Firefox: eMudhra intermediate certificates compromised, blocked via OneCRL, root removed from NSS
Summary
Mozilla received a report that private keys of eight eMudhra intermediate certificates were compromised. Attackers could use them to issue fraudulent HTTPS certificates. Mozilla blocked the certificates in Firefox via OneCRL and released updated Firefox versions. The NSS trust store also drops the root certificate that signed the intermediates.
Symptoms
No error is shown to users. The risk is that an attacker who can intercept a connection could impersonate websites with fraudulent certificates and read or modify traffic. Only a minority of clients with custom settings may not have received the OneCRL block.
Affected
- Firefox users whose custom settings prevented the OneCRL update (standard configurations were protected within 3 hours on 2026-10-17)
- Firefox for Android clients that did not apply changes to the bundled OneCRL blocklist immediately after startup
- Other applications that use Mozilla's trust store (NSS) or versions derived from it and do not receive OneCRL updates
Workaround
No workaround known.
Fix
Fixed: OneCRL block distributed on 2026-10-17 for standard configurations. Firefox 158.0.1 (Desktop and Android), Firefox ESR 115.43.1 and Firefox ESR 153.5.1 deliver the protection to clients with custom settings. Firefox for Android 158.0.2 (2026-10-21) fixes the delayed application of the bundled OneCRL blocklist after startup. NSS 3.131.1 removes the root certificate that signed the affected intermediates.
Recommendation
Update Firefox to 158.0.1 or later (Android: 158.0.2), or ESR to 115.43.1 or 153.5.1. Check whether managed Firefox profiles disable OneCRL or certificate revocation updates. For other software based on the Mozilla/NSS trust store, check with the vendor whether NSS 3.131.1 or the root removal is included.
Sources
- Protecting Firefox users following the compromise of eMudhra intermediate certificates Vendor · blog.mozilla.org
Compiled from the sources listed and translated with AI (Claude); status and dates come from the vendor. The vendor’s statements are authoritative. Updated 1 Nov 2026, 15:38.
Where the information comes from
We continuously read the vendors’ official sources, community reports and trade media and summarise them in our own words, with a link to the source:
- Microsoft: Windows release health (Windows 10/11, Server 2016 to 2025), Windows message center, known issues of Microsoft 365 Apps (Outlook, Excel, Word, PowerPoint), Edge, Intune, Autopilot, Windows 365 and Entra Connect, Microsoft KB articles with timelines, Exchange and Windows IT Pro blogs, optionally Microsoft 365 service health and message center
- other vendors: Veeam KB, Citrix (known issues), Ubuntu and Debian (regressions), Broadcom (VMware), Fortinet, Cisco, Mozilla, Let’s Encrypt
- community (title, short excerpt and link only, without the names of the authors): Microsoft Q&A, Microsoft Tech Community (discussions), Veeam R&D Forums, Eleven Forum
- targeted web research with AI (Claude), e.g. on the updates of the month – this also finds discussions on Reddit and in forums; such entries are labelled as community reports until the vendor confirms them
- early warning from trade media (title and link only): Born’s Tech and Windows World, BleepingComputer, AskWoody, Windows Latest, Windows Central, gHacks, The Windows Club, Deskmodder, Dr. Windows, WindowsArea, Frankys Web, heise online
Summary and translation with AI (Claude by Anthropic) – without any data of visitors.
Affected? We can help.
We check whether your systems are affected, apply workarounds properly and plan for dated changes in good time.