CVE-2026-41431: Mozconfig Unverified Updates Enabled
Mozilla build configuration explicitly enables unverified updates via '--enable-unverified-updates'. This allows signature-absent update packages (MAR) to be applied without cryptographic validation, exposing users to arbitrary code execution if update channels are compromised.
Provally CuratedPublic repositoryHighMedium confidenceVerifiedApache-2.0generic
greprules fetch cve-2026-41431-mozconfig-unverified-updates-enabled --engine opengrepDescription
Mozilla build configuration explicitly enables unverified updates via '--enable-unverified-updates'. This allows signature-absent update packages (MAR) to be applied without cryptographic validation, exposing users to arbitrary code execution if update channels are compromised.
Detection target
Not provided
Recommended fix
Not provided
False-positive notes
Not provided
Community feedback
Sign in to report false positives, mark this rule useful, or suggest metadata improvements.