Google said on 6 October 2026 that the previous week it became aware of hijacks of three country-code top-level domains: .gh (Ghana), .sl (Sierra Leone) and .as (American Samoa). The attackers compromised the third-party registries rather than Google or the domain owners, changed the authoritative DNS records for selected domains under those suffixes, and used that control to pass certificate authority domain validation and obtain HTTPS certificates covering several Google domains and domains of other organisations.

Google says it has no reason to believe the issuing certificate authorities did anything wrong. Chrome blocked the certificates through CRLSets and Google worked with the issuing CAs to revoke them; Certificate Transparency data pointed to more affected organisations, including leading global brands and widely used services, which Google also blocked and contacted where it could.

Update 8 Oct: The Hacker News reviewed Certificate Transparency logs and found at least 12 unauthorised certificates for seven Google and YouTube names, including google.com.gh, google.sl and google.as, logged one ccTLD at a time: .gh on 22 September, .sl on 25 September and .as on 27 September.

Let's Encrypt issued 11 and ZeroSSL one, and a Let's Encrypt staff member confirmed on its community forum on 7 October that Google and YouTube certificates were issued and revoked. All 12 showed as revoked by 1 October, between about a day and a half and nearly a week after first being logged. Only a small set of names was searched, so the total is likely higher.

Google has not named the attackers, said how the registries were breached, whether any certificate was used to impersonate a site, or whether the registries are now secure, and warns its analysis may have missed affected domains and that Chrome's blocking does not protect other browsers.

Primary: Google (Chrome Security blog); wires: The Hacker News, Ars Technica.