NewsCompaniesFlawsGuides
Get the app
HighPartly fixedUpdated

CVE-2026-111943

Go’s crypto/x509 certificate verifier needed to reject compromised eMudhra intermediates that could otherwise allow forged website certificates to be accepted.

What to do

Update all browsers, operating systems and apps. Firefox users need at least desktop 158.0.1, Android 158.0.2, ESR 153.5.1 or ESR 115.43.1, depending on their release branch. Ask your IT provider to check apps and services with their own certificate lists, including built-in macOS command-line tools; updating the browser alone does not cover everything.

Affects
eMudhra emSign certificates and browsers, operating systems and apps that trust them
Severity
High
Fixed in
Firefox Desktop 158.0.1
Firefox for Android 158.0.2
Firefox ESR 153.5.1
Firefox ESR 115.43.1
NSS 3.131.1
Go 1.27.3
Go 1.26.10
Being used in attacks
Not known to be
Made public
17 Oct 2026

Part of: eMudhra weak certificate keys trigger browser blocks; wider software fixes remain incomplete

Eight eMudhra intermediate certificates created in April 2025 had recoverable private keys: six could authorise website certificates and two could authorise software-signing certificates. An attacker able to intercept a connection could impersonate a website to software still trusting those keys. A researcher reported the weakness on 17 October 2026; browser blocks and certificate revocation followed. Mozilla also released browser updates, including a follow-up Android fix. Protection remains partial across the wider software ecosystem because some apps maintain separate certificate lists or do not receive revocation updates. Cloudflare observed forged certificates after disclosure but found no evidence of interception of its connections; malicious interception remains unconfirmed. eMudhra says its infrastructure and customer data were not breached. It is moving TLS customers to other providers and winding down publicly trusted TLS issuance. KPMG is reviewing the incident, with eMudhra’s full report promised by 9 November.

The whole incident, its timeline and sources

Fixed in the same update

Sources

  1. Security Vulnerabilities fixed in Firefox ESR 153.5.1Mozilla · 20 Oct 2026
  2. eMudhra Statement on Recent Certificate Security IncidenteMudhra · 30 Oct 2026
  3. eMudhra: Private key compromise of Intermediate CertificatesMozilla and eMudhra · 18 Oct 2026
  4. Protecting Firefox users following the compromise of eMudhra intermediate certificatesMozilla · 20 Oct 2026
  5. Go 1.27.3 and Go 1.26.10 are releasedGo team · 19 Oct 2026
  6. Mozilla, Google, Apple block compromised eMudhra CA certificatesBleepingComputer · 20 Oct 2026
  7. 4 real? Tracking exploitation and patching of eMudhra’s weak keysCloudflare · 30 Oct 2026
  8. eMudhra Intermediate CA CompromiseDennis Jackson
Also: CVE-2026-111943 at CVE.org · NVD · Every flaw being used in attacks · Everything live