Security1 hOctober 29, 2026, 01:59

Mars browser developer finds stale eMudhra roots in pinned webpki-roots

The team behind Mars, a from-scratch Rust browser, discovered its pinned webpki-roots 1.0.9 still trusted eMudhra roots that Mozilla, Google and Microsoft removed after the CA compromise. The fix took four minutes: both TLS crates were bumped to 1.0.11, which drops the emSign roots.

DEV Community

Open source

Mars browser developer finds stale eMudhra roots in pinned webpki-roots

webpki-roots 1.0.9 from July 18 shipped four emSign root certificates
Versions 1.0.10 and 1.0.11 removed the eMudhra roots following CCADB
rustls does no revocation checking without CRLs, so trust changes only on rebuild
Apple blocked the certs in Safari and Mail but not in macOS command-line tools

#Rustls#Webpki-roots#Apple#EMudhra

eMudhra's eight compromised intermediates expose non-browser TLS clients

Science

Chinese scientists develop catalyst to turn Martian air into liquid methanol fuel

Gaming

Developer ports a 3DS emulator to the browser in two days with AI help

Security

Mars browser developer finds stale eMudhra roots in pinned webpki-roots

eMudhra's eight compromised intermediates expose non-browser TLS clients

Chinese scientists develop catalyst to turn Martian air into liquid methanol fuel

Developer ports a 3DS emulator to the browser in two days with AI help

Stale approvals drained Avalanche Safe of $7.45M