eMudhra Certificate Authority Compromise Triggers Emergency Browser Blocks
eMudhra's certificate authority private keys were compromised, leading to emergency blocks by Chrome, Firefox, Apple, and Microsoft.
Major web browsers and software platforms have implemented emergency blocks following the compromise of private keys belonging to eight eMudhra intermediate certificate authority certificates. These compromised keys could have allowed attackers to issue fraudulent certificates, potentially impersonating legitimate websites and enabling man-in-the-middle attacks. The incident has prompted swift action from browser vendors and software providers to protect users from the risks associated with these compromised certificates.
A researcher, identified as Wayne, demonstrated the compromise by signing a message with each of the affected intermediate CA private keys on October 17, 2026. This proof-of-concept, published by Dennis Jackson, confirmed the signing capability without exposing the private keys themselves. The affected certificates chain to roots trusted by major entities including Mozilla, Microsoft, Apple, and Google Chrome, meaning any client that continued to trust these chains would be vulnerable to accepting forged certificates.
Mozilla was among the first to react, receiving the report on October 17 and completing its OneCRL blocklist rollout by October 17, 22:59 UTC. This update protected standard Firefox configurations without requiring a user-initiated browser update or restart. Google Chrome also reportedly blocked the affected certificates on the same day. Apple implemented its protective measures on October 19, followed by Microsoft on October 20.
Beyond browser-level blocking, eMudhra has also officially revoked the compromised intermediate certificates. However, revocation alone is insufficient for all systems. Many applications and clients do not automatically receive browser blocklists or actively check certificate revocation status. Consequently, these programs require separate, timely updates to cease trusting the compromised certificate chains.
Software vendors have released updates to address the vulnerability. Mozilla provided Firefox 158.0.1, ESR 115.43.1, and ESR 153.5.1, along with an NSS 3.131.1 update to remove the compromised signing root from trusted lists. Other affected software includes Go (versions 1.27.3 and 1.26.10), Python's certifi (2026.10.19), and Rust's webpki-roots (1.0.10). Updates for Node.js and Composer's ca-bundle were listed as pending.
Users and developers are strongly advised to ensure their browsers, operating systems, and applications are updated promptly. Developers, in particular, should verify that certificate bundles shipped with their applications are current, as operating system updates may not cover all runtime environments. Administrators can utilize test endpoints and certificate chains provided on the disclosure site to assess their specific exposure.
While the compromise is serious, the publicly available information does not confirm how the keys were exposed or if widespread attacks have occurred. The incident highlights the critical importance of certificate authority security and the need for robust, multi-layered trust mechanisms in the digital ecosystem. The rapid response from multiple vendors underscores the severity of such compromises and the collaborative effort required to maintain internet security.
The Go programming language has also implemented an emergency fix, addressing CVE-2026-111943 by rejecting any certificate chain containing one of the eight compromised keys. This fix was released on October 20th and requires a rebuild of Go applications. Additionally, the NSS library has been updated to version 3.131.1, removing the compromised emSign ECC Root CA - G3 from its trusted list, and Python's certifi bundle has been updated to version 2026.10.19 to drop the same root.