Attackers compromised the private keys for eight intermediate TLS certificates issued by Indian certificate authority eMudhra. The keys could let attackers create fraudulent HTTPS certificates to impersonate websites and intercept encrypted traffic. A researcher reported the vulnerability on October 17, 2026.
Google, Mozilla, Apple and Microsoft blocked the affected certificates. Mozilla began rolling out a Firefox fix within three hours of receiving the report.
Google’s Chrome Root Program said no fraudulent certificates appear to have been issued and trusted by major browsers before the block. The incident also prompted emergency security updates for the Go programming language.