eMudhra weak certificate keys trigger browser blocks; wider software fixes remain incomplete
Eight eMudhra certificate keys could be recovered and used to impersonate websites. Major browsers have protections, but some apps still need separate fixes. Update browsers, operating systems and apps; malicious interception remains unconfirmed.
Update all browsers, operating systems and apps. Firefox users need at least desktop 158.0.1, Android 158.0.2, ESR 153.5.1 or ESR 115.43.1, depending on their release branch. Ask your IT provider to check apps and services with their own certificate lists, including built-in macOS command-line tools; updating the browser alone does not cover everything.
- Mozilla Firefoxfixed in 158.0.1 and later
- Firefoxfixed in 158.0.2 and later
- Mozilla Firefox ESR (153 branch)fixed in 153.5.1 and later
- Mozilla Firefox ESR (115 branch)fixed in 115.43.1 and later
What’s happening
Eight eMudhra intermediate certificates created in April 2025 had recoverable private keys: six could authorise website certificates and two could authorise software-signing certificates. An attacker able to intercept a connection could impersonate a website to software still trusting those keys. A researcher reported the weakness on 17 October 2026; browser blocks and certificate revocation followed. Mozilla also released browser updates, including a follow-up Android fix. Protection remains partial across the wider software ecosystem because some apps maintain separate certificate lists or do not receive revocation updates. Cloudflare observed forged certificates after disclosure but found no evidence of interception of its connections; malicious interception remains unconfirmed. eMudhra says its infrastructure and customer data were not breached. It is moving TLS customers to other providers and winding down publicly trusted TLS issuance. KPMG is reviewing the incident, with eMudhra’s full report promised by 9 November.
- What
- Flaw
- Affects
- eMudhra emSign certificates and browsers, operating systems and apps that trust them
- Affected
- EM EV TLS CA - G3B (eMudhra BV)
EM OV TLS CA - G3B (eMudhra BV)
EM DV TLS CA - G3B (eMudhra BV)
EM EV TLS CA - G3C (eMudhra Inc)
EM OV TLS CA - G3C (eMudhra Inc)
EM DV TLS CA - G3C (eMudhra Inc)
EM OV CS CA - G3B (eMudhra BV)
EM OV CS CA - G3C (eMudhra Inc)
Cross-signed certificates containing the same compromised keys
Firefox Desktop, Android and ESR configurations unable to receive the automatic OneCRL block
Go crypto/x509 certificate verification without the eMudhra block
Other clients that continue trusting the compromised intermediates - Fixed in
- Firefox Desktop 158.0.1
Firefox for Android 158.0.2
Firefox ESR 153.5.1
Firefox ESR 115.43.1
NSS 3.131.1
Go 1.27.3
Go 1.26.10 - Since
- 17 Oct 2026
Timeline
- Update
As of 3 November, eMudhra had appointed KPMG to review the incident and said its full incident report would follow by 9 November.
- Update
Cloudflare reported seeing forged certificates after disclosure, but no evidence of interception of its connections. It said modern browsers were mostly protected, while older and embedded clients still lagged.
- Vendor revised
eMudhra said roughly 30,800 certificates under the wider affected G3 hierarchies served a US customer ecosystem. It was moving customers to alternative providers and winding down publicly trusted TLS certificate issuance.
- Fix incompletePartly fixed
Mozilla released Firefox for Android 158.0.2 after finding that some clients did not immediately apply the bundled certificate block when starting.
- Made publicPartly fixed
Mozilla publicly explained the incident and released Firefox 158.0.1, ESR 115.43.1 and ESR 153.5.1. These bundled the block for users unable to receive automatic revocation updates.
- New fixPartly fixed
The Go team released Go 1.27.3 and 1.26.10, blocking the affected intermediate certificates during certificate verification. Its mitigation is tracked as CVE-2026-111943.
- Update
eMudhra marked all eight affected intermediate certificates as revoked because their keys were compromised.
- UpdatePartly fixed
Researcher Wayne privately reported eight recoverable eMudhra intermediate certificate keys. Mozilla independently confirmed the weakness and completed Firefox’s automatic certificate block at 22:59 UTC; Chrome also distributed a block that day.
Sources
- Security Vulnerabilities fixed in Firefox ESR 153.5.1Mozilla · 20 Oct 2026
- eMudhra Statement on Recent Certificate Security IncidenteMudhra · 30 Oct 2026
- eMudhra: Private key compromise of Intermediate CertificatesMozilla and eMudhra · 18 Oct 2026
- Protecting Firefox users following the compromise of eMudhra intermediate certificatesMozilla · 20 Oct 2026
- Go 1.27.3 and Go 1.26.10 are releasedGo team · 19 Oct 2026
- Mozilla, Google, Apple block compromised eMudhra CA certificatesBleepingComputer · 20 Oct 2026
- 4 real? Tracking exploitation and patching of eMudhra’s weak keysCloudflare · 30 Oct 2026
- eMudhra Intermediate CA CompromiseDennis Jackson