{
 "schema_version": "1.0",
 "agent_rules": [
  "Use only read-only checks (the commands marked read_only, or the app's own About menu). Never run anything that changes the computer.",
  "Never install, update, uninstall or change settings without the user's clear OK for that exact step.",
  "Only give the user the official links in this feed (official_patch_links and sources). Never send them to a download from anywhere else.",
  "If you cannot tell whether the user is affected, say so plainly instead of guessing.",
  "Say 'unconfirmed' when an incident's confidence is 'unconfirmed'."
 ],
 "incident": {
  "id": "emudhra-fake-website-certificates",
  "url": "https://patchgap.ai/incidents/emudhra-fake-website-certificates/",
  "path": "/incidents/emudhra-fake-website-certificates/",
  "json_url": "https://patchgap.ai/incidents/emudhra-fake-website-certificates.json",
  "title": "Fake website certificates: browsers and computers are blocking a certificate company's weak keys",
  "category": "browsers",
  "platforms": [
   "windows",
   "macos",
   "linux"
  ],
  "products": [
   "chrome",
   "firefox",
   "edge",
   "windows",
   "macos",
   "tailscale"
  ],
  "status": "partial",
  "status_label": "Partly patched",
  "severity": "high",
  "severity_source": "Mozilla and Google both treat it as a serious break in website trust. No score exists.",
  "exploited_in_wild": "no",
  "exploited_note": "Google says no fake certificates were found in public records before it blocked the keys. The company (eMudhra) says it issued no certificates from those keys.",
  "exploited_source_url": "https://blog.google/security/protecting-chrome-and-android-users-from-compromised-emudhra-intermediate-ca-certificates/",
  "confidence": "confirmed",
  "confidence_note": null,
  "first_reported": "2026-10-17",
  "updated_at": "2026-10-27",
  "cves": [],
  "summary": "When you visit a secure website, your browser trusts a 'certificate' to prove the site is real. A company called eMudhra made weak secret keys for 8 of its certificate makers. Someone could use them to make fake certificates and pretend to be any website. Mozilla, Google, Apple and Microsoft all blocked those keys in the days after Oct 17. Most of this is automatic. Make sure your browser and your computer are up to date.",
  "am_i_affected": "Most people are already protected because the block went out by itself within hours. Browsers and computers that were offline, or had special settings, may be behind. Update your browser and your computer to be sure. Mac command-line tools still need a future Apple update.",
  "action": "Update your browsers, Windows, Mac and Tailscale",
  "affected": [
   {
    "product": "firefox",
    "product_name": "Mozilla Firefox",
    "platform": "windows",
    "affected_versions": "Firefox with settings that stopped the automatic block",
    "fixed_version": "158.0.1 (ESR: 153.5.1 or 115.43.1)",
    "fixed_min": null,
    "fix_note": null,
    "fixed_source_urls": [
     "https://blog.mozilla.org/security/2026/10/20/protecting-firefox-users-following-the-compromise-of-emudhra-intermediate-certificates/"
    ],
    "check": {
     "menu_path": "Click the three lines at the top right > Help > About Firefox. Firefox checks for updates there.",
     "command": "Get-ItemProperty 'HKLM:\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\*','HKLM:\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\*','HKCU:\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\*' -ErrorAction SilentlyContinue | Where-Object DisplayName -like '*Mozilla Firefox*' | Select-Object DisplayName,DisplayVersion",
     "shell": "PowerShell",
     "read_only": true
    },
    "official_download": "https://www.mozilla.org/firefox/new/"
   },
   {
    "product": "firefox",
    "product_name": "Mozilla Firefox",
    "platform": "macos",
    "affected_versions": "Firefox with settings that stopped the automatic block",
    "fixed_version": "158.0.1 (ESR: 153.5.1 or 115.43.1)",
    "fixed_min": null,
    "fix_note": null,
    "fixed_source_urls": [
     "https://blog.mozilla.org/security/2026/10/20/protecting-firefox-users-following-the-compromise-of-emudhra-intermediate-certificates/"
    ],
    "check": {
     "menu_path": "Firefox menu bar: Firefox > About Firefox.",
     "command": "defaults read \"/Applications/Firefox.app/Contents/Info\" CFBundleShortVersionString",
     "shell": "Terminal",
     "read_only": true
    },
    "official_download": "https://www.mozilla.org/firefox/new/"
   },
   {
    "product": "firefox",
    "product_name": "Mozilla Firefox",
    "platform": "linux",
    "affected_versions": "Firefox with settings that stopped the automatic block",
    "fixed_version": "158.0.1 (ESR: 153.5.1 or 115.43.1)",
    "fixed_min": null,
    "fix_note": null,
    "fixed_source_urls": [
     "https://blog.mozilla.org/security/2026/10/20/protecting-firefox-users-following-the-compromise-of-emudhra-intermediate-certificates/"
    ],
    "check": {
     "menu_path": "Firefox menu > Help > About Firefox.",
     "command": "firefox --version",
     "shell": "Terminal",
     "read_only": true
    },
    "official_download": "https://www.mozilla.org/firefox/new/"
   },
   {
    "product": "chrome",
    "product_name": "Google Chrome",
    "platform": "windows",
    "affected_versions": "Chrome that has not yet received the Oct 27 trust-list update",
    "fixed_version": null,
    "fixed_min": null,
    "fix_note": "Chrome blocked the keys the same day with no update. It removes the whole root certificate in a release that began rolling out Oct 27, 2026.",
    "fixed_source_urls": [
     "https://blog.google/security/protecting-chrome-and-android-users-from-compromised-emudhra-intermediate-ca-certificates/"
    ],
    "check": {
     "menu_path": "Click the three dots at the top right > Help > About Google Chrome. Chrome checks for updates there, then click Relaunch.",
     "command": "(Get-ItemProperty 'HKCU:\\Software\\Google\\Chrome\\BLBeacon' -ErrorAction SilentlyContinue).version",
     "shell": "PowerShell",
     "read_only": true
    },
    "official_download": "https://support.google.com/chrome/answer/95414"
   },
   {
    "product": "chrome",
    "product_name": "Google Chrome",
    "platform": "macos",
    "affected_versions": "Chrome that has not yet received the Oct 27 trust-list update",
    "fixed_version": null,
    "fixed_min": null,
    "fix_note": "Chrome blocked the keys the same day with no update. It removes the whole root certificate in a release that began rolling out Oct 27, 2026.",
    "fixed_source_urls": [
     "https://blog.google/security/protecting-chrome-and-android-users-from-compromised-emudhra-intermediate-ca-certificates/"
    ],
    "check": {
     "menu_path": "Chrome menu bar: Chrome > About Google Chrome.",
     "command": "defaults read \"/Applications/Google Chrome.app/Contents/Info\" CFBundleShortVersionString",
     "shell": "Terminal",
     "read_only": true
    },
    "official_download": "https://support.google.com/chrome/answer/95414"
   },
   {
    "product": "chrome",
    "product_name": "Google Chrome",
    "platform": "linux",
    "affected_versions": "Chrome that has not yet received the Oct 27 trust-list update",
    "fixed_version": null,
    "fixed_min": null,
    "fix_note": "Chrome blocked the keys the same day with no update. It removes the whole root certificate in a release that began rolling out Oct 27, 2026.",
    "fixed_source_urls": [
     "https://blog.google/security/protecting-chrome-and-android-users-from-compromised-emudhra-intermediate-ca-certificates/"
    ],
    "check": {
     "menu_path": "Chrome menu: three dots > Help > About Google Chrome.",
     "command": "google-chrome --version",
     "shell": "Terminal",
     "read_only": true
    },
    "official_download": "https://support.google.com/chrome/answer/95414"
   },
   {
    "product": "edge",
    "product_name": "Microsoft Edge",
    "platform": "windows",
    "affected_versions": "Edge that has not yet received the Oct 27 trust-list update",
    "fixed_version": null,
    "fixed_min": null,
    "fix_note": "Microsoft Edge blocks the keys automatically. Microsoft planned to remove the affected roots from Edge's trust list on Oct 27, 2026.",
    "fixed_source_urls": [
     "https://www.microsoft.com/en-us/msrc/blog/2026/10/microsoft-response-to-compromised-emudhra-certificate-authority-keys"
    ],
    "check": {
     "menu_path": "Click the three dots at the top right > Help and feedback > About Microsoft Edge.",
     "command": "(Get-Item \"${env:ProgramFiles(x86)}\\Microsoft\\Edge\\Application\\msedge.exe\" -ErrorAction SilentlyContinue).VersionInfo.ProductVersion",
     "shell": "PowerShell",
     "read_only": true
    },
    "official_download": "https://www.microsoft.com/edge/download"
   },
   {
    "product": "edge",
    "product_name": "Microsoft Edge",
    "platform": "macos",
    "affected_versions": "Edge that has not yet received the Oct 27 trust-list update",
    "fixed_version": null,
    "fixed_min": null,
    "fix_note": "Microsoft Edge blocks the keys automatically. Microsoft planned to remove the affected roots from Edge's trust list on Oct 27, 2026.",
    "fixed_source_urls": [
     "https://www.microsoft.com/en-us/msrc/blog/2026/10/microsoft-response-to-compromised-emudhra-certificate-authority-keys"
    ],
    "check": {
     "menu_path": "Edge menu bar: Microsoft Edge > About Microsoft Edge.",
     "command": "defaults read \"/Applications/Microsoft Edge.app/Contents/Info\" CFBundleShortVersionString",
     "shell": "Terminal",
     "read_only": true
    },
    "official_download": "https://www.microsoft.com/edge/download"
   },
   {
    "product": "windows",
    "product_name": "Windows 10 and 11",
    "platform": "windows",
    "affected_versions": "Windows without Microsoft's Oct 26, 2026 trust-list update",
    "fixed_version": null,
    "fixed_min": null,
    "fix_note": "Microsoft released an out-of-band Windows update on Oct 26, 2026 that removes seven affected certificates.",
    "fixed_source_urls": [
     "https://www.microsoft.com/en-us/msrc/blog/2026/10/microsoft-response-to-compromised-emudhra-certificate-authority-keys"
    ],
    "check": {
     "menu_path": "Start > Settings > Windows Update. Then click Update history to see recent updates.",
     "command": "Get-CimInstance Win32_OperatingSystem | Select-Object Caption,Version,BuildNumber; Get-HotFix | Sort-Object InstalledOn -Descending | Select-Object -First 5 HotFixID,InstalledOn",
     "shell": "PowerShell",
     "read_only": true
    },
    "official_download": "https://support.microsoft.com/windows/update-windows-3c5ae7fc-9fb6-9af1-1984-b5e0412c556a"
   },
   {
    "product": "macos",
    "product_name": "macOS",
    "platform": "macos",
    "affected_versions": "Mac command-line tools (not Safari or other apps)",
    "fixed_version": null,
    "fixed_min": null,
    "fix_note": "Apple blocked the certificates automatically from Oct 19, 2026 (and the root on Oct 23). A future macOS update will block them in command-line tools too.",
    "fixed_source_urls": [
     "https://support.apple.com/en-us/149555"
    ],
    "check": {
     "menu_path": "Apple menu > About This Mac. Or Apple menu > System Settings > General > Software Update.",
     "command": "sw_vers -productVersion",
     "shell": "Terminal",
     "read_only": true
    },
    "official_download": "https://support.apple.com/en-us/108382"
   },
   {
    "product": "tailscale",
    "product_name": "Tailscale",
    "platform": "windows",
    "affected_versions": "Tailscale older than v1.104.2",
    "fixed_version": "1.104.2",
    "fixed_min": "1.104.2",
    "fix_note": "Tailscale v1.104.2 (Oct 21, 2026) includes Go 1.27.3, which refuses the compromised certificates.",
    "fixed_source_urls": [
     "https://tailscale.com/security-bulletins",
     "https://tailscale.com/changelog"
    ],
    "check": {
     "menu_path": "Click the Tailscale icon (tray on Windows, menu bar on Mac) and choose About Tailscale.",
     "command": "tailscale version",
     "shell": "PowerShell",
     "read_only": true
    },
    "official_download": "https://tailscale.com/download"
   },
   {
    "product": "tailscale",
    "product_name": "Tailscale",
    "platform": "macos",
    "affected_versions": "Tailscale older than v1.104.2",
    "fixed_version": "1.104.2",
    "fixed_min": "1.104.2",
    "fix_note": "Tailscale v1.104.2 (Oct 21, 2026) includes Go 1.27.3, which refuses the compromised certificates.",
    "fixed_source_urls": [
     "https://tailscale.com/security-bulletins",
     "https://tailscale.com/changelog"
    ],
    "check": {
     "menu_path": "Click the Tailscale icon in the menu bar > About Tailscale.",
     "command": "tailscale version",
     "shell": "Terminal",
     "read_only": true
    },
    "official_download": "https://tailscale.com/download"
   },
   {
    "product": "tailscale",
    "product_name": "Tailscale",
    "platform": "linux",
    "affected_versions": "Tailscale older than v1.104.2",
    "fixed_version": "1.104.2",
    "fixed_min": "1.104.2",
    "fix_note": "Tailscale v1.104.2 (Oct 21, 2026) includes Go 1.27.3, which refuses the compromised certificates.",
    "fixed_source_urls": [
     "https://tailscale.com/security-bulletins",
     "https://tailscale.com/changelog"
    ],
    "check": {
     "menu_path": "Open the app and look in its Help or About menu, or check your software manager.",
     "command": null,
     "shell": null,
     "read_only": null
    },
    "official_download": "https://tailscale.com/download"
   }
  ],
  "fix_steps": [
   "Update your browser: Chrome (three dots > Help > About Google Chrome), Firefox (three lines > Help > About Firefox), Edge (three dots > Help and feedback > About Microsoft Edge).",
   "Run Windows Update (Settings > Windows Update) and install everything, including the update from Oct 26.",
   "On a Mac, run Software Update (System Settings > General > Software Update).",
   "If you use Tailscale, update it to the newest version.",
   "A site that suddenly shows a certificate warning might use the blocked company. That is expected. Do not click through the warning. Tell the site owner."
  ],
  "official_patch_links": [
   {
    "label": "Mozilla: blog post about the eMudhra block",
    "url": "https://blog.mozilla.org/security/2026/10/20/protecting-firefox-users-following-the-compromise-of-emudhra-intermediate-certificates/"
   },
   {
    "label": "Apple: about the compromised eMudhra certificates",
    "url": "https://support.apple.com/en-us/149555"
   },
   {
    "label": "Microsoft: response to the eMudhra keys",
    "url": "https://www.microsoft.com/en-us/msrc/blog/2026/10/microsoft-response-to-compromised-emudhra-certificate-authority-keys"
   }
  ],
  "extra_checks": [],
  "sources": [
   {
    "url": "https://blog.mozilla.org/security/2026/10/20/protecting-firefox-users-following-the-compromise-of-emudhra-intermediate-certificates/",
    "title": "Mozilla Security Blog: Protecting Firefox users after the eMudhra compromise",
    "date": "2026-10-20",
    "kind": "vendor",
    "official": true
   },
   {
    "url": "https://blog.google/security/protecting-chrome-and-android-users-from-compromised-emudhra-intermediate-ca-certificates/",
    "title": "Google: Protecting Chrome and Android users from compromised eMudhra certificates",
    "date": "2026-10-20",
    "kind": "vendor",
    "official": true
   },
   {
    "url": "https://support.apple.com/en-us/149555",
    "title": "Apple Support: About the compromised eMudhra intermediate CAs",
    "date": "2026-10-23",
    "kind": "vendor",
    "official": true
   },
   {
    "url": "https://www.microsoft.com/en-us/msrc/blog/2026/10/microsoft-response-to-compromised-emudhra-certificate-authority-keys",
    "title": "Microsoft MSRC: Response to compromised eMudhra keys",
    "date": "2026-10-26",
    "kind": "vendor",
    "official": true
   },
   {
    "url": "https://tailscale.com/changelog",
    "title": "Tailscale changelog (Oct 21, 2026 entry)",
    "date": "2026-10-21",
    "kind": "vendor",
    "official": true
   },
   {
    "url": "https://emudhra.com/en/post/certificate-security-incident",
    "title": "eMudhra: Statement on the certificate security incident",
    "date": "2026-10-21",
    "kind": "primary",
    "official": true
   },
   {
    "url": "https://tailscale.com/security-bulletins",
    "title": "Tailscale security bulletin TS-2026-013 (eMudhra certificates)",
    "date": "2026-10-21",
    "kind": "vendor",
    "official": true
   }
  ]
 }
}