome. Search choice screens would also appear in Chrome on other platforms, including through a major update for existing users. Some AI assistants would also be eligible to appear alongside search engines.

The proposals are well designed, but solve only half the problem

The CMA's mobile browser investigation found that preinstallation, prominent placement and default settings restrict browser competition. Mozilla's innovative 2023 experiment showed that properly designed browser choice screens can help people choose a browser they expect to keep using, and can be an effective tool for giving people agency over their online life. It also showed that an overwhelming majority of people (98%!) want to see them.

The EU Digital Markets Act has since demonstrated their impact in practice. We welcome the CMA's work on search choice, but people in the UK deserve browser choice too. Asking people to pick a search service inside a browser that most of them never actively chose in the first place leaves some of the biggest issues identified in the CMA's own mobile browser investigation unaddressed.

The CMA commissioned user research on search choice screens to refine and improve the proposals it first consulted on in January. Providers' positions on the choice screen would be fully randomised. Users would have to scroll to the bottom before confirming, and could "test drive" a search provider for at least a week.

The CMA has also recognized that search is changing. Its research found that many people were already using AI assistants to search alongside traditional search services. Under the revised, more technology-neutral eligibility criteria, an AI assistant could also qualify to appear on the search choice screen if it meets the requirements, including being able to search the web and attribute its sources. But browser choice should not be left behind.

Why the two choices belong together

• Less confusion. The CMA's new research found that participants often confused browsers with search services and were unsure what their search choice would change. Mozilla's research has revealed similar confusion. These findings support designing and testing the two screens together, with clear explanations of each decision.
  
• Less duplication. The CMA's work on search choice can also inform browser choice. Developing the two together would allow the design, order and timing to be tested as one journey, helping to avoid separate rounds of changes and interruptions for users.
  
• Order matters. Nobody chooses the furniture before the house. Browsers have their own search defaults, which is why we recommend showing the browser choice screen first, followed by the search screen, with wording that makes clear these are two separate decisions.

The EU and Japan already show both screens

The EU's Digital Markets Act introduced browser choice screens on iOS for the first time and brought browser and search choice together during Android set-up.

Browser first, then search, so the relationship between the two makes sense. In Japan, search and browser choice screens are presented on both Android and iOS.

And people are making use of the browser screen to select alternatives. In May, we reported Firefox is selected through a DMA choice screen once every ten seconds, with retention five times higher than for organic downloads. Other independent browsers have also reported substantial growth.

Choice matters more as AI moves into the browser

The CMA's proposals recognize that AI is changing how people search. AI is also changing what browsers offer, adding to the ways they compete on features, privacy and user control. Firefox already lets people on desktop pick which AI assistant sits in the sidebar, and our Smart Window beta extends that choice to the model behind the browser's own assistant. There are meaningful differences between browsers. AI is the latest example of why giving people an active choice matters.

When people aren't offered an active browser choice, they may be choosing search and AI services within a browser someone else picked. One decision taken at the factory can end up shaping the ones that follow. A search choice screen gives people a say over their search provider; offering browser choice alongside it would give them a say over that first decision too.

Our ask of the CMA

We're asking the CMA to consult now on browser choice screens for Apple's and Google's mobile platforms, so they can launch alongside the search screens. Apple and Google already offer browser choice screens in the EU and Japan. The CMA can draw on that experience and its own research to give people in the UK an active choice of both browser and search service.

Mozilla's response to the consultation is available here.

The post Why is the CMA asking us to choose the furniture before the house? The UK's search choice screens need browser choice screens alongside them appeared first on The Mozilla Blog.

20 Oct 2026 7:00am GMT

I've been working at Mozilla for eleven years, my golly. I'm still on my third hardware refresh (a Dell XPS I continue to dislike), I'm up to my fourth CEO, and 76 reorgs have happened (well, I know that quite a few things that would normally have counted haven't been counted there, so it's probably a higher number than that).

I'm still getting Firefox Desktop to use Glean instead of Legacy Telemetry. We're more than two-thirds of the way done with removing the legacy system, with concrete plans about what to do with the rest. I'm still not blogging as much as I'd like, but I have some honest hope that I might change that in no small part thanks to someone who mentioned in passing that they liked my posts.

Looking back at last year's predictions, I did indeed requisition a second work monitor, which is working out well.

I was right that FOG Migration hasn't completely removed all of Legacy Telemetry, though we're a lot closer than I thought we'd be. I do have a little time to think about doing other things, but not all that much, so the part of the prediction where I'd do something else is a "maybe".

My desire to push for a sensible user population measurement did not have a chance to be acted upon. We might be shifting what the business counts, but not to anything I've had a say in. At least one of the reorgs that happened changed the organizational distance between my team and the other parts of Data that would be involved in such a measurement, other non-work things took way too much time and resulted in slower overall work velocity, and FOG Migration kept taking priority.

I didn't think there'd be an All Hands, and in the off-change there were, it'd be a multi-city "Summit style" affair. I was half wrong twice: there wasn't an All Hands but there was indeed an all-Engineering Summit; it wasn't in multiple cities but just one. I was right that Toronto finally got its chance. I enjoyed the heck out of it as it really reminded me of some of the things I really missed about the All Hands of yore. It could've been a day longer, it could've been a little more of a polished experience like Brianna-era events were… but for not having done anything like this for two years, what an accomplishment. I was initially skeptical about spending hours of the first day making small talk deliberately with people you don't know on the subject of the work you do and how you do it, but once it was framed as an effort to scale-up and operationalize The Hallway Track I suddenly understood it.

I had wishful, hopeful thinking that the genAI bubble would have burst or a new shiny late-stage capitalist exploitation mechanism would be draining focus away from it by now. Alas neither. Though maybe things are beginning? I can dream.

I was also half-wrong about there being a new CEO but not yet sworn in. I didn't account for the candidate coming from within the org, meaning it could be quick. We've had Anthony hired and active for nearly a year now and he's… fine? So far the changes he's made to MoCo haven't been to any of the things I feel we need to change, so I can't really evaluate him. (Assuming that, since he (well, his reports) are able to evaluate my performance, it's only fair that I get to evaluate his in turn. That's how this works, right?)

Predictions for the coming year:

• We're going to stick with Anthony as CEO, keeping my count stable
• Firefox Enterprise is going to be a runaway success, finally giving MoCo that revenue diversification we've been aiming for
• Maybe the genAI bubble will have burst? (Yes, this is a duplicate from last year)
• I'll read The Psychology of Software Teams. It will frustrate me to finally be able to name and cite sources for how badly this industry treats its workers.
• FOG Migration will be "complete" (Legacy Telemetry probes will be gone, code will have been removed) and I'll move on to working on… maybe data consent management? Developing a way to find out which metrics are unused, and removing them? I have a few ideas.
• I'll still be complaining about this Dell XPS laptop, and considering what I'll be refreshing to the following February. Maybe I'll finally leave Windows behind?
• I will have blogged at least three times (setting my prediction deliberately and achievably low), probably mostly video game musings in my ongoing So I've Finished series. But I do have a draft of a work post about the history of public data tooling at Mozilla that I've been meaning to finish…

To another year of supporting The Mission!

19 Oct 2026 1:43pm GMT