Affected Systems
Mozilla Firefox and Thunderbird Linux downloads (all versions signed with subkey 09BE ED63 F346 2A2D FFAB 3B87 5ECB 6497 C1A2 0256 from April 2025 to August 2026). Users verifying signatures manually and RPM package users on Fedora, RHEL, CentOS, openSUSE are affected. Debian/Ubuntu APT repositories use different key and are not affected.
Exploitation Status
No evidence of exploitation. The compromised key was committed to a private Mozilla repository. Mozilla's audit review found no unauthorized access. Revocation is precautionary with reason code 2 ("key material has been compromised") applied.
Business Impact
Supply chain integrity risk if key was accessed by unauthorized parties. Revocation with reason code 2 invalidates all signatures made with the compromised subkey, affecting verification of older Firefox and Thunderbird Linux downloads. RPM users may experience failed updates requiring manual key rotation. Most end users unaffected as browsers auto-update. Primary risk is to organizations that verify package signatures as part of software supply chain controls or maintain local mirrors.
Urgency
🟡 Within a week
Recommended Actions
- Import Mozilla's replacement signing subkey (fingerprint 827E 6586 0867 9618 CD34 9F93 678E 455D 7676 7AA3) from https://packages.mozilla.org/rpm/firefox/signing-key.gpg
- For RPM-based systems (Fedora, RHEL, CentOS): remove old key with 'sudo rpm -e --allmatches gpg-pubkey-14f26682d0916cdd81e37b6d61b7b526d98f0353', import new key, and run 'sudo dnf clean all'
- For openSUSE: run same rpm commands followed by 'zypper refresh'
- Update signature verification procedures and scripts to use the new subkey for any automated Firefox/Thunderbird deployment pipelines
- Review internal software supply chain controls to ensure GPG signature verification is enforced for Mozilla packages going forward