# Blocked in Hours — Everywhere Except the Long Tail

The browser response was a model of speed: Chrome blocked the six TLS intermediates about 100 minutes after the report, Mozilla's OneCRL block landed the same evening, Apple followed within two days, Microsoft within three. The incident's real lesson is the gap that speed exposed: everything that is not a browser — Go programs, Python apps, Node services, container images, appliances — kept trusting the compromised chains until its own update arrived.

## Key facts

- October 17, 19:45 UTC (~1h40 after the report): Chrome ships a CRLSet update blocking the six TLS intermediates.
- October 17, 22:59 UTC: Mozilla's OneCRL block reaches Firefox installations with standard settings; Firefox 158.0.1, ESR releases, and NSS 3.131.1 ship October 20, and Mozilla removes the emSign ECC Root CA – G3 from NSS.
- Apple blocks the certificates October 19; Microsoft blocks them October 20; Go ships fixes and Cloudflare completes mitigations October 20.
- Chrome's check: no TLS certificate chaining to the six affected intermediates appeared in Certificate Transparency logs before the block, so no fraudulent certificate from these CAs could have been trusted by default in CT-enforcing browsers.
- The residual risk sits outside browsers: clients that do not consume revocation data or enforce CT — bundled trust stores, language runtimes, appliances — keep trusting the intermediates until their software or bundle is updated.
- CERT-In advisory CIAD-2026-0050 (October 21) urges users to update browsers and operating systems and replace affected certificates, and warns legitimate sites could face disruption from the root removal.

Part of the eMudhra collection at https://aiservicesmarket.lol/emudhra/