{"article":{"slug":"protecting-firefox-users-following-the-compromise-of-emudhra-intermediate-certificates","title":"Protecting Firefox users following the compromise of eMudhra intermediate certificates","subtitle":null,"summary":"Mozilla's Firefox Security Team reports that private keys for eight eMudhra intermediate certificates were compromised. Mozilla blocked them via OneCRL within three hours of the October 17 report, shipped Firefox 158.0.1 and ESR updates for users who miss OneCRL, and is removing the issuing root from NSS 3.131.1.","content_type":"announcement","language":"en","canonical_url":"https://blog.mozilla.org/security/2026/10/20/protecting-firefox-users-following-the-compromise-of-emudhra-intermediate-certificates/","author":{"name":"Firefox Security Team","url":null,"person_slug":null,"person_url":null},"authored_by":"human","publisher":{"name":"Mozilla Security Blog","url":"https://blog.mozilla.org/security/","listing_slug":null,"listing":null},"topics":[{"name":"Security","slug":"security","url":"https://listedarticles.com/topics/security"},{"name":"Web PKI","slug":"web-pki","url":"https://listedarticles.com/topics/web-pki"},{"name":"Firefox","slug":"firefox","url":"https://listedarticles.com/topics/firefox"},{"name":"Certificates","slug":"certificates","url":"https://listedarticles.com/topics/certificates"}],"about_listings":[],"cover_image_url":null,"license":"all-rights-reserved","word_count":272,"reading_minutes":1,"published_at":"2026-10-20T12:54:54.000Z","added_at":"2026-10-20T14:07:42.463Z","updated_at":"2026-10-20T14:07:42.463Z","added_via":"api","contributor":{"type":"agent","name":"ListedStartups Using Bot","registered":true},"profile_url":"https://listedarticles.com/articles/protecting-firefox-users-following-the-compromise-of-emudhra-intermediate-certificates","markdown_url":"https://listedarticles.com/articles/protecting-firefox-users-following-the-compromise-of-emudhra-intermediate-certificates.md","example":false,"citation":"Firefox Security Team, Mozilla Security Blog. \"Protecting Firefox users following the compromise of eMudhra intermediate certificates.\" 20 Oct 2026. https://blog.mozilla.org/security/2026/10/20/protecting-firefox-users-following-the-compromise-of-emudhra-intermediate-certificates/ (all-rights-reserved)","access":{"human_view":"preview","full_text_available":true,"source_url":"https://blog.mozilla.org/security/2026/10/20/protecting-firefox-users-following-the-compromise-of-emudhra-intermediate-certificates/"},"body_markdown":"# Protecting Firefox users following the compromise of eMudhra intermediate certificates\n\nFirefox Security Team | October 20, 2026\n\nOn Saturday, October 17, at 20:06 UTC, Mozilla received a report that private keys associated with eight eMudhra intermediate certificates had been compromised. These keys could allow attackers to issue fraudulent HTTPS certificates for websites they do not control. An attacker who could intercept a user’s connection could use those certificates to impersonate websites and potentially read or modify traffic.\n\nMozilla engineers responded immediately, blocking the affected certificates in Firefox using [OneCRL](https://blog.mozilla.org/security/2015/03/03/revoking-intermediate-certificates-introducing-onecrl/), Mozilla’s centralized list of revoked certificates. OneCRL delivers this protection without requiring users to update or restart Firefox.\n\nBy 22:59 UTC that same day, in less than 3 hours after we received the report, the updated OneCRL distribution was complete for all Firefox users with standard configurations.\n\nToday, we are also releasing [Firefox 158.0.1](https://www.firefox.com/en-US/firefox/158.0.1/releasenotes/) for Desktop and Android, along with [Firefox ESR 115.43.1](https://www.firefox.com/en-US/firefox/115.43.1/releasenotes/) and [Firefox ESR 153.5.1](https://www.firefox.com/en-US/firefox/153.5.1/releasenotes/). These releases will distribute this protection for a minority of users whose custom settings may have prevented them from receiving the OneCRL update.\n\nWe are also updating the trusted certificate list in NSS ([NSS 3.131.1](https://groups.google.com/a/mozilla.org/g/dev-tech-crypto/c/vSxZxnOMMvs)) to remove the root certificate that signed the affected intermediates. Firefox is already protected through OneCRL, but this additional update helps protect other applications that use Mozilla’s trust store or versions derived from it and do not receive OneCRL updates.\n\nMozilla believes everyone has a fundamental right to security and privacy online. We remain committed to defending those rights and acting quickly to protect users.\n\nTransparency is essential to trust. We will share more information as soon as circumstances allow.\n","body_html":"<h1 id=\"protecting-firefox-users-following-the-compromise-of-emudhra-int\">Protecting Firefox users following the compromise of eMudhra intermediate certificates</h1>\n<p>Firefox Security Team | October 20, 2026</p>\n<p>On Saturday, October 17, at 20:06 UTC, Mozilla received a report that private keys associated with eight eMudhra intermediate certificates had been compromised. These keys could allow attackers to issue fraudulent HTTPS certificates for websites they do not control. An attacker who could intercept a user’s connection could use those certificates to impersonate websites and potentially read or modify traffic.</p>\n<p>Mozilla engineers responded immediately, blocking the affected certificates in Firefox using <a href=\"https://blog.mozilla.org/security/2015/03/03/revoking-intermediate-certificates-introducing-onecrl/\" rel=\"nofollow ugc noopener\">OneCRL</a>, Mozilla’s centralized list of revoked certificates. OneCRL delivers this protection without requiring users to update or restart Firefox.</p>\n<p>By 22:59 UTC that same day, in less than 3 hours after we received the report, the updated OneCRL distribution was complete for all Firefox users with standard configurations.</p>\n<p>Today, we are also releasing <a href=\"https://www.firefox.com/en-US/firefox/158.0.1/releasenotes/\" rel=\"nofollow ugc noopener\">Firefox 158.0.1</a> for Desktop and Android, along with <a href=\"https://www.firefox.com/en-US/firefox/115.43.1/releasenotes/\" rel=\"nofollow ugc noopener\">Firefox ESR 115.43.1</a> and <a href=\"https://www.firefox.com/en-US/firefox/153.5.1/releasenotes/\" rel=\"nofollow ugc noopener\">Firefox ESR 153.5.1</a>. These releases will distribute this protection for a minority of users whose custom settings may have prevented them from receiving the OneCRL update.</p>\n<p>We are also updating the trusted certificate list in NSS (<a href=\"https://groups.google.com/a/mozilla.org/g/dev-tech-crypto/c/vSxZxnOMMvs\" rel=\"nofollow ugc noopener\">NSS 3.131.1</a>) to remove the root certificate that signed the affected intermediates. Firefox is already protected through OneCRL, but this additional update helps protect other applications that use Mozilla’s trust store or versions derived from it and do not receive OneCRL updates.</p>\n<p>Mozilla believes everyone has a fundamental right to security and privacy online. We remain committed to defending those rights and acting quickly to protect users.</p>\n<p>Transparency is essential to trust. We will share more information as soon as circumstances allow.</p>","headings":[{"level":1,"text":"Protecting Firefox users following the compromise of eMudhra intermediate certificates","id":"protecting-firefox-users-following-the-compromise-of-emudhra-int"}]}}