The browser makers blocked eight certificate intermediates from eMudhra Limited after Mozilla said a flaw could let an attacker use a weak key to issue a website certificate for an unrelated domain.
Mozilla's public bug report lists six intermediates used for website certificates and two for code signing. Mozilla said exploiting a forged certificate would also require the attacker to get between the visitor and the website.
Google blocked the six website intermediates in Chrome on Oct. 17. Firefox's block reached users with standard settings that day, and Mozilla released updates Oct. 20 for people whose custom settings may have prevented the protection from arriving.
Google said a search of Certificate Transparency logs found no website certificates linked to the six intermediates before Chrome applied its block. That search does not show whether the certificates were used against software that does not require Certificate Transparency logging.
Applications beyond the two browsers may still trust affected certificates if their software or certificate stores have not been updated. Mozilla has urged operators to block the certificates in its guidance for trust-store operators.
Separately, Google plans to remove emSign ECC Root CA - G3 from Chrome's root store Tuesday, Oct. 27. Google warned that some legitimate certificates linked to the root may stop working in Chrome unless replaced; the company outlined the planned root-store change.
