Google Chrome and Mozilla Firefox have blocked compromised digital certificates linked to Indian cybersecurity company eMudhra after researchers discovered a serious weakness in their cryptographic keys.
The incident, first reported on October 17, 2026, highlights how a small mistake in generating security keys can threaten the trust systems that protect websites and online communications.
Although browser developers responded quickly, the discovery raises important questions about certificate security and how businesses protect their digital infrastructure.
What Happened to eMudhra's Certificates?
According to Google's official security report, a security researcher identified weaknesses affecting eight intermediate Certificate Authority (CA) certificates operated by eMudhra.
These certificates used private keys generated with insufficient randomness, making them unusually easy to recover.
Normally, cryptographic private keys contain extremely large, unpredictable numbers. In this case, the affected elliptic-curve keys had values smaller than 256.
An attacker possessing such keys could potentially create fraudulent certificates that appear legitimate to vulnerable systems.
India's Computer Emergency Response Team (CERT-In) confirmed that six affected certificates were intended for TLS authentication and two for code signing.
How Google Chrome and Firefox Responded
Google and Mozilla acted rapidly after receiving reports of the vulnerability.
Google blocked the six affected TLS intermediate authorities through Chrome's certificate revocation mechanism on October 17.
This protection was distributed automatically, without requiring users to restart their browsers.
Mozilla similarly blocked the affected certificates using Firefox's OneCRL system.
According to the Mozilla Security Blog, the company completed distribution of its initial protection to standard Firefox configurations within three hours of receiving the report.
Mozilla also released additional Firefox security updates for users whose configurations might prevent automatic certificate-blocking updates.
Google subsequently announced the removal of the affected eMudhra root certificate from the Chrome Root Store, with rollout expected from October 27.
Are Ordinary Internet Users at Risk?
For most users running properly updated Chrome or Firefox installations, the immediate risk from these certificates has been substantially reduced.
Google reported that no TLS certificates chaining to the six compromised intermediates appeared in Certificate Transparency logs before Chrome blocked them.
This matters because Chrome requires publicly trusted certificates to satisfy Certificate Transparency rules, helping prevent fraudulent certificates from being silently accepted.
However, older software, applications using independent certificate stores, and unmaintained systems may require additional attention.
A compromised certificate authority does not automatically mean that users' passwords, banking information, or personal data have been stolen.
What Should Website Owners Do?
Website administrators should review their SSL/TLS certificate chains to determine whether they depend on affected eMudhra certificates.
Google advised operators using the emSign ECC Root CA - G3 hierarchy to obtain replacement certificates from another trusted certificate authority.
Businesses should also ensure that servers, applications, and operating systems receive appropriate security updates.
For ordinary users, keeping browsers and devices updated remains an important precaution.
What Has eMudhra Said?
In its official statement, eMudhra said it revoked all eight affected intermediate certificates on October 18.
The company stated that its infrastructure had not been compromised and that the affected intermediates had not issued any end-entity certificates.
CERT-In also clarified that eMudhra's domestic Digital Signature Certificate and eSign services were not affected because they operate on separate infrastructure.
Following the incident, eMudhra announced its decision to exit the global SSL/TLS certificate business.
Why This Incident Matters
The eMudhra incident demonstrates that online security depends not only on strong encryption algorithms but also on generating and managing cryptographic keys correctly.
Even sophisticated security infrastructure can become vulnerable when fundamental safeguards fail.
For internet users, the encouraging development is how quickly major browser developers responded.
For technology companies, the broader lesson is clear: digital trust requires continuous verification, transparent incident reporting, and reliable security practices.