Browsers stopped trusting eMudhra’s cracked certificates within hours in October. Many desktop apps still haven’t.
Security researcher Pascal Schärli published a scan of 36 apps built on Electron on 10 November. Among those that still accept certificates signed with the compromised keys are the Session messenger, the encrypted cloud drives Filen and Internxt, and the note apps Notesnook and Standard Notes. Several of them also install updates without checking who signed them.
Each gap is bad on its own. Together, they mean someone on the same network as you, a café’s Wi-Fi for example, could hand one of these apps a fake update and run their own code on your computer. No such attack has been reported so far.
Source: Privacy Affairs · 2026-11-10