Google and Mozilla have taken emergency security measures after private keys linked to eight eMudhra intermediate certification authority certificates were compromised, potentially allowing attackers to create fraudulent HTTPS certificates and impersonate legitimate websites.
FCRF’s Chief AI Officer Certification Returns on November 14 to Prepare Future AI Leaders
What Happened to eMudhra Certificates?
The security incident came to light on October 17, 2026, when Google and Mozilla received reports concerning compromised private keys associated with eight eMudhra intermediate certificates. Google said the keys had been generated with insufficient cryptographic randomness, making them vulnerable to compromise.
These certificates form part of the digital trust infrastructure used to verify website identities and establish secure HTTPS connections. An attacker possessing the affected private keys could potentially issue fraudulent certificates for websites they do not control.
Such certificates could enable website impersonation and, under certain circumstances, allow attackers to intercept or modify communications. The disclosures concern compromised certificate keys rather than a confirmed breach of individual users’ devices.
How Did Google Protect Chrome Users?
Google’s Chrome Root Program received the security report at 18:05 UTC on October 17 and completed its initial protective action by 19:45 UTC.
The company deployed a CRLSet update blocking the affected certificate keys. The protection reached Chrome users without requiring a browser update or restart.
Android devices and Google applications received equivalent protections through Google Play services around 22:00 UTC. Google said most Android devices had already received the update, although restarting a device could trigger immediate protection.
Google also reported that no certificates issued through six affected intermediate authorities had been recorded in Certificate Transparency logs before the blocking action. Consequently, fraudulent certificates from those authorities could not have been used against clients enforcing Certificate Transparency requirements.
What Action Did Mozilla Take?
Mozilla received its report at 20:06 UTC on October 17 and immediately blocked the affected certificates through Firefox’s OneCRL system.
By 22:59 UTC, Mozilla had completed distribution of the updated blocklist to Firefox users operating with standard configurations, less than three hours after receiving the report.
Mozilla also announced Firefox 158.0.1 for desktop and Android, alongside Firefox ESR 115.43.1 and Firefox ESR 153.5.1, to protect users whose customised settings might have prevented them from receiving the OneCRL update.
Will eMudhra Certificates Remain Trusted?
Google has removed the eSign ECC Root CA – G3 certificate, which signed the compromised intermediate certificates, from the Chrome Root Store. The removal could affect legitimate websites relying on that certificate chain.
Google advised affected website operators to obtain new TLS certificates from another trusted certificate hierarchy to prevent connection failures.
Mozilla is similarly updating its Network Security Services trusted certificate list through NSS 3.131.1. Google also said it was investigating whether eMudhra’s remaining certificates should continue to be trusted.
The420 Insight: What Should Users Do?
The incident demonstrates how weaknesses in certificate infrastructure can threaten trust across browsers and digital services. Although Google and Mozilla rapidly deployed protections, users should keep browsers and devices updated. Website operators relying on affected certificates should review their certificate chains and arrange replacements where necessary.
Follow for daily updates on cybercrime, corporate fraud, DFIR, hacking, investigations, and digital forensics
