Mozilla has taken swift action to address a potential security vulnerability after accidentally exposing its GPG signing subkey in a GitHub repository. The exposed key could have allowed an attacker to create malicious versions of Firefox and Thunderbird software that appeared authentic, but several factors mitigate the impact.
The GPG (GNU Privacy Guard) private signing key was used to sign various artifacts for Firefox and Thunderbird, including Linux tarballs and RPM packages. An unencrypted copy of the key was inadvertently committed to a private GitHub repository accessible only to a small group of Mozilla developers who already had access to the key through other means. While an unauthorized party may have accessed the repository, there is no evidence they took advantage of the exposed key.
To err on the side of caution, Mozilla has decided to revoke the exposed key and issue a new one. This decision reflects the growing concern over software supply chain attacks in recent times. In such attacks, malicious actors compromise trusted third-party services or software distribution channels to inject malware into popular applications. The fact that most users don’t need to take any action is reassuring, but those who manually verify GPG signatures will have to import the new key and revocation for the old one.
Mozilla has also taken steps to prevent similar incidents in the future. This proactive approach to security is becoming increasingly common among organizations, especially after a series of high-profile supply chain attacks over the past year. It’s clear that Mozilla values user trust and is willing to take measures to protect it.
While users may not need to take immediate action, those who use Firefox RPM packages will have to follow detailed instructions provided by Mozilla to ensure their software remains secure. This incident serves as a reminder of the importance of robust security practices in software development and distribution.
Source: SecurityWeek — 2026-08-11