JetBrains IDE Embedded Browser Improperly Accepts Revoked Intermediate Certificates

In JetBrains IntelliJ IDEA, PyCharm, PhpStorm, RubyMine and WebStorm before 2026.3, 2026.2.4, 2026.1.5.1, and 2025.3.6.2; GoLand before 2026.3, 2026.2.4, 2026.1.5.1, and 2025.3.5.2; Rider before 2026.3, 2026.2.4, 2026.1.5.3, and 2025.3.5.3; CLion before 2026.3, 2026.2.4.1, 2026.1.5.2, and 2025.3.6.3; DataGrip before 2026.3, 2026.2.6.1, 2026.1.4.1, and 2025.3.6.1; RustRover before 2026.3, 2026.2.5, 2026.1.4.1, and 2025.3.7.1; DataSpell before 2026.1.3.1 and 2025.3.3.1, the embedded browser trusted revoked intermediate certificates

The confirmed affected ranges are:

• IntelliJ IDEA, PyCharm, PhpStorm, RubyMine, and WebStorm: before 2026.3; 2026.2 before 2026.2.4; 2026.1 before 2026.1.5.1; and versions before 2025.3.6.2.
• GoLand: before 2026.3; 2026.2 before 2026.2.4; 2026.1 before 2026.1.5.1; and versions before 2025.3.5.2.
• Rider: before 2026.3; 2026.2 before 2026.2.4; 2026.1 before 2026.1.5.3; and versions before 2025.3.5.3.
• CLion: before 2026.3; 2026.2 before 2026.2.4.1; 2026.1 before 2026.1.5.2; and versions before 2025.3.6.3.
• DataGrip: before 2026.3; 2026.2 before 2026.2.6.1; 2026.1 before 2026.1.4.1; and versions before 2025.3.6.1.
• RustRover: before 2026.3; 2026.2 before 2026.2.5; 2026.1 before 2026.1.4.1; and versions before 2025.3.7.1.
• DataSpell: 2026.1 before 2026.1.3.1 and versions before 2025.3.3.1.

JetBrains lists specific fixed builds for each branch, including RC or EAP builds in the 2026.3 line. Unlisted later or parallel branches should not be assumed unaffected solely because another branch has a fix.

This is CWE-299, an improper certificate-revocation check in the embedded browser shipped with affected JetBrains IDEs. The affected component is the JCEF embedded browser, which has a certificate list and update path separate from the JetBrains Runtime trust store. As a result, the browser could continue trusting revoked eMudhra intermediate certificates after the related private-key compromise and revocation event.

A network attacker able to intercept traffic could use a suitable certificate to impersonate a website or service reached by the browser. The supplied assessment describes no prior authentication requirement, high attack complexity, and required user interaction with the affected connection or content. The exact interception position and browser workflow required for exploitation are not documented in the available evidence.

JetBrains states that fixed releases in the 2025.3 branch and later provide Chrome certificate updates to the embedded browser through Google's update servers. If those servers are blocked by the network, the embedded browser may remain unprotected; in that situation, JCEF should remain disabled until the update path is available or the IDE is updated.

The vulnerability is reachable over the network. The supplied assessment describes no required prior privileges, high attack complexity, and required user interaction with the embedded browser or a connection it processes.

The central precondition is the attacker's ability to intercept or influence network traffic and present a certificate that the embedded browser accepts even though its intermediate certificate has been revoked. The available evidence does not identify a specific network position, website, or complete exploitation sequence.

The supplied record does not identify a public exploit and does not mark the vulnerability as known exploited. JetBrains stated at the time of its advisory that it was not aware of exploitation against JetBrains users. That statement is limited to the advisory's observation window and does not establish that every environment is safe.

The flaw weakens the embedded browser's TLS trust decision for revoked intermediate certificates. If an attacker can intercept traffic and the user interacts with the manipulated connection, an impersonated website or service may be treated as trusted by the browser.

Possible outcomes include disclosure of data entered or displayed in the browser, acceptance of modified content, or interference with authentication and service workflows accessed through the embedded browser. The level of exposure depends on the data and services used through the browser; the record does not establish that every connection or plugin is affected in the same way.

The supplied assessment describes required user interaction, no required prior privileges, and no direct availability impact. The record does not establish arbitrary code execution, a specific compromise, or a named attack campaign.

• Data exposure: An impersonated website or service could cause users to submit sensitive information through the embedded browser or accept untrusted content.
• Integrity risk: Responses or content from an impersonated service could be altered before the user views or processes them, depending on how the IDE or a plugin uses the browser.
• Access risk: Organizations using the embedded browser for internal services, administrative portals, or authentication flows could be affected if the connection crosses a network controlled by the attacker.
• Limit: The available evidence does not confirm a specific breach, victim, or business loss. It does not identify a direct service-availability effect.

1. Update to a JetBrains-listed fixed build. The vendor lists the following fixes:

• IntelliJ IDEA: 2026.3 RC, 2026.2.4, 2026.1.5.1, 2025.3.6.2, and 2025.2.6.4.
• PyCharm, PhpStorm, RubyMine, and WebStorm: 2026.3 RC, 2026.2.4, 2026.1.5.1, 2025.3.6.2, and 2025.2.6.3.
• GoLand: 2026.3 RC, 2026.2.4, 2026.1.5.1, 2025.3.5.2, and 2025.2.6.3.
• Rider: 2026.3 EAP 9, 2026.2.4, 2026.1.5.3, and 2025.3.5.3.
• CLion: 2026.3 RC, 2026.2.4.1, 2026.1.5.2, 2025.3.6.3, and 2025.2.6.3.
• DataGrip: 2026.3 RC, 2026.2.6.1, 2026.1.4.1, 2025.3.6.1, and 2025.2.6.1.
• RustRover: 2026.3 EAP 8, 2026.2.5, 2026.1.4.1, 2025.3.7.1, and 2025.2.6.1.
• DataSpell: 2026.1.3.1, 2025.3.3.1, and 2025.2.4.1.

1. Disable JCEF if immediate updating is not possible. JetBrains documents disabling the ide.browser.jcef.enabled key, especially for 2025.2.6.4 and earlier or for any version when the network blocks Google's update servers. Restart the IDE after changing the setting.
2. Preserve the certificate-update path. In fixed releases in the 2025.3 branch and later, JCEF receives Chrome certificate updates from Google's servers after the IDE starts. If network policy blocks that path, keep JCEF disabled until connectivity is restored or the IDE is updated according to JetBrains guidance.
3. Do not treat a JetBrains Runtime trust-store cleanup as sufficient for this vulnerability. JCEF has its own certificate list, so cleaning only the JBR trust store does not replace updating or disabling the embedded browser.
4. After updating and confirming that JCEF has the new protection, re-enable ide.browser.jcef.enabled if it was disabled. Recheck browser-dependent features because disabling JCEF can affect Markdown and HTML previews, Jupyter output, and some plugins.

1. Inventory all JetBrains IntelliJ IDEA, PyCharm, PhpStorm, RubyMine, WebStorm, GoLand, Rider, CLion, DataGrip, RustRover, and DataSpell installations, then compare their versions with the affected branches and fixed builds below.
2. Check whether the embedded browser is enabled and inspect the ide.browser.jcef.enabled setting. An affected version with JCEF enabled should be treated as exposed.
3. Verify that the IDE host can reach Google's certificate update servers. JetBrains states that blocking those servers can prevent the embedded browser from receiving the required certificate updates.
4. Review certificate warnings displayed by the IDE. If the IDE shows an untrusted-server-certificate warning involving an eMudhra certificate, reject the certificate and investigate the related connection.
5. Prioritize review of sessions in which the embedded browser accesses sensitive websites or services, handles credentials, displays source code, or processes other protected content. This is a risk-assessment step, not a confirmed indicator of exploitation.
6. Do not treat the absence of a warning or unusual TLS log as proof of safety. The reviewed sources do not provide a dedicated IOC for this vulnerability.