eMudhra certificate incident: How AdGuard responded
A security incident involving the certificate authority eMudhra prompted browser and operating system vendors to block several of its certificates. Because AdGuard also checks server certificates to filter HTTPS traffic, we needed to address the issue in our apps, too.
We acted quickly and released emergency updates. Here’s what happened, what we changed, and what you need to do to stay protected.
What happened with eMudhra certificates?
eMudhra is a certificate authority whose certificates were trusted by major browsers and operating systems. Certificate authorities play an important role in HTTPS: they help browsers verify that a website is really the site it claims to be.
On October 17, 2026, a security researcher reported that the private keys of eight eMudhra intermediate certificates were compromised. The keys had been generated with extremely weak randomness, so they could be recovered from the public certificates in under a second. Someone who obtained these keys could use them to issue fraudulent certificates and impersonate websites that browsers would otherwise trust. As of publication, there have been no public reports of these keys being exploited in attacks.
Browser vendors acted quickly. Google and Mozilla revoked trust in the affected certificates within hours of the report, followed by Apple and Microsoft. The root cause was a flaw in eMudhra’s key generation process. AdGuard was not involved, but the incident required us to adjust how AdGuard handles HTTPS traffic.
When HTTPS filtering is enabled, AdGuard checks server certificates itself so it can inspect encrypted traffic and block ads and trackers. We need to make these checks at least as strict as those performed by browsers, and, when necessary, take a more conservative approach.
How AdGuard responded
We added the compromised eMudhra certificates to our blocklist and rolled out emergency updates for all AdGuard apps that support HTTPS filtering.
The fixes are available in these versions:
- AdGuard for Windows: 8.0.3
- AdGuard for Android: 4.15.1
- AdGuard for Mac: 2.20.2
- AdGuard for Linux: 1.5
Our team worked hard to deliver these fixes as quickly as possible, with several team members working late into the night to get the updates ready. We want to thank everyone who contributed to the response. Protecting our users’ security and privacy is a responsibility we take seriously, especially when it comes to certificate validation.
What does this mean for you?
On websites that use the affected certificates, AdGuard’s HTTPS filtering will be disabled. Instead, your browser will validate the connection and handle certificate security warnings itself.
This is intentional: AdGuard must not interfere with the browser’s ability to warn you about a potentially unsafe connection. The trade-off is that ads may appear on these websites, since AdGuard cannot filter their HTTPS traffic.
For the best protection, update AdGuard to the latest version available for your platform. We also recommend using an up-to-date browser that no longer trusts the affected certificates, such as Chrome, Edge, Opera, Brave, Vivaldi, or Firefox.
Still using AdGuard for Windows v7.x? We have you covered
AdGuard for Windows v8.x is now our main development branch, and version 7.x is no longer actively maintained as a primary update branch. However, we know that some users may still be using version 7 for various reasons. We don’t want them to be left without this important security fix.
That’s why we’ve released AdGuard for Windows v7.22.10, which includes the same fix for the compromised eMudhra certificates. This is a one-off security update rather than a return to active maintenance of version 7.
Important: Version 7.22.10 will not be delivered through the app’s built-in updater. You must download and install it manually from GitHub.
To update:
- Open the AdGuard for Windows releases page on GitHub.
- Find version 7.22.10 and download its installer.
- Run the installer and follow the on-screen instructions.
If you’re still using version 7.x, please make sure to install this update. If you’re already on version 8.x, update to version 8.0.3 or a newer release containing the fix.
An additional step for some Windows 7 users
Some Windows 7 users may also need to install a root certificate manually to get AdGuard running again after the update.
Here’s why: AdGuard for Windows v7.x uses a Sectigo certificate to digitally sign its files. Windows checks this digital signature when the AdGuard service starts. However, some Windows 7 systems are missing the root certificate Sectigo Public Code Signing Root R46, which is required to verify the signature. This certificate was issued in 2021, after Windows 7 support ended, so it may not be available through Windows Update.
If the certificate is missing, Windows cannot verify AdGuard’
s digital signature and the service may fail to start, displaying a Something went wrong message.
To fix this:
Download the Sectigo Public Code Signing Root R46 certificate from Sectigo’s official website.
Verify the certificate before installing it. In the folder where you saved the file, open Command Prompt and run:
certutil -hashfile SectigoPublicCodeSigningRootR46.crt SHA256The result must be:
7e76260ae69a55d3f060b0fd18b2a8c01443c87b60791030c9fa0b0585101a38
Ignore spaces and letter case. If the hash doesn't match, do not install the certificate and contact the AdGuard Support team.
Run the downloaded file as administrator and select Install Certificate.
Choose Local Machine.
Select Place all certificates in the following store, then choose Trusted Root Certification Authorities.
Click Finish and restart your computer.
Windows may display a warning that it cannot verify the publisher of the certificate. This is expected when installing a root certificate.
This is a local fix: it restores digital signature verification on the affected computer so that the AdGuard service can start.
Your security matters to us
Security incidents like this one remind us why certificate validation matters and why we need to respond quickly when something goes wrong — even when the issue originates outside AdGuard. We acted as soon as the issue was identified and released fixes across our supported platforms, including a dedicated update for users who are still using AdGuard for Windows v7.x.
If you have questions, run into problems updating, or have feedback about these changes, please let us know on GitHub. Your reports and feedback help us improve AdGuard and keep your browsing safer.
