CVE-2020-26957: 
NixOS vulnerability analysis and mitigation

OneCRL was non-functional in Firefox for Android (Fenix) due to a missing service initialization, tracked as CVE-2020-26957. The vulnerability was discovered in 2020 and affected Firefox for Android versions prior to 83. This security issue was specific to the Android version of Firefox, with other operating systems remaining unaffected (Mozilla Advisory).

The vulnerability stemmed from a regression introduced during code reorganization where initialization code was moved from the security module to the browser component without including the corresponding code in mobile implementations. This resulted in OneCRL, Mozilla's certificate revocation mechanism, failing to initialize properly in Firefox for Android. The issue was assigned a CVSS v3.1 base score of 6.5 (Medium) with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N (NVD).

The vulnerability prevented Firefox for Android from enforcing certificate revocations through OneCRL, which is Mozilla's mechanism for addressing compromised or maliciously issued certificates. This could potentially allow connections to websites using revoked certificates, exposing users to security risks from compromised or malicious certificates that should have been blocked (Mozilla Bug).

While there were no reported instances of this vulnerability being exploited in the wild, the impact was considered moderate due to its potential to bypass certificate revocation checks. The vulnerability required no special privileges to exploit, though its impact was limited to certificate revocation enforcement (Mozilla Advisory).

The vulnerability was fixed in Firefox for Android version 83 by properly initializing the OneCRL service when GeckoView starts. Users were advised to update to Firefox for Android version 83 or later to receive the security fix (Mozilla Advisory).