Google has blocked compromised certificate keys that could allow forged HTTPS certificates, and says Android users can restart their device to trigger the equivalent protective update.
The October 20 notice from Chrome and Android's security teams describes a report received on October 17 about eight eMudhra intermediate certificate authorities. Their keys had insufficient randomness, making them vulnerable to reconstruction and misuse.
Chrome applied a CRLSet block that Saturday without requiring a browser restart. Android devices and Googlebooks received an equivalent Google Play Services update around 22:00 UTC on Monday. Google says most Android devices had received it by the notice's publication.
The Chromium project's CRLSet documentation describes these lists as Chrome's main mechanism for quickly blocking certificates in emergencies. This explains why Google's immediate protection did not wait for an ordinary browser-version upgrade. A later root-store removal is a separate trust change and has its own implications for site operators.
The action depends on your role
| Reader | Practical next step |
|---|---|
| Android device owner | Restart to trigger the protective update |
| Chrome user | Keep updates enabled; the key block was delivered automatically |
| Website operator using the affected root | Arrange a replacement certificate chain before the root removal |
An HTTPS certificate helps a browser establish the identity of the website at the other end of a connection. When the authority behind that certificate becomes untrustworthy, blocking its keys can protect readers but also break legitimate sites relying on the same chain.
Google plans to remove the emSign ECC Root CA - G3 root from the Chrome Root Store on October 27 Pacific time. Operators with certificates chaining to that root should acquire and install a replacement from another trusted hierarchy, according to the notice.
For someone visiting a site, a certificate error is a reason to stop and contact the operator through a known route. Do not bypass the warning just because the address is familiar.
The trust change can affect a certificate before its ordinary expiration date. Operators need to check the installed chain even if no renewal is due.
