2026 eMudhra — private keys of eight intermediate CA certificates compromised; browsers block them
Data compromised
CA signing keys: anyone holding them could issue TLS or code-signing certificates that chained to trusted roots. No misissued certificates were found in Certificate Transparency logs before Chrome’s block.
Technical writeup
Confirmed by Mozilla and the Chrome Root Program (Oct 20, 2026); no public eMudhra statement as of Oct 20, though the eight certificates have been revoked. A researcher reported the keys to Chrome Oct 17 18:05 UTC; Chrome pushed a CRLSet block by 19:45 and Mozilla a OneCRL block by 22:59. Apple (Oct 19) and Microsoft (Oct 20) followed. Go 1.27.3/1.26.10 reject chains with the keys (CVE-2026-111943); Firefox 158.0.1/ESR builds carry the block (CVE-2026-113470); NSS 3.131.1, certifi 2026.10.19 and webpki-roots 1.0.10 drop emSign ECC Root CA - G3. companyConfirmed false (no CA statement); recordsAffected 0.
Root cause
Undisclosed. Private keys for eight eMudhra intermediate CAs (six TLS, two code-signing) left eMudhra’s control; how, when, and who else holds them is not public.
References
- https://blog.mozilla.org/security/2026/10/20/protecting-firefox-users-following-the-compromise-of-emudhra-intermediate-certificates/
- https://groups.google.com/a/mozilla.org/g/dev-security-policy/c/0R3XLJL6FuE/m/Kp1v6CPuAAAJ
- https://thehackernews.com/2026/10/eight-emudhra-ca-keys-compromised.html
- https://emudhra.we-have-a-problem.com/