https://seclists.org/oss-sec/2026/q4/369: eMudhra Intermediates Compromise
Published Oct 23, 2026
·Updated
Affected Software
4 affected components
Google Chrome
Mozilla Firefox=153 ESR
Mozilla NSS=3.131.1
pypi/certifi
Frequently Asked Questions
1
Does removal of the Comodo AAA Services Root TLS trust bit eliminate all use of the affected certificate chain?
No. Although the root was dropped from browser trust stores and some tooling after its TLS trust bit was removed in April 2025, the certificate could still be used for S/MIME.
2
Which trust-store implementations are identified for review?
The provided software list identifies Google Chrome, Mozilla Firefox, Mozilla NSS, and pypi/certifi. Review how each of these environments handles the relevant certificate chain and any non-TLS uses.