What changed
On October 17, 2026, Chrome and Mozilla received reports of compromised private keys associated with eight eMudhra intermediate certification authority certificates. Google says the keys were generated with insufficient entropy, allowing fraudulent certificates to be created for arbitrary domains. Chrome deployed CRLSet blocks and Mozilla distributed OneCRL revocations on October 17; Mozilla released Firefox 158.0.1 and ESR security builds October 20 for clients missing remote revocation. Google plans to remove emSign ECC Root CA - G3 from the Chrome Root Store for general devices on October 27, potentially breaking legitimate chains under that root. Cloudflare updated WARP/One clients and cloudflared 2026.10.2, plus server-side mitigations. eMudhra says the eight affected intermediate keys did not issue end-entity certificates, but this does not make the key compromise harmless.
Why it matters
Trusting a compromised intermediate CA can let a network-positioned attacker present a forged certificate for another website. Browser emergency revocation protected standard configurations quickly, but background services, pinned/custom trust stores, outdated images and client libraries may not receive browser revocation updates. Operators with certificates chaining to the distrusted root face real breakage and must migrate certificates, while service developers need to check the TLS verifier actually used by each workload.
What was compromised and what is known
Google's Chrome Root Program and Mozilla both confirmed eight intermediate CA private keys with inadequate entropy. The issue concerns authentication of server certificates, not a flaw in TLS ciphers. eMudhra says no end-entity certificates were issued by the affected intermediates and that the root private keys were not compromised; those are company claims under investigation. No confirmed widespread exploitation has been established in the cited incident notices.
Emergency browser and root-store responses
Chrome blocked affected public keys through CRLSet on October 17, without waiting for a full browser release. Mozilla OneCRL reached standard Firefox configurations within hours and Firefox 158.0.1 plus ESR 115.43.1/153.5.1 followed October 20 for atypical settings. Chrome plans to remove emSign ECC Root CA - G3 from its root store on October 27; some legitimate certificates chaining to that root will then fail validation. Mozilla is updating NSS trust roots as well.
Cloudflare-specific mitigations and action
Cloudflare says its CDN and Zero Trust mitigations were deployed by October 20, and directs WARP/Cloudflare One users to updated clients and cloudflared operators to 2026.10.2. Customers using custom mTLS trust stores, Full (strict) origin validation or container images must assess their own certificates and trust stores; application-specific TLS stacks can remain exposed even if the user's browser is patched.
Practical validation without weakening TLS
Inventory origin and client certificates issued under the affected eMudhra root, replace affected chains using an unaffected CA, update operating-system and language-runtime trust stores and redeploy affected services. Verify from the application's actual TLS path, not only a browser or curl test. Certificate errors after distrust should be resolved by replacing the chain, not by disabling certificate verification.