Primary sources: Google Chrome and Android Security Teams post (Oct. 20, 2026), Mozilla Security Blog post (Oct. 20, 2026), eMudhra statement (updated Oct. 21, 2026), Cisco Talos threat advisory (Oct. 21, 2026)

Google's Chrome and Android security teams and Mozilla said they blocked eight intermediate certificate authorities run by eMudhra after a security researcher reported their private keys were compromised, and both are removing the root that signed them^1,2. The Indian certificate authority said it revoked all eight on Monday, Oct. 19^3,5.

Google said the keys were generated with too little randomness, which let anyone forge trusted HTTPS certificates for any website against clients that still trust those CAs¹. Cisco Talos said browser blocks do not reach every program, because some software that checks TLS certificates may not consult revocation lists, and named VPNs as one example⁴.

eMudhra said the intermediates were created in a key generation ceremony on April 30, 2025, and that a key wrap and unwrap step produced a second, weak set of keys, which were the ones published to browser root stores³. Talos gave the same account and said several of the private keys evaluated to single- and double-digit integers⁴. eMudhra said the flaw went undetected for about 18 months through two independent audit cycles and that it has not confirmed the exact root cause³.

Talos said six of the eight were TLS intermediates, blocked by Chrome, Mozilla and Apple, and two were code-signing intermediates blocked by Microsoft⁴. eMudhra describes all eight as part of its Global TLS business³.

Google said Chrome blocked the keys through a CRLSet update at 19:45 UTC on Saturday, Oct. 17, with no browser update or restart needed, and Android devices got an equivalent update through Google Play Services around 22:00 UTC on Monday¹. Because no certificates chaining to the six affected intermediates had been logged to Certificate Transparency before the block, none could have been used against clients that enforce it, including Chrome, Google said¹.

Mozilla said its OneCRL revocation list blocked the certificates for Firefox users on standard settings within three hours of the report, that it released Firefox 158.0.1, ESR 115.43.1 and ESR 153.5.1 on Tuesday, Oct. 20, for users whose settings stopped that update, and that NSS 3.131.1 removes the root².

Google said it has removed emSign ECC Root CA - G3 from the Chrome Root Store, a change expected to reach all devices on the morning of Tuesday, Oct. 27, Pacific time¹. It said some legitimate certificates under that root will stop working, that site operators using it must install a certificate from another hierarchy, and that it is investigating whether eMudhra's remaining CA certificates should stay trusted¹.

eMudhra said seven of the eight intermediates were never used in production, the eighth had issued no certificates, and the root distrust affects one customer ecosystem in the United States³. "No certificates had been issued from any of them, our infrastructure was not compromised, and no data was breached," the company said³.

The sources disagree on when the problem was first reported. Google said its root program received the report at 18:05 UTC on Saturday, Oct. 17, which was 11:35 p.m. that day in India, and Mozilla put its receipt at 20:06 UTC the same day^1,2. eMudhra said it was made aware late in the evening of Oct. 18, India time, about a day after Google's stated time, and that the researcher notified Apple, Google, Microsoft and Mozilla at the same time³. An earlier Oct. 20 update on eMudhra's own page repeated Mozilla's Oct. 17 date without comment³.

Talos said it had seen no malicious use of the certificates as of 10 a.m. ET on Wednesday, Oct. 21, and recommended updating software and trust stores as fixes become available⁴. It said the Go team released Go 1.27.3 and 1.26.10, which reject chains containing the eight keys, under CVE-2026-111943⁴. eMudhra said it knows of no evidence the weak keys were recovered or exploited before disclosure³. Mint reported that Cloudflare found no active exploitation on its own services and updated its WARP, 1.1.1.1 and cloudflared software⁵.

Sources

1. Google Chrome and Android Security TeamsProtecting Chrome and Android Users from Compromised eMudhra Intermediate CA Certificates
2. Mozilla Security BlogProtecting Firefox users following the compromise of eMudhra intermediate certificates
3. eMudhraeMudhra Statement on Recent Certificate Security Incident
4. Cisco TalosCompromised eMudhra intermediate certificatesOct 21, 4:43 PM
5. MintGoogle, Apple and Mozilla block 8 eMudhra certificates over weak keys: What users need to knowOct 21, 2:56 AM

Read the original at Google Chrome and Android Security Teams ↗