NewsPublished 11 Aug 2026

Mozilla Issues New Firefox GPG Key Following Exposure

Source SecurityWeek

Description

Mozilla revoked a Firefox and Thunderbird GPG signing subkey after it was inadvertently exposed in a private GitHub repository accessible only to a limited group of developers. The exposed key could have allowed an attacker to create valid signatures on malicious software artifacts, posing a supply chain risk. Mozilla's audit found no evidence of unauthorized access to the key. Most users do not need to take action, but those verifying GPG signatures or using Firefox RPM packages should update to the new key. Mozilla has implemented additional protections to prevent similar incidents.

Impact

If exploited, the exposed GPG signing key could have enabled attackers to sign malicious Firefox and Thunderbird software artifacts, potentially facilitating supply chain attacks by distributing malicious software appearing authentic. However, the exposure was limited to a private repository with restricted access, and no unauthorized access was detected. Most users are unaffected, but those manually verifying signatures or using RPM packages may need to update keys.

Defensive guidance

Mozilla has revoked the exposed GPG signing subkey and issued a new one. Users who manually verify GPG signatures should import the new key and the revocation for the old key. Users of Firefox RPM packages should follow Mozilla's detailed instructions for updating. Mozilla has also implemented additional protections to prevent similar key exposures in the future. Most users do not need to take any action.

References

securityweek.com/mozilla-issues-new-firefox-gpg-key-following-exposure/ (opens in a new tab)

Community reviews

Loading reviews…

Description

AI analysisMachine-generated, updated 11 Aug 2026, 06:26 UTC

References

Community reviews