Firefox for Android fixes delayed blocking of compromised eMudhra CAs
Mozilla released Firefox for Android 158.0.2. The fix ensures that the OneCRL blocklist is applied immediately after app startup for eight compromised eMudhra intermediate CAs.
Firefox for Android received a fix intended to apply changes to its integrated blocklist immediately after startup. On October 21, Mozilla released Firefox for Android 158.0.2 in response to the compromise of the private keys of eight eMudhra intermediate certificate authorities.
The problem involved the practical deployment of protection that was already prepared: some Firefox for Android clients did not immediately apply OneCRL blocklist updates after launch. Users should therefore upgrade to version 158.0.2 or later.
Firefox for Android should activate blocking immediately after startup
OneCRL is Firefox’s mechanism for blocking untrusted or revoked certificates. In this case, it includes protection against the affected eMudhra intermediate CAs. Mozilla fixed the delay so that blocklist changes would not be applied only later after opening the mobile browser.
The fix follows an incident involving eight intermediate certificate authorities. Google confirmed that their private keys had weak entropy. Such an error could have allowed HTTPS certificates to be created that appear trustworthy to clients that still trust those CAs.
An intermediate CA can sign end-entity certificates for web services. A compromised or predictable private key could therefore be used to create a certificate for someone else’s domain. Blocking in browsers and revoking the affected CAs are intended to limit this risk.
eMudhra says all eight intermediates have been revoked
In its latest statement, eMudhra said that it revoked all eight affected intermediate certificate authorities on October 19. The company also claims that no end-entity certificate was issued by them.
However, according to eMudhra, the exact root cause has not yet been confirmed. The company preliminarily links it to an error in the key wrap/unwrap process during the key-generation ceremony. The claim that the keys were not misused by anyone before publication has also not been fully independently verified.
There is no evidence in the available confirmed information of actual issuance or use of fraudulent certificates. The risk of certificate forgery was addressed through blocking in client software and revocation of the intermediates.
What users and administrators should monitor
Firefox for Android users should install version 158.0.2 or later. Further developments will concern the results of the eMudhra investigation, the status of blocks in the trust stores of other vendors including Apple and Microsoft, and any evidence that fraudulent certificates were issued or used before revocation.
Sources
- Mozilla Security Blog – Confirms the release of Firefox for Android 158.0.2 at 08:29 UTC on October 21 to fix the delayed application of the integrated OneCRL blocklist.
- Google Security Blog – Confirms the weak entropy of eight keys, the risk mechanism, and the blocking of the affected intermediates in Chrome and Android.
- eMudhra – Reports the revocation of eight intermediates, the ongoing investigation, and the company’s claims about the scope of the impact and the absence of issued end-entity certificates.
Verified and updated: October 21, 2026 15:24
