Attackers hijacked parts of the .gh, .sl and .as country-code domain infrastructure, changed authoritative DNS records and used that control to obtain unauthorized HTTPS certificates for several Google domains and domains belonging to other organizations. Google says its systems were not compromised and that it has no reason to believe the issuing certificate authorities acted improperly.
What happened?
In a post dated October 6, 2026, Google’s Chrome Secure Web and Networking Team said it had learned of a series of hijacks in the .gh (Ghana), .sl (Sierra Leone) and .as (American Samoa) namespaces the previous week. Attackers changed authoritative DNS records and obtained unauthorized TLS certificates covering several Google domains and domains operated by other organizations. Google’s incident report says the activity did not involve a compromise of Google’s systems.
As an Amazon Associate I earn from qualifying purchases.
The reported path was through country-code top-level domain infrastructure and DNS control—not an intrusion into Google. Google also said it had no reason to believe the certificate authorities that issued the certificates did anything wrong.
Recommended Free Tools
Which Google domains and organizations were affected?
Google did not identify the specific Google domains, name the other organizations, provide a certificate count or publish a complete list of affected domains in its incident post. It said Certificate Transparency logs revealed additional organizations, including leading global brands and widely used online services, believed to have been affected. Without an official list, it is not possible to say which services those were.
#1 Best Overall
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
What did Chrome do, and who is protected?
Chrome immediately blocked unauthorized certificates for Google properties using CRLSets and worked with the issuing CAs to revoke them. That revocation can protect users of clients beyond Chrome. After CT logs exposed additional potentially affected organizations, Chrome proactively blocked certificates where it identified them and notified organizations where possible.
Google said, “Chrome users do not need to take any action to be protected.” That statement concerns Chrome’s browser-side protection; it is not a guarantee that every affected certificate or domain was found. Google cautioned that its analysis might not identify every affected domain and that Chrome interventions do not reliably protect users of non-Chrome browsers.
How can domain owners check for unauthorized certificates?
Monitor Certificate Transparency logs across the whole portfolio
Google recommends continuous CT monitoring for all domains, including parked domains and regional country-code properties. Chrome’s Certificate Transparency overview describes CT as a public, append-only record of certificates issued by CAs. Publicly trusted TLS certificates issued after April 30, 2018 must support CT to be recognized as valid by Chrome.
Do these 3 things before closing this tab:
1Scan for outdated or missing drivers - takes under a minute2Clear out junk files and repair common Windows errors3Fix the driver behind crashes, sound loss and screen glitchesWhen an unexpected certificate appears, compare its domain names, issuing CA and timing with your organization’s authorized issuance and incident records. A CT entry is a useful signal to investigate, but it does not by itself prove the certificate was malicious or used in an attack. Google’s site-operator guidance notes that CT-disclosed certificates expose their contents, including domain names.
Rank #3
Review recent entries for .gh, .sl and .as domains
If your organization operates domains in any of the three namespaces named by Google, review recent CT entries for unexpected issuance. Include properties that are parked, regional or managed outside your main web portfolio; overlooked domains can still matter if they are within your organization’s namespace.
Use CAA carefully, especially after DNS control is restored
Certification Authority Authorization (CAA) records let domain owners specify which CAs may issue certificates for a domain. Google recommends restrictive CAA policies, including controls tied to authorized ACME accounts and validation methods. But CAA cannot stop issuance during an active DNS hijack. Once DNS control has been restored, restrictive policies can help prevent an attacker from using cached domain-control validation to obtain additional certificates.
Rank #4
- Tamper Resistant Star Key Set Crafted with premium chrome vanadium steel, and each star tool folds neatly into the handle for quick, easy access.
- Details - The handle is engraved with size for quick identification with drilled tips to allow use.
- Portable - Keys fold compact for easy storage, Drilled tips allow use on tamper resistant security screws.
- Size:Full Size T-6, T-7, T-8, T-9, T-10, T-15 T-20, T-25, T-27 and T-30.
- And with 10 total star sizes able to match nearly all standard tamper resistant security screws on the market.
Treat browser blocking as one layer, not the whole response
Chrome’s intervention does not establish that every affected certificate was identified, and it cannot be relied on to protect non-Chrome clients. Domain owners are best placed to know which certificates and CAs are authorized for their own domains, so they should use CT alerts as an input to their own investigation and response.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
What Certificate Transparency can—and cannot—tell you
CT makes publicly trusted certificate issuance visible to domain operators, browsers, root stores and the wider security community. In this incident, Google said CT logs helped surface potentially affected organizations beyond those initially identified. Because the logs are public, they can support timely detection of unexpected issuance, but visibility is not the same as proof of abuse: an unfamiliar certificate needs to be checked against the organization’s approved certificate activity.
Best Value
Google says nearly all CAs support CT by default, often through Signed Certificate Timestamps (SCTs) embedded in certificates, and most site operators do not need to take special action to support CT. Its guidance generally discourages ordinary site operators from supporting CT through a TLS extension, because doing so requires ongoing monitoring of the CT ecosystem.
What remains undisclosed
Google’s October 6, 2026 account does not give a certificate total, a complete victim list or the specific Google domains involved. It also does not establish that every potentially affected domain was found. Those details should not be inferred from the mention of major brands or online services.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →
