[qutebrowser] PSA: Compromised eMudhra intermediates (CVE-2026-111943)

[Coiby Xu]

On Wed, Oct 21, 2026 at 10:21:24AM +0200, Freya Bruhin via qutebrowser wrote:
>Hey!
>
>The private keys of eight eMudhra intermediate CA certificates have been
>compromised. They chain to roots trusted by the QtWebEngine trust store
>(via NSS).
>
>See https://emudhra.we-have-a-problem.com/ for more details and a test
>page.
>
>tl;dr: Someone messed up and used "4" as a private key (among other
>single-byte keys), you might want to run a script as a mitigation until
>packages are upgraded:
>https://984601.bugs.gentoo.org/attachment.cgi?id=972696

Thanks for sharing the script!

After running the script, I notice QB still trusts AAA Certificate
Services according to https://emudhra.we-have-a-problem.com/. After also
revoking the corresponding root CA, all checks now pass,
   CA_URL=http://www.tbs-x509.com/Comodo_AAA_Certificate_Services.crt
   curl -sSf "$CA_URL" | certutil -d sql:"$HOME"/.pki/nssdb -A -a -t p,p,p -n "Comodo AAA Services root CA"

>
>Thanks to Kerin Millar for the script. I have verified this fixes the
>issue on Archlinux, and expect it to work on other Linux distributions
>as well. On Windows/macOS, in theory this could work as well if you find
>out where your NSS store used by qutebrowser is, and how to get a copy
>of `certutil`.
>
>I plan to push a release of qutebrowser for macOS/Windows once this is
>fixed proper in QtWebEngine and released, but so far I haven't heard
>back from them.
>
>Unfortunately, QtWebEngine also does not support certificate revocation
>via CRLsets, so qutebrowser (and others using QtWebEngine) still happily
>accepts those certificates without manual mitigation or an upstream
>update: https://qt-project.atlassian.net//browse/QTBUG-58059
>(Despite being closed, this remains without a proper fix for a decade)
>
>There's an open issue in the Gentoo bugtracker to distrust the
>certificate, and I just reported this to Archlinux as well:
>https://bugs.gentoo.org/show_bug.cgi?id=984633
>https://gitlab.archlinux.org/archlinux/packaging/packages/qt6-webengine/-/work_items/16
>
>Note: While the CVE cited in the subject is technically in Go, it still
>seems widely used to refer to this issue at whole, so I included it for
>visibility.
>
>Also, independently, consider temporarily shutting down your PHP
>installations and patching them as soon as a patch is available:
>https://www.vincentschmalbach.com/cve-2026-109618-and-cve-2026-109619-what-you-should-do-now/
>https://phpc.social/@Girgias/117476510850918355
>
>What a week.
>- Freya

-- 
Best regards,
Coiby