Firefox 158.0.1 Ships eMudhra Certificate Blocks: What Businesses Should Check

Compromised certificate keys can enable website impersonation

Mozilla released Firefox 158.0.1 for Desktop and Android on October 20, 2026 after private keys for eight eMudhra intermediate certificates were compromised. Businesses should check employee browsers, particularly managed clients with custom policies or restricted update connectivity. This is a new response to an incident reported on October 17, not a claim that the compromise began this morning.

Intermediate certificates help browsers validate HTTPS identities. Mozilla says the keys could sign fraudulent certificates for domains an attacker does not control. An attacker also able to intercept a victim’s connection could impersonate a site and read or modify traffic. That additional condition matters.

The statement confirms compromised keys, but does not establish interception of particular users. No CVE, CVSS score or victim count is assigned here without supporting evidence.

OneCRL protected standard configurations before the release

Mozilla received the report at 20:06 UTC on October 17 and completed OneCRL distribution by 22:59 UTC. It says standard configurations received protection without updating or restarting. In Vietnam, both timestamps fall early on October 18.

Firefox 158.0.1 packages the block list for clients that missed Remote Settings because of policy or network conditions. A public announcement that OneCRL exists does not prove delivery to every managed machine. Equally, protection did not begin only with the October 20 browser release.

Inventory ESR and NSS separately

The same announcement lists ESR 115.43.1 and ESR 153.5.1. Match the organization’s supported channel instead of switching branches simply to match the mainstream version number. Check distribution or device-management package availability where applicable.

NSS 3.131.1 also removes the root that signed the affected intermediates. NSS is a security library used by other applications. Updating Firefox does not demonstrate that another application’s embedded library or derived trust store has changed, particularly if it receives no OneCRL updates.

Confirm remediation on managed devices

Friday Works recommends inventorying browsers by channel, applying the official package through the approved process and confirming the running version after any required restart. For Mozilla-installed builds, About Firefox checks updates; a downloaded package alone is not completion.

If an internal site develops certificate errors, preserve the error and have its owner review the chain with the issuer. Do not bypass warnings or add trust merely to restore access. Checks should be limited to owned devices and systems.

The cover is VulcanSphere’s genuine July 18, 2021 Firefox 90 Page Info Security screenshot, MPL 2.0. Its Let’s Encrypt example explains certificate inspection; it is neither eMudhra incident evidence nor a patched Firefox 158.0.1 screen.