--- title: "Protecting Firefox users following the compromise of eMudhra intermediate certificates" slug: protecting-firefox-users-following-the-compromise-of-emudhra-intermediate-certificates url: https://listedarticles.com/articles/protecting-firefox-users-following-the-compromise-of-emudhra-intermediate-certificates canonical_url: https://blog.mozilla.org/security/2026/10/20/protecting-firefox-users-following-the-compromise-of-emudhra-intermediate-certificates/ content_type: announcement language: en published_at: 2026-10-20T12:54:54.000Z updated_at: 2026-10-20T14:07:42.463Z author: "Firefox Security Team" authored_by: human publisher: "Mozilla Security Blog" publisher_url: https://blog.mozilla.org/security/ topics: ["Security", "Web PKI", "Firefox", "Certificates"] license: all-rights-reserved word_count: 272 reading_minutes: 1 citation: "Firefox Security Team, Mozilla Security Blog. \"Protecting Firefox users following the compromise of eMudhra intermediate certificates.\" 20 Oct 2026. https://blog.mozilla.org/security/2026/10/20/protecting-firefox-users-following-the-compromise-of-emudhra-intermediate-certificates/ (all-rights-reserved)" # The full text follows. The web page shows an extract and sends readers # to the source above; quote the citation and link the canonical URL. --- # Protecting Firefox users following the compromise of eMudhra intermediate certificates > Mozilla's Firefox Security Team reports that private keys for eight eMudhra intermediate certificates were compromised. Mozilla blocked them via OneCRL within three hours of the October 17 report, shipped Firefox 158.0.1 and ESR updates for users who miss OneCRL, and is removing the issuing root from NSS 3.131.1. # Protecting Firefox users following the compromise of eMudhra intermediate certificates Firefox Security Team | October 20, 2026 On Saturday, October 17, at 20:06 UTC, Mozilla received a report that private keys associated with eight eMudhra intermediate certificates had been compromised. These keys could allow attackers to issue fraudulent HTTPS certificates for websites they do not control. An attacker who could intercept a user’s connection could use those certificates to impersonate websites and potentially read or modify traffic. Mozilla engineers responded immediately, blocking the affected certificates in Firefox using [OneCRL](https://blog.mozilla.org/security/2015/03/03/revoking-intermediate-certificates-introducing-onecrl/), Mozilla’s centralized list of revoked certificates. OneCRL delivers this protection without requiring users to update or restart Firefox. By 22:59 UTC that same day, in less than 3 hours after we received the report, the updated OneCRL distribution was complete for all Firefox users with standard configurations. Today, we are also releasing [Firefox 158.0.1](https://www.firefox.com/en-US/firefox/158.0.1/releasenotes/) for Desktop and Android, along with [Firefox ESR 115.43.1](https://www.firefox.com/en-US/firefox/115.43.1/releasenotes/) and [Firefox ESR 153.5.1](https://www.firefox.com/en-US/firefox/153.5.1/releasenotes/). These releases will distribute this protection for a minority of users whose custom settings may have prevented them from receiving the OneCRL update. We are also updating the trusted certificate list in NSS ([NSS 3.131.1](https://groups.google.com/a/mozilla.org/g/dev-tech-crypto/c/vSxZxnOMMvs)) to remove the root certificate that signed the affected intermediates. Firefox is already protected through OneCRL, but this additional update helps protect other applications that use Mozilla’s trust store or versions derived from it and do not receive OneCRL updates. Mozilla believes everyone has a fundamental right to security and privacy online. We remain committed to defending those rights and acting quickly to protect users. Transparency is essential to trust. We will share more information as soon as circumstances allow.