Key facts
- Eight intermediate certificates from eMudhra Limited were blocked due to a private key generation flaw.
- Attackers could use fraudulent certificates to impersonate legitimate websites.
- There is no evidence of attacks on major browsers like Firefox, Chrome, Edge, and Safari.
- The vulnerability could still affect systems that do not automatically receive the blocks.
Major technology companies have implemented emergency measures to block eight intermediate digital certificates issued by eMudhra Limited after a critical flaw was discovered in their private key generation process. Mozilla, a browser developer, confirmed the vulnerability on Saturday, October 19, 2024, finding that the private keys were so insecure they could be easily guessed. This flaw could allow attackers to forge HTTPS certificates for any website, enabling them to impersonate legitimate sites and potentially intercept or alter user information. Mozilla, along with other tech giants like Apple, Microsoft, and Cloudflare, have since deployed protections. While major browsers are now secured, the risk persists for systems that do not automatically receive these updates. There is no current evidence of exploitation against major browsers, but the possibility remains for other clients.