WebPKI Observatory — Governance Risk
Chrome participated substantively in only 18.4% of 2025's 223 reported CA incidents, down from 67.8% coverage in 2019, while Mozilla dropped from 78.0% to 9.9% and Apple engaged in 5.4% despite growing to 16.4% browser share. Microsoft provided zero substantive oversight across all 1,812 bugs in the corpus despite maintaining 142 roots not trusted by other programs. This declining engagement leaves most incidents unreviewed by root programs even as their trust decisions affect billions of users, connecting to the operational risk finding that only 25% of incidents emerge through CA self-detection.