Eight keys. That is how many private keys Mozilla received a report about, each on an eMudhra intermediate certificate. A key like that can issue a fake certificate for someone else's site. To use it, an attacker has to sit between you and the site.
Fact
The facts: on October 20, 2026 Mozilla said it had received a report of compromised private keys tied to eight eMudhra intermediate certificates, and that they could be used to issue fraudulent HTTPS certificates for sites the attacker does not control. To use them, the attacker has to intercept the user's connection. Mozilla blocked the certificates through OneCRL, its central revocation list, with no need for users to update or restart Firefox; by its account the block reached users on standard settings in under three hours after the report, received on Saturday, October 17. Firefox 158.0.1, ESR 115.43.1 and ESR 153.5.1 carry the same protection to the minority whose settings may have stopped OneCRL updates. NSS 3.131.1 removes from the trusted list the root that signed the intermediates, which protects other programs that use Mozilla's list and do not receive OneCRL. On October 21 Mozilla also shipped Firefox for Android 158.0.2, because some clients were not applying changes to the bundled list right after startup. Cloudflare, which became aware of the case on October 19, writes that the keys are weak and can be used to forge a certificate for any domain.
This is not a bug in code. These are leaked keys. So there is no CVE number and no registry entry to lean on; there are two official notices, from Mozilla and from Cloudflare.
I have seen it at the door of an event: the pass works because it carries the right stamp. Once the stamp is in other hands, the pass proves nothing, and security cannot wait for the next shift. Here security is the browser. It does not wait for an update. It adds a line to a list and trust in the eight certificates stops. Cloudflare puts it its own way: browser makers fixed the problem with a flip of a switch.
When the signer's key leaks, trust is cut from a list, not from an update.
Other programs are the other half. OneCRL is a Firefox channel. A program that uses Mozilla's list but has no such channel gets the fix with NSS 3.131.1, which means with an update.
How the keys leaked is not in either source. Neither is whether fake certificates were issued: Cloudflare only says it has not found active exploitation on its own services. What eMudhra itself says, I do not know.
If you maintain a program with a built-in list of trusted certificates, ask yourself how long it takes you to change it. Firefox needed under three hours.
Official primary sources
Mozilla Security Blog - Protecting Firefox users following the compromise of eMudhra intermediate certificates, 20.10.2026Cloudflare - eMudhra certificate compromise, 20.10.2026The visual is generated code-art, no third-party images.