The private keys associated with eight intermediate certificate authority (CA) certificates issued by eMudhra have been confirmed as compromised, according to Mozilla and Google's Chrome Root Program. The disclosure was made on October 20, 2026.
Why Intermediate CA Compromises Are Serious
An intermediate CA occupies a critical position in the chain of trust that underpins encrypted web traffic. Certificates that websites present to browsers are signed by intermediate CAs, which are themselves trusted by root CAs embedded in browsers and operating systems. Anyone in possession of a compromised intermediate CA private key can issue certificates for any website, and browsers would accept them as legitimate. This creates conditions for undetected impersonation of websites or interception of encrypted communications.
How the Compromise Was Discovered
According to The Hacker News, a researcher reported the issue, triggering the confirmation from both Mozilla and Google. The sources do not specify how the keys were originally exposed or for how long they may have been accessible.
Emergency Response Across the Ecosystem
The disclosure prompted rapid action from multiple software maintainers. Mozilla released Firefox 158.0.1 specifically to block the compromised eMudhra intermediate certificates, according to reporting aggregated by Google News referencing 9to5Linux. The Go programming language runtime also issued version 1.27.3 to block the eight affected certificates, an update described as urgent. Google's Chrome Root Program was among the parties confirming the compromise, suggesting Chrome-based browsers are also taking remediation steps, though specific Chrome version details were not provided in the available sources.
Scope and Context
eMudhra is an Indian certificate authority. The incident affects eight intermediate certificates, and the breadth of the software response — spanning a major browser, a widely used programming language runtime, and likely others — indicates the certificates were trusted across a significant portion of the web's infrastructure. The sources describe the internet as having gone on high alert following the discovery.
Users running affected browsers or software are advised to apply available updates promptly to ensure the compromised certificates are blocked.
