Google and Mozilla have issued emergency blocks against eight intermediate CA certificates belonging to Indian certificate authority eMudhra after discovering that their private keys were compromised due to flawed key generation processes. The vulnerability, which lacked sufficient randomness, theoretically allows attackers to forge HTTPS certificates for any website and execute man-in-the-middle attacks. The tech giants acted within hours of receiving the report on October 17, blocking the certificates via CRLSet for Chrome and OneCRL for Firefox without requiring browser updates or restarts. Android devices received equivalent protections through Google Play services. Google confirmed no TLS certificates linked to these compromised CAs were present in Certificate Transparency logs prior to the block. Chrome will remove the emSign ECC Root CA - G3 from its root store starting October 27 Pacific Time, while Mozilla has already revoked the issuing root certificate. Websites relying on this certificate chain are urged to replace their certificates immediately.