Mozilla's servers collect CRLs from all public CAs, join them with the CT-logged certificate corpus and build a cascade of filters that answers "revoked or not" without false results for any logged certificate. Clients download a full filter plus small updates (Firefox refreshes every 12 hours), so a lookup leaks nothing and adds no network round trip.
CRLite was researched by Larisch and colleagues (2017) and enabled for all Firefox desktop users in version 137 (2025); with Firefox 142 Mozilla stopped sending OCSP queries for domain-validated certificates. It depends on the CRL mandate and on CT logging of every certificate.
Other browsers use different aggregates: Chrome's CRLSets cover a curated subset of revocations, mostly intermediates and high-impact cases, and Mozilla's OneCRL covers intermediate certificates.