# Mozilla blocks compromised eMudhra certificates in Firefox within three hours

> **Key takeaway:** Mozilla blocked eight compromised eMudhra intermediate certificates in Firefox using OneCRL within three hours of receiving the report, and released patched browser versions for users with custom settings.

**Published:** 2026-10-20T12:54:54+00:00 
**Source:** Planet Mozilla 
**Category:** distro-planet 
**Canonical URL:** https://fosswire.org/news/mozilla-blocks-compromised-emudhra-certificates-in-firefox-w.html 

## Summary
On October 17, private keys for eight eMudhra intermediate certificates were compromised, enabling potential fraudulent HTTPS certificate issuance. Mozilla blocked the affected certificates via OneCRL by 22:59 UTC the same day, protecting standard-configuration Firefox users without requiring updates or restarts. Firefox 158.0.1, ESR 115.43.1, and ESR 153.5.1 were released for users whose custom settings prevented OneCRL updates. NSS 3.131.1 was also updated to remove the signing root certificate, protecting other applications using Mozilla's trust store.

## How Mozilla responded to the certificate compromise
- **OneCRL** (One Certificate Revocation List) is Mozilla's centralized mechanism for pushing certificate revocations to Firefox users without requiring browser updates or restarts
- Eight **eMudhra intermediate certificates** had their private keys compromised; these intermediates could sign fraudulent TLS certificates for arbitrary domains
- The **OneCRL update** completed distribution to all standard-configuration Firefox users in under 3 hours (20:06 to 22:59 UTC)
- **Firefox 158.0.1** for Desktop and Android, plus **ESR 115.43.1** and **ESR 153.5.1**, provide the same protection for users who disabled or blocked OneCRL updates
- **NSS 3.131.1** removes the root certificate that signed the affected intermediates, extending protection to non-Firefox applications using Mozilla's trust store

## Why it matters
The incident demonstrates the value of centralized revocation mechanisms like OneCRL for rapid response to certificate compromises. The NSS update extends protection beyond Firefox to the broader ecosystem of applications relying on Mozilla's trust store, including many Linux distributions and open source tools.