Incident brief

eMudhra: check certificate chains before October 27

Chrome plans to remove trust in emSign ECC Root CA - G3. Services using that root need a replacement certificate chain.

Trust change announcedFurther action neededCVE-2026-91403

Disclosed Oct 21, 2026Updated Oct 23, 2026Sources checked Oct 23, 2026 UTC

Change: Certificate trust
Deadline: Oct 27, 2026
Clients: Chrome, TLS certificate chains, Java SE, GraalVM

What happened

Google announced the Chrome root removal for the morning of October 27, Pacific time. Check the complete chain served by each endpoint, including customer portals and API gateways.

A browser trust change does not automatically update every application trust store. Oktsec recommends validating representative clients and agent tools after certificate replacement. Keep Chrome, Android and other runtime guidance separate.

Oracle’s October 21 alert addresses the compromised intermediates through Java and GraalVM updates. Its affected version matrix is separate from Chrome’s deadline. Consult Oracle’s patch availability guidance for each deployed runtime.

Affected systems and fixes

Product	Affected	Fixed release / action
TLS certificate chain	Chains terminating at emSign ECC Root CA - G3	Deploy an alternative trusted chain

Confirm the running version against the vendor advisory, including any distribution backports.

CISA exploitation evidence

Catalog 2026.10.23 · Checked Oct 24, 2026 UTC

No matching CVE appears in the reviewed catalog snapshot. This does not establish that exploitation has not occurred. Check the incident sources and vendor guidance.

eMudhra / Google

Response checklist

0 of 3 complete

Inspect certificate chainsIdentify public endpoints that chain to emSign ECC Root CA – G3. Include certificates supplied by hosting and infrastructure providers.Replace affected chainsArrange replacement before Chrome’s October 27 deadline, in the morning Pacific time. Confirm which chain each endpoint actually serves.Test the clients that use themCheck Oracle’s CVE-2026-91403 alert for Java and GraalVM, plus the trust stores bundled with containers and AI agent tools. Test real client connections after replacement.

Sources

Technical facts come from these sources. Priorities and suggested reviews are Oktsec’s analysis.

Chrome and Android response to compromised eMudhra intermediatesGoogle · vendor · Checked Oct 23, 2026 UTC
Java security alert CVE-2026-91403Oracle · vendor · Checked Oct 23, 2026 UTC

Editorial record2 entries

Oct 23, 2026 UTCPriority override: Act now because a dated trust removal can interrupt customer access. No successful attack is inferred from the trust decision.

Oct 23, 2026 UTCAdded the response priority rationale and original disclosure date.

Oktsec Assessment

Choose what to review

Exposure check Patch verification

Radar email

Get incident alerts and briefings

Act now incidents and team briefings, with sources and recommended actions.

Checking availability…