Google, Mozilla and Apple have taken quick steps to mitigate risks that were discovered in digital certificates issued by Indian company eMudhra. For those who do not know, the digital certificates help browsers such as Safari, Chrome and Firefox to check whether a website is real. They act as a verifying tool to keep the information flow going between websites and users in a secured way. On October 17, a security official found that eight certificates had extremely weak security keys, which may allow hackers to create fake websites certificates. This raised concerns over the online certificates linked to systems trusted by browsers.
Here’s What Happened
According to an official incident report by Mozilla, a security researcher identified as Wayne found that the private keys linked to eight eMudhra intermediate certificates were compromised. This means that someone with those weak keys could potentially create fake security certificates for legitimate websites and steal data.
Mozilla confirmed that its engineers were able to recover the affected private jets, showing how serious the problem was. After the issue was reported, major tech giants quickly responded to the problem.
As per the Google’s official security blog, its Chrome team received the report on October 17 and blocked the six affected certificates authorised to issue website security certificates on the same day. The company also introduced protections for Android devices through Google Play Services. Google said most Android devices had already received the update and that restarting a device could help trigger it.
Apple also took action. According to the incident timeline published by the researchers, Apple verified the findings on October 17 and introduced protections against the compromised certificates on October 19.
Related News |
Anthropic Reports Over $80 Billion Net Loss In First Half Of 2026: WSJ
What Did eMudhra Say About The Security Flaw?
According to the incident report, eMudhra acknowledged the problem and began investigating how the affected certificates had been created.
The company attributed the issue to an error in a script used to generate certificates in April 2025.
The error reportedly resulted in a second set of weaker security keys being generated. These keys were mistakenly selected for signing certificates because their labels were similar to those of the correctly generated keys.
eMudhra subsequently revoked all eight affected certificates and stopped issuing new certificates under the impacted G3 root. For most users, the immediate priority is to keep their devices, browsers and applications updated.
