At least google chrome (and im sure plenty of other browsers) embed some certs (or at least their hashes) in the browser to protect against this sort of attack for some services. See https://news.ycombinator.com/item?id=9078506 for some discussion on this -- its a slightly different response to a slightly different threat model.