Security Advisory: eMudhra Intermediate Certificate Authority Compromise

Executive Summary

Elo Touch Solutions is actively monitoring and addressing an industry-wide cryptographic vulnerability involving eMudhra Technologies Limited, a commercial Certificate Authority (CA). On October 17, 2026, security researchers disclosed that private keys associated with eight intermediate CA certificates operated by eMudhra were generated with critical cryptographic defects (extremely weak entropy of only 3 to 8 bits), allowing third parties to immediately deduce the private signing keys.

The potential impact to Elo customers is isolated to Elo enterprise Android and Windows product lines. The scope of automatic protection is important to understand:

• Android 14 GMS Devices: Protected via an emergency Google Play Services update pushed on October 19, 2026.
• Windows Devices: Protected via the Microsoft Windows Disallowed Certificate Trust List update on October 20, 2026, and an automatic CRLSet update for Microsoft Edge and WebView2.
• Android 13 and below, AOSP-only builds, and non-GMS devices: Not automatically protected. Administrators must apply the manual mitigation plan described in this advisory until an official Elo OS firmware update incorporating Google's upcoming patch is released and installed.

No other Elo products are affected. Elo’s corporate infrastructure, cloud services (EloView, Elo Radar, and Elo Remote), and internal systems are not compromised. At the time of this advisory, there have been no reports of active exploitation against Elo customers.

Summary at a Glance

• Issue: A critical cryptographic flaw was disclosed involving eight eMudhra intermediate Certificate Authorities, potentially allowing attackers to spoof secure websites or forge trusted signatures.
• Impact: Impact is limited to Elo enterprise Android and Windows devices; all other Elo products and solutions are unaffected. This vulnerability originated strictly within eMudhra’s external key generation process. Elo infrastructure, cloud platforms, and internal systems are completely secure and uncompromised.
• Resolution for Android (Android 14 GMS): Protection has been delivered silently and automatically via background Play Services and browser updates. No firmware flashing or manual action is required.
• Resolution for Android (Other Versions): For Android 13 and below, AOSP, and non-GMS, Google will provide a patch update that Elo will subsequently integrate into an OS firmware update. Until then, use the manual mitigation plan below.
• Resolution for Windows: Fully automated updates to the Windows Disallowed Certificate Trust List and CRLSet block the compromised keys automatically.

Detailed Impact Analysis by Architecture on Android

1. Android Web Browsers (Google Chrome)

Chrome manages its own independent root store and does not rely on the underlying Android OS trust store. Chrome has pushed silent internal updates to block the compromised certificates via its internal revocation list (CRLSet). Additionally, Chrome's native Certificate Transparency (CT) enforcement will instantly reject any attempt to present a forged certificate because no legitimate certificates were logged prior to revocation.

2. Android Native Applications using WebView

Applications utilizing the WebView control API (such as the Elo WebView Controller) require system-level updates:

• On Android 14 GMS devices: Google Play Services automatically appended the eight compromised public key hashes to Android's secure system blocklist. Technical validation showed this blocklist arrived within one second of internet connection on factory-reset devices.
• On other Android versions/AOSP: System-level updates are not available via Play Services. These devices remain vulnerable until the upcoming Elo OS firmware update is applied.

Manual Mitigation Plan

Required for Android 13 and below, AOSP-only, and non-GMS devices operating in restricted networks.

Network-Level Compensating Control

For large enterprise fleets, it is highly recommended to block inbound/outbound connections presenting certificates signed by the compromised eMudhra intermediate keys at your secure web gateway or corporate firewall (e.g., Zscaler, Palo Alto Networks, Fortinet).

Manual Certificate Disabling Procedure

1. Navigate to Settings > Security (or Security & Privacy > More Security Settings).
2. Select Encryption & credentials > Trusted credentials.
3. Under the System tab, locate and toggle Disable on the following two root certificates (covers both direct and cross-signed variants):
   • emSign ECC Root CA - G3 (Listed under eMudhra Technologies Limited)
   • AAA Certificate Services (Listed under Comodo CA Limited)

Note: Disabling these roots secures Android system TLS and WebView applications. Standalone browsers like Chrome will continue to rely on their own automatic internal updates.

Verification and Testing Endpoints

Security administrators can validate local device and network security configurations using the following independent test endpoints:

• Primary Compromised Intermediate Test: https://dv-g3b-emudhra.we-have-a-problem.com/
• General Incident Reference and Test Suite: https://emudhra.we-have-a-problem.com/

Other Elo Products and Services

Elo interactive touchscreen displays, signage, point-of-sale systems, peripherals, and backend management tooling do not utilize or trust the affected eMudhra certificate chains and are completely unaffected. Elo cloud services (including EloView, Elo Radar, and Elo Remote) do not use eMudhra-issued certificates.

References & Resources

• Microsoft Response to Compromised eMudhra Certificate Authority Keys
• Google Security Blog: Protecting Chrome & Android Users from Compromised eMudhra Intermediate CA Certificates

Disclaimer: Update delivery times vary by region, device model, and third-party supplier. Some updates may require the operating system to be running the latest maintenance release before the fix is applied. This advisory is provided on an "as-is" basis for informational purposes only; Elo Touch Solutions disclaims all warranties, either express or implied, including implied warranties of merchantability and fitness for a particular purpose. Elo reserves the right to update this advisory as additional information becomes available.