Eight eMudhra intermediate CA keys compromised; browsers block them
Original title: Eight eMudhra CA Keys Compromised, Triggering Emergency Fixes Across Browsers and Software
Chrome and Firefox blocked the TLS intermediates within hours of an October 17 report, and no website certificate chaining to them was in Certificate Transparency beforehand.
Mozilla and Google's Chrome Root Program confirmed on October 20 that private keys for eight eMudhra intermediate CA certificates are compromised. A researcher reported it on the evening of October 17, and Chrome and Firefox blocked the six TLS intermediates within hours. Chrome said no TLS certificate chaining to those six had been logged to Certificate Transparency before the block. eMudhra revoked the eight certificates; Apple, Microsoft, Go, NSS, certifi, and other trust stores published or prepared blocks.
Unconfirmed: It is unknown how or when the keys left eMudhra, or whether anyone besides the researcher holds them.
- The eight intermediates cover DV, OV, and EV TLS plus two code-signing CAs under the emSign brand.
- Chrome's CRLSet was in place by 19:45 UTC on October 17; Firefox's OneCRL push finished at 22:59 UTC.
- Go 1.27.3 and 1.26.10 reject chains containing the eight keys (CVE-2026-111943).
- Firefox 158.0.1, ESR 115.43.1, and ESR 153.5.1 carry the OneCRL block (CVE-2026-113470).
- Node.js and Composer ca-bundle had only pending changes.
Impact: Holders could issue browser-trusted certificates for any website
| Product | Affected | Fixed in |
|---|---|---|
| Go | — | 1.27.3 and 1.26.10 |
| Mozilla Firefox | — | 158.0.1, ESR 115.43.1 and ESR 153.5.1 |
| Mozilla NSS | — | 3.131.1 |
| Python certifi | — | 2026.10.19 |
| Rust webpki-roots | — | 1.0.10 |
| Homebrew ca-certificates | — | 2026-09-25_1 |
- 1.Rebuild programs with Go 1.27.3 or 1.26.10.
- 2.Update Firefox, NSS 3.131.1, certifi 2026.10.19, webpki-roots 1.0.10, or Homebrew ca-certificates.
- 3.Where revocation is not checked, block the eight intermediates or distrust the signing roots.
- Organizations
- Chrome Root Program
- Countries
- IndiaUnited StatesNetherlands
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-111943 | On most platforms, Go uses the given system root certificates | — | <1% | PoC | |
| CVE-2026-113470 | Cryptographic issue in the Security Block-lists, Allow-lists, and other State component | 5.4 | — |
From the original article
6 min read at thehackernews.com
The private keys of eight eMudhra intermediate certificate authority (CA) certificates are compromised, Mozilla and Google's Chrome Root Program confirms on October 20. An intermediate CA signs the certificates that websites present, so anyone holding one of these keys could issue a certificate for any website that a browser would accept. A researcher reported the
thehackernews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.