Do Son 
TL;DR
On October 17, 2026, at 20:06 UTC, Mozilla learned that private keys for eight eMudhra intermediate certificates had been compromised. Within three hours, it blocked them for Firefox users through OneCRL. Mozilla has now shipped Firefox and NSS updates that extend protection to everyone else affected by the eMudhra certificate compromise.
- CVE: CVE-2026-111943
- CVSS: Awaiting analysis
- Product: Go standard library crypto/x509
- Affected: < 1.26.10, 1.27.0-0
- Impact: Distrust compromised intermediate certificates in crypto/x509
- Status: Exploited in the wild
- Patched in: 1.26.10, 1.27.3
- EPSS: 0.1% (30-day)
- Action: Update to 1.26.10, 1.27.3 now
Why It Matters
Intermediate certificates sign the HTTPS certificates that websites use. With their keys, an attacker could mint trusted certificates for any domain. Mozilla warns that these keys “could allow attackers to issue fraudulent HTTPS certificates for websites they do not control.”
In practice, an attacker who can intercept traffic could then “impersonate websites and potentially read or modify traffic,” Mozilla said.
How the keys were exposed
The eMudhra certificate compromise stemmed from a key generation mistake, according to BleepingComputer. All eight keys were tiny numbers, so anyone could recover them by trying 256 values. eMudhra blamed a script error that produced weak keys, which were “mistakenly selected for certificate signing.” The keys date back to April 2025.
So far, no misissued certificates have been confirmed. Even so, the keys were open to abuse for well over a year.
How Mozilla Responded
OneCRL revocation
Mozilla engineers pushed a block through OneCRL, the browser’s central list of revoked certificates. This works “without requiring users to update or restart Firefox.” By 22:59 UTC, the update had reached all Firefox users with standard settings.
Firefox and ESR updates
On October 20, Mozilla released Firefox 158.0.1 for desktop and Android, plus Firefox ESR 115.43.1 and 153.5.1. As explained in Mozilla’s security blog post on the eMudhra intermediates, these builds protect users whose custom settings blocked the OneCRL update.
NSS root removal
Mozilla also released NSS 3.131.1. It removes trust in three emSign roots, including the G3 root that signed the compromised intermediates. The NSS 3.131.1 release announcement says it “helps protect downstream users beyond Firefox who don’t receive revocation information.”
Other Vendors Act Too
Google Chrome blocked six of the intermediates on October 17, and Apple followed on October 19. Meanwhile, Go released versions 1.27.3 and 1.26.10. However, tools with their own certificate bundles may still trust the keys until updated.
The Go development team released versions 1.27.3 and 1.26.10 to address the issue, tracked as CVE-2026-111943.
What Users Should Do
- Update Firefox to 158.0.1, or ESR 115.43.1 or 153.5.1.
- Update applications that bundle NSS to version 3.131.1.
- Patch Go-based tools and other software with private trust stores.
The eMudhra certificate compromise shows how one bad key script can shake the web’s trust system. Mozilla says it “will share more information as soon as circumstances allow.”
Support Our Threat Intelligence
Find our vulnerability reports and weekly recaps helpful? Support our work today and unlock a 100% ad-free reading experience!
Buy Me a Coffee
