Google reports .gh, .sl and .as registry hijacks and certificate protections
Google says third-party registry hijacks enabled unauthorized certificates; Chrome blocked identified certificates, while domain owners should review their own monitoring.
What the record says
Google’s October 6 security report describes hijacks affecting the .gh, .sl and .as country-code namespaces. Attackers changed authoritative DNS and obtained unauthorized HTTPS certificates for some Google and other organizations’ domains. Google says its own systems were not compromised. It blocked identified unauthorized certificates in Chrome and worked with issuers on revocation. It says Chrome users need no action for those protections.
Source details and supporting locations.
Practical next step
Organizations operating domains in the affected namespaces should review recent Certificate Transparency entries for unexpected certificates. Google recommends monitoring the full domain portfolio and restoring restrictive certificate-authorization policies after DNS control is recovered; technical administrators should follow the full guidance.
Limits and what is not established
Google does not guarantee every affected domain was identified, and Chrome interventions do not reliably protect other clients. Restrictive CAA records do not prevent certificate issuance during an active DNS hijack. This incident is distinct from Chrome’s separately announced desktop software update.
Sources checked October 9, 2026. Later notices may change instructions or arrangements.
Original sources
Google Chrome Secure Web and Networking Team: original information