Blog.Mozilla

Compromise of eMudhra Certificates Threatens Firefox Users

First seen 20 Oct 2026, 15:52 UTC • •33.8

Article Content

1 / 3

Browse articles

ThreatCluster •October 20, 2026 at 17:12 UTC

•Eight eMudhra intermediate certificates were compromised, risking user security.
•Mozilla blocked the affected certificates using OneCRL without requiring user updates.
•Firefox and NSS updates were released to enhance security for affected users.

On October 17, 2026, Mozilla was informed that private keys for eight eMudhra intermediate certificates were compromised, enabling attackers to issue fraudulent HTTPS certificates. This could allow them to impersonate legitimate websites and intercept user traffic. Mozilla quickly blocked the affected certificates in Firefox using OneCRL, which does not require user action. Additionally, Firefox 158.0.1 and NSS 3.131.1 were released to further secure users by removing the root certificate that signed the compromised intermediates. This incident highlights the importance of timely updates and user security. Mozilla is committed to transparency and will provide updates as more information becomes available.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Answers cite the sources they use

Updated just now How this analysis works

Timeline

2026-10-17

Compromise of eMudhra certificates reported

Mozilla received a report about the compromise of private keys for eight eMudhra intermediate certificates, allowing potential HTTPS certificate fraud.

Blog.Mozilla

2026-10-19

OneCRL update delivered

Mozilla implemented a OneCRL update to block the compromised certificates in Firefox, providing immediate protection to users.

Blog.Mozilla

2026-10-20

NSS 3.131.1 released

NSS 3.131.1 was released to remove trust in the root certificates associated with the compromised intermediates, enhancing security for other applications.

groups.google.com