Mozilla and Zen Browser release security updates for eMudhra certificate compromise

Mozilla has released Firefox 158.0.1 to address a significant security vulnerability involving the compromise of private keys belonging to the eMudhra certificate authority. An attacker possessing these keys could issue fraudulent certificates to impersonate websites and intercept or alter web traffic.

While Mozilla had previously revoked the affected certificates via OneCRL, the new update bundles this revocation directly into the browser. This ensures protection for users whose network policies or settings might otherwise disable OneCRL updates. The Firefox release also addresses various functional bugs, including issues with the built-in VPN, Linux multi-monitor setups, and JPEG XL rendering.

Zen Browser, an open-source Firefox fork, has also launched version 1.23.4b. This release incorporates the Firefox 158.0.1 base and integrates Mozilla’s OneCRL block directly into the browser to protect users against the eMudhra compromise even in offline or restrictive network environments. Additionally, Zen Browser introduces a “Focus” mode for its Boosts feature and performance improvements for Windows users.