Firebase Apps Must Be Rebuilt After the eMudhra Certificate Breach

Firebase apps that bundle their own TLS certificate list can still trust forged certificates from a compromised authority, and the only fix is to update the SDK, rebuild and republish, according to Firebase’s remediation guide. Firebase said Google learned on Oct. 19, 2026 that the private keys for several intermediate certificates issued by the authority eMudhra were compromised and later revoked.

Key Takeaways

• Browsers and operating systems have already distrusted the certificates. Affected apps validate connections against a root bundle compiled into the binary, so they have not.
• An attacker on the network could impersonate Cloud Firestore and read or alter traffic, Firebase said.
• Updating a server or the phone’s OS does nothing for installed builds. Only a new app version fixes them.

Who Is Affected

Firebase listed Flutter apps on any platform, native Apple apps using Cloud Firestore, Unity and C++ apps on Apple or desktop platforms using Firestore, and native Android apps using the App Distribution Gradle plugin. It said community platforms such as React Native on Apple devices are also hit.

The patched versions, per the guide:

• Apple SDK: 13.1.1 or later, or 12.19.3 for apps still on version 12. CocoaPods users on 12.19.2 or earlier need 12.19.3.
• Flutter Firestore plugin: cloud_firestore 7.1.0 (FlutterFire BoM 5.1.0). Apps on version 6 can take 6.10.1 for iOS and macOS or 6.10.2 for Windows.
• Flutter and Dart on Android, Windows and Linux: Dart 3.13.7 or later and Flutter 3.47.8 or later. These platforms use dart:io, which Firebase said ignores operating-system blocklists.
• App Distribution Gradle plugin: 5.3.1, 4.2.1 or 3.2.1. This one needs no app redeploy, only a plugin bump and a check that CI pulls it.

Our Take

The version bump is quick. Each patched app then has to clear store review, and you have to get people to install it. Until they do, every old build is exposed on hostile networks. A Flutter team shipping to Android, iOS and desktop has several release trains to push. That is our read, not Firebase’s.

Teams that pin Firebase versions in a lockfile or a build image should check those first. A CI job that still resolves the old plugin will quietly ship the vulnerable build again.

What to Check

• Run flutter pub upgrade and confirm cloud_firestore and your Dart and Flutter versions.
• Search Apple projects for firebase-ios-sdk pins below 13.1.1 (or 12.19.3).
• Check the App Distribution plugin version in every Gradle build.
• Publish the new build, then prompt users to update.