eMudhra: Intermediate certificate private key compromise

On October 17, 2026, Mozilla confirmed that private keys associated with eight eMudhra intermediate certificates were compromised. These keys allow an attacker to issue fraudulent HTTPS certificates for websites they do not control, enabling the interception and modification of encrypted traffic (Man-in-the-Middle).

Mozilla implemented mitigations via OneCRL, a centralized certificate revocation list, for all standard Firefox configurations. Additionally, Mozilla released Firefox 158.0.1, Firefox ESR 115.43.1, and Firefox ESR 153.5.1 to provide protections for users with custom configurations, and updated the NSS library (version 3.131.1) to remove the root certificate that signed the affected intermediates.

Impact

The compromise of these intermediate keys allows an attacker capable of intercepting a user connection to impersonate any website, potentially exposing sensitive user data or allowing the injection of malicious content into HTTPS sessions.

Recommendation

• Update all instances of Firefox to 158.0.1 (Desktop/Android) or the latest ESR versions (115.43.1 / 153.5.1) to ensure revocation coverage for custom configurations.
• Organizations utilizing the NSS (Network Security Services) library should update to version 3.131.1 or later to ensure the affected root certificate is untrusted.
• Audit infrastructure that relies on the eMudhra trust store for certificate validation.