{
  "id": 15745228,
  "title": "Protecting Firefox users following the compromise of eMudhra intermediate certificates",
  "url": "https://urgent.news/2026/10/20/protecting-firefox-users-following-the-compromise-of-emudhra",
  "topic": "tech",
  "section": "Tech",
  "published": "2026-10-20T13:00:50.000Z",
  "source": {
    "name": "Lobsters",
    "slug": "lobsters",
    "url": "https://blog.mozilla.org/security/2026/10/20/protecting-firefox-users-following-the-compromise-of-emudhra-intermediate-certificates/"
  },
  "original_language": "en",
  "account": "On October 17, at 20:06 UTC, Mozilla received notification that the private keys linked to eight eMudhra intermediate certificates had been compromised. These compromised keys could enable attackers to create false HTTPS certificates for websites they do not own. If a user's connection is intercepted, the attacker could use these forged certificates to masquerade as legitimate websites, potentially gaining access to sensitive data being transmitted.\n\nReacting swiftly, Mozilla's engineers employed OneCRL, Mozilla's centralized list of revoked certificates, to block the affected certificates in the Firefox browser. This protective measure can be implemented without the need for users to update or restart Firefox. Remarkably, within three hours of receiving the report, the enhanced OneCRL distribution was successfully installed for all standard Firefox users.\n\nIn an effort to extend this security enhancement to a smaller subset of users with custom settings that may have hindered the OneCRL update, Mozilla has released new versions of Firefox. These include Firefox 158.0.1 for desktop and Android, along with Firefox ESR (Extended Support Release) versions 115.43.1 and 153.5.1. These updates will provide the necessary protection to these remaining users.\n\nAdditionally, Mozilla is updating the trusted certificate list within the NSS (Network Security Configuration) to remove the root certificate that signed the compromised intermediates. This action aims to safeguard not only Firefox but also other applications that rely on Mozilla's trust store or its derivatives.\n\nMozilla firmly believes in the inherent right to security and privacy online. This incident underscores their unwavering commitment to defending these rights and taking prompt action to protect users. They emphasize the importance of transparency in maintaining trust, vowing to provide further details as the situation permits.",
  "summary": null,
  "key_points": [
    "Mozilla discovered compromised eMudhra intermediate certificates on October 17",
    "Mozilla blocked affected certificates using OneCRL in Firefox within 3 hours",
    "Mozilla released updated Firefox versions and updated NSS to protect users"
  ],
  "editors_take": "Mozilla's rapid deployment of revoked certificate lists and software updates demonstrates how centralized security management can neutralize identity theft risks before attackers can exploit compromised encryption keys.",
  "illustration": null,
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}