Mozilla has updated the GPG signing key used for Firefox and Thunderbird releases after an unencrypted copy of the previous subkey was inadvertently committed to a private GitHub repository. The organization announced the key rotation on August 11, 2026, stating that the exposed key was used to sign Linux tarballs, RPM packages, and checksum files for both applications.
Despite the exposure, Mozilla believes the risk of a supply chain attack is low. This assessment is based on two factors: the GitHub repository where the key was exposed had access restricted to a limited number of individuals within Mozilla, and an internal review of audit records found no evidence that unauthorized parties accessed the key while it was present in the repository. All individuals with access to the repository already had authorized access to the key through other means.
Upon discovering the incident, Mozilla revoked the compromised key and implemented measures to prevent similar issues in the future. The new signing subkey is set to expire on August 5, 2028. The new public key and the revocation for the old key are available via the latest Firefox Nightly KEY files and on keys.openpgp.org.
Most users will not need to take any action following the key rotation. However, users who manually verify GPG signatures must import the new signing key and the revocation for the old key.
Linux users who install Firefox using RPM packages may need to manually update their systems to continue receiving the latest Firefox updates. Mozilla has provided detailed instructions for systems running Fedora 43 and later, Fedora 42 and older, RHEL/Rocky/Almalinux, and openSUSE/SUSE-based distributions. Thunderbird users are not affected by RPM-specific actions, as official RPM packages are not provided for Thunderbird.
