[Bug]: Desktop ships Electron 44.4.5, which still trusts the compromised eMudhra CA keys (fixed in 44.9.1) #22610

Before submitting

• I searched existing issues and did not find a duplicate.
• I included enough detail to reproduce or investigate the problem.

Area

apps/desktop

Summary

The desktop app ships Electron 44.4.5, which still trusts the eight eMudhra (emSign) intermediate CA certificates whose private keys were found to be recoverable (disclosed 2026-10-17 to 2026-10-20). Electron 44.9.1 adds those keys to its certificate SPKI blocklist and applies the blocklist to Node's TLS as well (electron/electron#55126, merged 2026-10-20; v44.9.1 published 2026-10-20). 44.9.2 is the newest 44.x on npm.

Affected intermediates: EM DV / OV / EV TLS CA - G3B and G3C, and EM OV CS CA - G3B and G3C (also cross-signed by Sectigo AAA Certificate Services). Chrome and Firefox already block them; apps that bundle an older Chromium/Node do not.

Steps to reproduce

1. git show main:apps/desktop/package.json | grep '"electron"' on main @ ecfe4f7 shows "electron": "44.4.5".
2. pnpm-workspace.yaml also pins [email protected] under minimumReleaseAgeExclude.

Expected behavior

The desktop app runs an Electron release that rejects certificate chains containing the compromised eMudhra keys (44.9.1 or later on the 44 line).

Actual behavior

It runs 44.4.5, which accepts them. A TLS server presenting a certificate issued from one of these keys (anyone can now mint one) would be trusted by the renderer and by Node https/fetch in the Electron process.

Impact

Major degradation or frequent failure

(Security exposure rather than a functional failure; no exploitation known. Chrome says no TLS certificate chaining to the six TLS intermediates had been logged to Certificate Transparency before its block.)

Version or commit

main @ ecfe4f7

Suggested fix

Bump electron in apps/desktop/package.json to 44.9.1 or 44.9.2, move the electron@… entry in pnpm-workspace.yaml minimumReleaseAgeExclude with it (44.9.x is younger than the minimum release age), and regenerate pnpm-lock.yaml.

Node.js itself had no released fix as of 2026-10-20, so any part of T3 Code that runs on a standalone Node (not Electron's) stays exposed until Node ships one.

References

• Mozilla: https://blog.mozilla.org/security/2026/10/20/protecting-firefox-users-following-the-compromise-of-emudhra-intermediate-certificates/
• Scott Helme: https://scotthelme.co.uk/eight-bits-of-trust-emudhras-ca-keys-cracked-in-milliseconds/
• Electron fix: fix: apply the certificate SPKI blocklist to Node and add entries electron/electron#55126