{"id":"emudhra-weak-certificate-keys-oct-2026","category":"patch","status":"live","title":"eMudhra weak certificate keys trigger browser blocks; wider software fixes remain incomplete","tldr":"Eight eMudhra certificate keys could be recovered and used to impersonate websites. Major browsers have protections, but some apps still need separate fixes. Update browsers, operating systems and apps; malicious interception remains unconfirmed.","summary":"Eight eMudhra intermediate certificates created in April 2025 had recoverable private keys: six could authorise website certificates and two could authorise software-signing certificates. An attacker able to intercept a connection could impersonate a website to software still trusting those keys. A researcher reported the weakness on 17 October 2026; browser blocks and certificate revocation followed. Mozilla also released browser updates, including a follow-up Android fix. Protection remains partial across the wider software ecosystem because some apps maintain separate certificate lists or do not receive revocation updates. Cloudflare observed forged certificates after disclosure but found no evidence of interception of its connections; malicious interception remains unconfirmed. eMudhra says its infrastructure and customer data were not breached. It is moving TLS customers to other providers and winding down publicly trusted TLS issuance. KPMG is reviewing the incident, with eMudhra’s full report promised by 9 November.","action":"Update all browsers, operating systems and apps. Firefox users need at least desktop 158.0.1, Android 158.0.2, ESR 153.5.1 or ESR 115.43.1, depending on their release branch. Ask your IT provider to check apps and services with their own certificate lists, including built-in macOS command-line tools; updating the browser alone does not cover everything.","product":"eMudhra emSign certificates and browsers, operating systems and apps that trust them","audience":"both","severity":"high","patch":"partial","exploited":false,"cves":["CVE-2026-113470","CVE-2026-111943"],"tags":["emudhra","certificates","firefox","browser","cryptography","go"],"affected":["EM EV TLS CA - G3B (eMudhra BV)","EM OV TLS CA - G3B (eMudhra BV)","EM DV TLS CA - G3B (eMudhra BV)","EM EV TLS CA - G3C (eMudhra Inc)","EM OV TLS CA - G3C (eMudhra Inc)","EM DV TLS CA - G3C (eMudhra Inc)","EM OV CS CA - G3B (eMudhra BV)","EM OV CS CA - G3C (eMudhra Inc)","Cross-signed certificates containing the same compromised keys","Firefox Desktop, Android and ESR configurations unable to receive the automatic OneCRL block","Go crypto/x509 certificate verification without the eMudhra block","Other clients that continue trusting the compromised intermediates"],"fixed":["Firefox Desktop 158.0.1","Firefox for Android 158.0.2","Firefox ESR 153.5.1","Firefox ESR 115.43.1","NSS 3.131.1","Go 1.27.3","Go 1.26.10"],"matches":[{"platform":"firefox","app":"Mozilla Firefox","bundle":"","fixed":"158.0.1"},{"platform":"android","app":"Firefox","bundle":"org.mozilla.firefox","fixed":"158.0.2"},{"platform":"firefox","app":"Mozilla Firefox ESR (153 branch)","bundle":"","fixed":"153.5.1"},{"platform":"firefox","app":"Mozilla Firefox ESR (115 branch)","bundle":"","fixed":"115.43.1"}],"sources":[{"kind":"advisory","title":"Security Vulnerabilities fixed in Firefox ESR 153.5.1","url":"https://www.mozilla.org/en-US/security/advisories/mfsa2026-112/","by":"Mozilla","date":"2026-10-20"},{"kind":"advisory","title":"eMudhra Statement on Recent Certificate Security Incident","url":"https://emudhra.com/en/post/certificate-security-incident","by":"eMudhra","date":"2026-10-30"},{"kind":"advisory","title":"eMudhra: Private key compromise of Intermediate Certificates","url":"https://bugzilla.mozilla.org/show_bug.cgi?id=2083449","by":"Mozilla and eMudhra","date":"2026-10-18"},{"kind":"post","title":"Protecting Firefox users following the compromise of eMudhra intermediate certificates","url":"https://blog.mozilla.org/security/2026/10/20/protecting-firefox-users-following-the-compromise-of-emudhra-intermediate-certificates/","by":"Mozilla","date":"2026-10-20"},{"kind":"advisory","title":"Go 1.27.3 and Go 1.26.10 are released","url":"https://groups.google.com/g/golang-announce/c/66pojueaQek?pli=1","by":"Go team","date":"2026-10-19"},{"kind":"news","title":"Mozilla, Google, Apple block compromised eMudhra CA certificates","url":"https://www.bleepingcomputer.com/news/security/mozilla-google-apple-block-compromised-emudhra-ca-certificates/","by":"BleepingComputer","date":"2026-10-20"},{"kind":"research","title":"4 real? Tracking exploitation and patching of eMudhra’s weak keys","url":"https://blog.cloudflare.com/emudhra-patching","by":"Cloudflare","date":"2026-10-30"},{"kind":"research","title":"eMudhra Intermediate CA Compromise","url":"https://emudhra.we-have-a-problem.com/","by":"Dennis Jackson","date":""}],"started":"2026-10-17","closed":null,"created":"2026-11-03T21:11:09.478Z","updated":"2026-11-03T21:11:09.478Z","cve_notes":[{"cve":"CVE-2026-113470","name":"eMudhra certificate block missing from Firefox clients","what":"Firefox clients unable to receive automatic OneCRL updates could continue trusting compromised eMudhra certificates, allowing website impersonation if an attacker intercepted their connections.","severity":"high","cvss":0},{"cve":"CVE-2026-111943","name":"Compromised certificate trust in Go crypto/x509","what":"Go’s crypto/x509 certificate verifier needed to reject compromised eMudhra intermediates that could otherwise allow forged website certificates to be accepted.","severity":"unknown","cvss":0}],"timeline":[{"at":"2026-11-03","added":"2026-11-03T20:51:54.186Z","kind":"other","text":"As of 3 November, eMudhra had appointed KPMG to review the incident and said its full incident report would follow by 9 November.","url":"https://bugzilla.mozilla.org/show_bug.cgi?id=2083449#c73","by":"eMudhra via Mozilla Bugzilla","patch":null},{"at":"2026-10-30","added":"2026-11-03T20:51:54.186Z","kind":"other","text":"Cloudflare reported seeing forged certificates after disclosure, but no evidence of interception of its connections. It said modern browsers were mostly protected, while older and embedded clients still lagged.","url":"https://blog.cloudflare.com/emudhra-patching","by":"Cloudflare","patch":null},{"at":"2026-10-28","added":"2026-11-03T20:51:54.186Z","kind":"vendor-revised","text":"eMudhra said roughly 30,800 certificates under the wider affected G3 hierarchies served a US customer ecosystem. It was moving customers to alternative providers and winding down publicly trusted TLS certificate issuance.","url":"https://emudhra.com/en/post/certificate-security-incident","by":"eMudhra","patch":null},{"at":"2026-10-21T08:29Z","added":"2026-11-03T20:51:54.186Z","kind":"fix-incomplete","text":"Mozilla released Firefox for Android 158.0.2 after finding that some clients did not immediately apply the bundled certificate block when starting.","url":"https://blog.mozilla.org/security/2026/10/20/protecting-firefox-users-following-the-compromise-of-emudhra-intermediate-certificates/","by":"Mozilla","patch":"partial"},{"at":"2026-10-20","added":"2026-11-03T20:51:54.186Z","kind":"disclosed","text":"Mozilla publicly explained the incident and released Firefox 158.0.1, ESR 115.43.1 and ESR 153.5.1. These bundled the block for users unable to receive automatic revocation updates.","url":"https://blog.mozilla.org/security/2026/10/20/protecting-firefox-users-following-the-compromise-of-emudhra-intermediate-certificates/","by":"Mozilla","patch":"partial"},{"at":"2026-10-19","added":"2026-11-03T20:51:54.186Z","kind":"new-fix","text":"The Go team released Go 1.27.3 and 1.26.10, blocking the affected intermediate certificates during certificate verification. Its mitigation is tracked as CVE-2026-111943.","url":"https://groups.google.com/g/golang-announce/c/66pojueaQek?pli=1","by":"Go team","patch":"partial"},{"at":"2026-10-18T09:38Z","added":"2026-11-03T20:51:54.186Z","kind":"other","text":"eMudhra marked all eight affected intermediate certificates as revoked because their keys were compromised.","url":"https://bugzilla.mozilla.org/show_bug.cgi?id=2083449","by":"Mozilla","patch":null},{"at":"2026-10-17","added":"2026-11-03T20:51:54.186Z","kind":"other","text":"Researcher Wayne privately reported eight recoverable eMudhra intermediate certificate keys. Mozilla independently confirmed the weakness and completed Firefox’s automatic certificate block at 22:59 UTC; Chrome also distributed a block that day.","url":"https://bugzilla.mozilla.org/show_bug.cgi?id=2083449","by":"Mozilla","patch":"partial"}],"url":"https://hard.fyi/live/emudhra-weak-certificate-keys-oct-2026/","json":"https://hard.fyi/api/live?id=emudhra-weak-certificate-keys-oct-2026"}