EIGHT intermediate certificate authority (CA) keys from Indian firm eMudhra have been compromised, triggering emergency fixes across major browsers and software ecosystems. Mozilla and Google’s Chrome Root Program confirmed the breach on 20 October 2026. The eight affected certificates include TLS domain-validated, organizational-validated, and EV TLS intermediates, plus two code-signing certificates.
Each of the TLS intermediates chains to emSign Root TLS CA - G3, with six of the certificates also cross-signed by Sectigo under its AAA Certificate Services root. Chrome notes that the cross-signed copies are caught by its public-key based blocking, and that no TLS chaining to the six intermediates logged in Certificate Transparency prior to the block.
Evidence and response unfolded rapidly. The Chrome Root Program blocked the six TLS intermediates via a CRLSet update by 19:45 UTC on 20 October, and Mozilla pushed a OneCRL block to Firefox by 22:59 UTC. Apple and other trust stores were informed; the certificates were revoked by eMudhra. Nine components and related bundles were updated or removed to mitigate risk, including Go, NSS, Python certifi, webpki-roots, Homebrew ca-certificates, and NSS removals of emSign ECC Root CA - G3 from trusted lists.
CVEs tied to the circumvention fixes include CVE-2026-111943 (Go chain rejection) and CVE-2026-113470 (OneCRL block in Firefox). Notably, Go’s fix requires rebuilding (Go 1.27.3 and 1.26.10), while Firefox and NSS updates carry the OneCRL block and root removals. Mozilla and Chrome state they do not presently believe other CAs are affected.