Google Chrome and Mozilla Firefox users, beware! CERT-In has identified a security flaw in eight eMudhra digital certificates. Starting October 27, 2026, some websites in Chrome may display a security warning.

CERT-In Cyber ​​Security Alert

If you use Google Chrome or Mozilla Firefox on your phone or laptop, this news is useful. On October 21st, the government's cybersecurity agency, CERT-In, issued an alert regarding a major security flaw in the digital certificate of the Indian company eMudhra.

Security vulnerabilities were found in eight of the company's digital certificates: six related to the identity and security of websites, and two related to the identity of software.

What is the whole matter?

To put it simply, a digital ID is used to prove the authenticity of a website on the Internet. This is called a digital certificate. It also comes with a unique digital code that helps verify the website's identity.

According to CERT-In's advisory, the process for generating this unique code associated with eight eMudhra certificates was vulnerable, allowing a knowledgeable person to decipher the code and misuse it.

How could the hacker commit fraud?

Imagine you're visiting your bank's website. The browser verifies the website's identity to ensure you're on the right track. If a hacker obtains the digital code that identifies the website, they could attempt to create a fake certificate for a website they don't own. This could make the fake website appear similar to the real one, increasing the risk of fraud.

Similarly, an attempt could be made to make a dangerous program appear like software from a trusted company by misusing the secret keys of two certificates associated with the software.

Was people's data stolen?

Currently, CERT-In's advisory provides no evidence that data was stolen through these vulnerable certificates. According to eMudhra, no websites or software were issued certificates for further use using these eight certificates.

Google also reported that the certificates associated with the six affected websites were not found in its records. However, this does not mean that all threats on the Internet have been eliminated.

What steps did Google and Mozilla take?

Google and Firefox maker Mozilla have blocked the affected website certificates. Simply put, the browser will no longer trust these certificates. Mozilla has also released new versions of Firefox to provide security information to users whose browsers haven't automatically updated it.

Google has also decided to remove eMudhra's master certificate, 'emSign ECC Root CA - G3', from Chrome's trusted list. This change will take effect on October 27, 2026.

What problems can arise after October 27?

Here's an important point to understand: A website's primary digital certificate is part of a comprehensive system for trusting its identity. If the browser stops trusting that primary certificate, some associated genuine website certificates may also become untrustworthy.

As a result, some genuine websites may display security warnings or have trouble opening. However, the CERT-In letter does not specify the total number of affected websites.

What should you do?

First, keep Chrome, Firefox, and your operating system updated on your phone and laptop. If you see a warning on a website that the connection is not secure, don't ignore it.

Especially if you see such a warning on a bank, online payment or shopping website, do not enter your password, card number or other personal information.

Government departments, companies, and website owners should also check whether their websites rely on this compromised digital security system. If so, they may need to obtain a new digital certificate from another trusted system. Overall, this issue addresses a security flaw in the way websites are identified and trusted on the Internet. It's important for ordinary users to keep their browsers updated and exercise caution when they receive security warnings on any website.