Attackers compromised third-party operators of the .GH (Ghana), .SL (Sierra Leone) and .AS (American Samoa) country-code domains, changed DNS records and obtained valid HTTPS certificates for domains they didn't own, including several Google domains, Google says. Google says its own systems were not compromised. It blocked the certificates in Chrome, worked to have them revoked, and found other organizations, including major brands, affected by the same attacks. Chrome users don't need to do anything; Google notes other browsers may not be protected.