Chrome and Firefox Block Compromised eMudhra Certificates

What happened in the eMudhra certificate compromise?

The eMudhra certificate compromise involved private keys for eight subordinate certificate authority certificates that were generated with insufficient randomness. Weak randomness can make a private key predictable enough for an attacker to create a forged certificate that appears valid to an unprotected device.

The affected certificates included six TLS intermediates trusted by Chrome, Mozilla, and Apple, plus two Microsoft code-signing intermediates, according to NHS England’s technical advisory. TLS certificates help browsers verify that a website is the site it claims to be. Code-signing certificates help users and operating systems assess whether software came from a trusted publisher.

The security risk matters because a forged HTTPS certificate could help an attacker impersonate a legitimate website for clients that still trust the affected certificate chain. The exposure is not the same for every person or device because browser vendors have already distributed blocks. The practical concern is greatest for software, devices, and trust stores that have not received those protections.

Which browsers have blocked the compromised eMudhra certificates?

Chrome, Android, and Firefox have all deployed protections against the compromised eMudhra certificate keys. Google blocked the affected keys through a Chrome CRLSet update at 19:45 UTC on October 17, 2026, which protects Chrome users without requiring a browser update or restart.

Android received an equivalent block through Google Play services around 22:00 UTC, Google said. The Android protection depends on Google Play services receiving the update, so restarting an Android device is a sensible way to prompt the device to check for the new configuration. Google documented the Chrome and Android response in its security incident notice.

Firefox standard configurations received the OneCRL blocklist by 22:59 UTC on October 17, less than 3 hours after Mozilla received the report. OneCRL is Firefox’s certificate revocation blocklist, which allows Mozilla to distrust known-bad certificates without waiting for every user to take manual action.

What should Chrome and Android users do now?

Chrome and Android users should keep their browsers and devices updated, then restart Android devices that may not have received the Google Play services block yet. Chrome users received the affected-key block automatically through CRLSet, so most current Chrome installations do not require a separate browser update or manual certificate change.

Android users should restart the device because Google says the equivalent protection arrives through Google Play services. A restart does not remove malware or repair a compromised website, but it can trigger the device to apply the updated certificate blocklist. The same general update discipline matters after other browser security fixes, including critical Chrome security updates that address separate vulnerabilities.

Chrome and Android users should not bypass browser certificate warnings for a site that normally works. A certificate error can mean a website has a configuration problem, but it can also signal an interception attempt or a connection that the browser cannot verify safely. Stop using the site for passwords, financial information, or downloads until the site operator resolves the error.

What should Firefox users update?

Firefox users should update to Firefox 158.0.1 or later, with Firefox for Android users installing Firefox 158.0.2 or later when available. Mozilla released Firefox 158.0.1 for desktop and Android, along with Firefox ESR 115.43.1 and ESR 153.5.1, to cover users whose settings may have prevented the OneCRL blocklist from updating.

Firefox for Android 158.0.2 followed after Mozilla identified that some clients did not apply the bundled OneCRL blocklist immediately after startup. The follow-up release matters because a security block only helps after the browser applies it. Mozilla described the affected releases and its mitigation timeline in its Firefox security update.

1. Open Firefox and select the application menu.
2. Select Help, then select About Firefox on desktop to check for updates.
3. Install the available Firefox update and restart the browser.
4. Open the Google Play Store on Android and update Firefox if version 158.0.2 or later is available.

Firefox users on an organization-managed device should stop after checking the installed version and contact the IT administrator if updates are blocked by policy. Enterprise Firefox deployments can use managed update schedules, and a local user should not try to override security controls or install unapproved software.

Why could legitimate websites stop working after October 27?

Chrome plans to remove the emSign ECC Root CA – G3 from the Chrome Root Store on the morning of October 27, 2026, Pacific Daylight Time. The root-store removal is intended to remove trust in the affected certificate hierarchy, but Google warns that some legitimate websites using certificates under that root could stop working in Chrome.

A browser certificate error after the removal does not automatically mean a website is malicious. A legitimate site can fail when its operator has not replaced or reconfigured a certificate chain before the browser stops trusting the root. At the same time, users should treat the error as a security boundary rather than clicking through it to reach a familiar site.

The practical response is to contact the website operator through a trusted channel if a necessary service stops loading. Use an official support page, a verified phone number, or an established account contact. Do not use a link embedded in an unexpected email or pop-up, particularly because phishing campaigns often rely on urgent certificate or account messages.

Which devices may remain exposed to the eMudhra certificate compromise?

Devices and software with outdated or unmanaged trust stores may remain exposed to the eMudhra certificate compromise. The NHS advisory says vendors have blocked the affected certificates, but systems without updated trust stores may still accept a forged certificate chain associated with the compromised keys.

Older phones, unsupported operating systems, embedded devices, and enterprise-managed software can receive certificate updates differently from current Chrome and Firefox installations. The issue is especially relevant for devices that do not use Google Play services, systems with restricted update access, and software that relies on its own certificate store rather than the operating system’s current store.

Organizations should identify systems that use the affected trust chains, confirm vendor guidance, and monitor for certificate validation failures after the Chrome root-store change. Security teams should also avoid treating a browser block as a complete replacement for inventory work, because network appliances, applications, and older endpoints can handle certificate validation separately.

Consumers should not attempt to manually edit certificate stores unless a device vendor or workplace administrator provides explicit instructions. Certificate-store changes can weaken normal browser protections if the wrong authority is trusted or removed. The safer choice is to install vendor updates or replace unsupported devices that no longer receive security maintenance.

What did eMudhra do after the certificate keys were compromised?

eMudhra revoked all eight affected intermediate certificates on October 18, 2026. The company says seven of the certificates were never deployed in production, while the one certificate that was deployed had not issued any end-entity certificates.

Revocation is important because it tells relying software that a certificate should no longer be trusted. Browser-side blocklists add another layer of protection because browsers can reject a known-compromised certificate even when ordinary revocation checking is unavailable or delayed. eMudhra’s incident statement provides its timeline and deployment assessment.

The eMudhra response reduces the known certificate-chain risk, but it does not remove the need for browser and device updates. A revoked certificate offers less protection when a client has an old trust store, cannot obtain updated revocation information, or uses software that has not incorporated the vendor block. Users should therefore update first and investigate certificate warnings rather than dismissing them.

FAQ

Does the eMudhra certificate compromise require Chrome users to update Chrome?

Chrome users generally do not need a separate Chrome update for the initial affected-key block because Google deployed the block through CRLSet on October 17, 2026. Chrome users should still keep the browser updated because the Chrome Root Store removal is expected to reach supported devices on October 27, 2026.

Should Android users restart their phones after the eMudhra certificate compromise?

Android users should restart their phones to help trigger the Google Play services update that carries the affected-key block. Google says Android received the equivalent protection around 22:00 UTC on October 20, 2026.

Which Firefox version fixes the eMudhra certificate issue?

Firefox 158.0.1, Firefox ESR 115.43.1, and Firefox ESR 153.5.1 provide protections for users who may not receive OneCRL updates normally. Firefox for Android users should install version 158.0.2 or later because Mozilla found that some Android clients did not apply the bundled blocklist immediately after startup.

Can a legitimate website show a certificate error after October 27?

Yes, legitimate websites can show a certificate error after October 27 if they still use certificates under the emSign ECC Root CA – G3 root that Chrome is removing. Website visitors should not bypass the warning and should contact the site operator through a trusted channel.

Are older devices still at risk from the eMudhra certificate compromise?

Older devices can remain at risk if their browsers, operating systems, or separate trust stores have not received the affected-certificate blocks. Unsupported devices should be updated through the vendor if possible, and users should avoid entering sensitive information after any certificate warning.