Microsoft removes seven eMudhra certificates on October 26, Google schedules Chrome/Android removal for October 27, eMudhra posts Oct 28 update
Event summary
Microsoft released an out-of-band Windows update on October 26 that removes seven certificates associated with the affected eMudhra hierarchies. Google expects to release a Chrome Root Store removal for all affected devices Tuesday morning, October 27, 2026 PDT. eMudhra posted an update on October 28 saying customers are being moved to an alternate issuance pathway using its G1 RSA root. Operators should inventory certificate chains, apply vendor updates, and reissue affected certificates.
CHRONOS Wire · October 29 · Alert 5
Publication details
- Published
- Updated
- Revision
- r1
- Source
- eMudhra
Cliff Notes
- Microsoft removed seven certificates on Oct 26, Google scheduled Chrome/Android removal for Oct 27, eMudhra updated customers on Oct 28; apply updates and reissue certs now.
U.S. Impact
U.S. Impact assessment pending.
ELI5: Plain-English Explanation
Several major vendors have taken eMudhra certificates out of trust stores after a security incident. Microsoft removed seven related certificates on October 26, Google scheduled Chrome/Android removals for the morning of October 27, and eMudhra posted an update on October 28 saying customers are being moved to an alternate issuance pathway. If your systems rely on eMudhra-issued certificate chains, check trust stores and reissue certificates now.
Why Urgent Level 4
Vendor trust-store removals are being deployed with concrete dates between October 26 and October 28; once removals propagate, affected certificate chains will fail validation and can cause service outages.
What Changed
Microsoft published an out-of-band Windows update on October 26 removing seven certificates associated with the affected hierarchies. Google announced a Chrome Root Store removal expected Tuesday morning, October 27, 2026 PDT. eMudhra published an update on October 28 saying customers are being moved to an alternate issuance pathway using its G1 RSA root. No retrieved vendor bulletin in the provided evidence assigns a CVE or states an AWS removal date, so any prior claims about AWS CVE assignment or an AWS 2026-10-28 removal date have been removed.
What Is Genuinely New
Confirmed vendor actions and timelines: Microsoft removed seven certificates from Windows trust on October 26; Google scheduled Chrome/Android root removal for the morning of October 27; eMudhra posted an Oct 28 update describing alternate issuance via its G1 RSA root.
CHRONOS Bottom Line
Microsoft, Google, and eMudhra have published actions and timelines between October 26 and October 28; operators should inventory chains that rely on eMudhra intermediates, apply vendor trust-store updates or OS patches, and reissue affected certificates immediately.
Uncertainties / Known Unknowns
Timing and completeness of trust-store updates across all device types, appliance vendors, language runtimes, and cloud-managed images may vary; some environments may require manual intervention.
Detailed Analysis
Evidence shows coordinated vendor distrust actions: Microsoft pushed an out-of-band Windows update on October 26 removing seven certificates tied to the affected hierarchies; Google scheduled removal from the Chrome Root Store for the morning of October 27, 2026 PDT; eMudhra posted an October 28 update stating customers are being issued certificates via an alternate G1 RSA root. These actions will cause certificate chains that transit the distrusted intermediates to fail validation when the removals reach clients and platforms that rely on those trust stores. Operators should inventory, patch, and reissue as needed.
Sources / Evidence
- 01eMudhra Statement on Recent Certificate Security IncidenteMudhra2026-10-28
- 02Microsoft’s response to compromised eMudhra certificate authority keysMicrosoft MSRC2026-10-26
- 03Protecting Chrome and Android Users from Compromised eMudhra Intermediate CA CertificatesGoogle Security Blog2026-10-20
Follow CHRONOS ALERTS
Published alerts also appear on Instagram and Threads as @chronosalerts.