Updates required to remediate eMudhra certificate compromise

On October 19, 2026, Google became aware of a compromised certificate authority (eMudhra). To address this security issue, we immediately issued security patches to several areas of our ecosystem.

This page helps you understand the affected app types and any required actions to remediate this eMudhra certificate compromise. We also provide detailed information about the security issue.

Affected app types and required actions

Due to the nature of this security issue, it affected many different types of apps. If your app type is listed here, then it was likely affected. Review the applicable section to learn what actions you need to take.

Flutter apps (regardless of target platform or product)
Apple platform apps (native) that use Cloud Firestore
Unity apps that target Apple or desktop platforms and use Cloud Firestore
C++ apps that target Apple or desktop platforms and use Cloud Firestore
Android apps (native) that use the Firebase App Distribution Gradle plugin

Other community-supported platforms are affected, as well (for example, React Native apps that target Apple platforms and use Firestore).

Flutter apps

Flutter apps were affected in various ways. Review the applicable section to understand which actions you need to take.

Flutter apps that target Android, Windows, or Linux

While browsers and operating systems pushed emergency intermediate certificate blocklists, dart:io on Android, Windows, and Linux validates TLS certificate chains using its own compiled-in BoringSSL engine and does not read OS intermediate certificate blocklists. Learn more about this security advisory.

Take the following actions if you have Flutter or Dart apps that target Android, Windows, or Linux:

Upgrade to the following Dart and Flutter versions:
- Dart 3.13.7 or later
- Flutter 3.47.8 or later (with Dart 3.13.7 or later)
Rebuild your app.
Redeploy your app or binary. Redeploy your Android, Window, and Linux apps or binaries so they include the updates with the security fix.

Flutter apps that target Apple or Windows platforms and use Cloud Firestore

Take the following actions if you have a Flutter app that targets Apple platforms (for example, iOS) and your app uses Cloud Firestore:

Determine the plugin version appropriate for your app. Depending on your current plugin version, choose a plugin version that's appropriate for your app.

FlutterFire plugin (flutterfire) — iOS, macOS, or Windows

Affected plugin versions Plugin versions with the security fix

Affected plugin versions	Plugin versions with the security fix
`cloud_firestore` `7.0.0` and earlier (excluding `6.10.1` and `6.10.2`)	Option 1: `cloud_firestore` `7.1.0` (FlutterFire BoM `5.1.0` or later) Option 2: iOS and macOS: `cloud_firestore` `6.10.1` (FlutterFire BoM `4.20.1`) Windows: `cloud_firestore` `6.10.2` (FlutterFire BoM `4.20.2`) Note: Firebase recently released a breaking change plugin version. To accommodate apps that haven't yet upgraded to this latest major version, we've backported the security fix into a new patch version of the last major plugin version.

cloud_firestore 7.0.0 and earlier
(excluding 6.10.1 and 6.10.2)

Option 1: cloud_firestore 7.1.0 (FlutterFire BoM 5.1.0 or later)
Option 2:
- iOS and macOS: cloud_firestore 6.10.1 (FlutterFire BoM 4.20.1)
- Windows: cloud_firestore 6.10.2 (FlutterFire BoM 4.20.2)

Update your app. Run flutter pub upgrade to update the cloud_firestore plugin to your desired version.
Rebuild your app.
Republish your app. Republish your app that has the updated SDK version (for example, to the Apple App Store or your desktop distribution channels).

After you republish your app, you need to encourage your end users to update to the latest version of your app. Because the TLS root certificate bundle is compiled into the application binary, operating system updates or server-side changes alone don't remediate previously installed application builds.

Apple platform apps (native) that use Cloud Firestore

Take the following actions if you have a native Apple platforms app (for example, iOS) and your app uses Cloud Firestore:

Determine the SDK version appropriate for your app. Depending on your current SDK version, choose an SDK version that's appropriate for your app.

Firebase SDK for Apple platforms (specifically, FirebaseFirestore)

Affected SDK versions	SDK versions with the security fix
`13.1.0` and earlier (excluding `12.19.3`)	Option 1: `13.1.1` or later Option 2: `12.19.3` Note: Firebase recently released a breaking change SDK version. To accommodate apps that haven't yet upgraded to this latest major version, we've backported the security fix into a new patch version of the last major SDK version.

Update your app. Follow the instructions for your distribution channel:
- SPM: Update your firebase-ios-sdk package dependency version in Xcode or Package.swift.
- Zip Distribution: From GitHub Releases, download Firebase.zip for the desired version and replace the existing .xcframework bundles in your project.
- Carthage: Update your Cartfile to target the desired version and update dependencies via Carthage.
Republish your app. Republish your app that has the updated SDK version (for example, to the Apple App Store or your desktop distribution channels).

After you republish your app, you need to encourage your end users to update to the latest version of your app. Because the TLS root certificate bundle is compiled into the application binary, operating system updates or server-side changes alone do not remediate previously installed application builds.

Unity apps that target Apple or desktop platforms and use Cloud Firestore

Take the following actions if you have a Unity app that targets Apple platforms (for example, iOS) and your app uses Cloud Firestore:

Determine the new SDK version appropriate for your app. Depending on your current SDK version, choose an SDK version that's appropriate for your app.

Firebase SDK for Unity (firebase-unity-sdk) — iOS or Desktop (Linux, macOS, Windows)

Affected SDK versions	SDK versions with the security fix
`14.0.0` and earlier (excluding `13.17.1`)	Option 1: `14.1.0` or later Option 2: `13.17.1` Note: Firebase recently released a breaking change SDK version. To accommodate apps that haven't yet upgraded to this latest major version, we've backported the security fix into a new patch version of the last major SDK version.

Update your app. Download the Firebase Unity SDK for the desired version from the GitHub release page.
Link and rebuild your app. Link and rebuild your iOS and desktop applications.
Republish your app. Republish your app that has the updated SDK version (for example, to the Apple App Store or your desktop distribution channels).

C++ apps that target Apple or desktop platforms and use Cloud Firestore

Take the following actions if you have a C++ app that targets Apple platforms (for example, iOS) and your app uses Cloud Firestore:

Determine the new SDK version appropriate for your app. Depending on your current SDK version, choose an SDK version that's appropriate for your app.

Firebase SDK for C++ (firebase_cpp_sdk) — iOS or Desktop (Linux, macOS, Windows)

Affected SDK versions	SDK versions with the security fix
`14.0.0` and earlier (excluding `13.13.1`)	Option 1: `14.1.0` or later Option 2: `13.13.1` Note: Firebase recently released a breaking change SDK version. To accommodate apps that haven't yet upgraded to this latest major version, we've backported the security fix into a new patch version of the last major SDK version.

Update your app. Download the Firebase C++ SDK for the desired version from the GitHub release page.
Link and rebuild your app. Link and rebuild your iOS and desktop applications.
Republish your app. Republish your app that has the updated SDK version (for example, to the Apple App Store or your desktop distribution channels).

Android apps (native) that use the Firebase App Distribution Gradle plugin

Take the following actions if you have a native Android app that uses the Firebase App Distribution Gradle plugin:

Determine the new plugin version appropriate for your app. You can use plugin version 5.3.1 or higher.

Update your Gradle file. In your root-level (project-level) Gradle file (<project>/build.gradle.kts or <project>/build.gradle), update the App Distribution Gradle plugin to version 5.3.1 or higher:

Kotlin

plugins {
    // ...
    // Update the version in the dependency for the App Distribution Gradle plugin.
    // Make sure the version is 5.3.1 or higher.
    id("com.google.firebase.appdistribution") version "5.3.1" apply false
}

Groovy

plugins {
    // ...
    // Update the version in the dependency for the App Distribution Gradle plugin.
    // Make sure the version is 5.3.1 or higher.
    id 'com.google.firebase.appdistribution' version '5.3.1' apply false
}

buildscript (legacy)

buildscript {
    dependencies {
        // ...
        // Update the version in the dependency for the App Distribution Gradle plugin.
        // Make sure the version is 5.3.1 or higher.
        classpath 'com.google.firebase:firebase-appdistribution-gradle:5.3.1'
    }
}

Clean and verify your CI/CD workflows. Ensure your automated build and deployment pipelines (such as GitHub Actions, GitLab CI, or Jenkins) pull the updated plugin version when executing tasks like ./gradlew appDistributionUpload<Variant>.

Detailed information about what happened

On October 19, 2026, Google became aware that the private keys for several intermediate Certificate Authority (CA) certificates issued by a third-party certificate authority (eMudhra) were compromised and subsequently revoked (for more details, see the Google Security Blog post).

While operating systems and web browsers have distributed updates to distrust these intermediate certificates in system trust stores, the impacted products validate Transport Layer Security (TLS) connections using an embedded root certificate bundle compiled into the binary.

Because attackers can use the compromised Certificate Authority keys to forge legitimate-looking HTTPS certificates, affected apps will fail to detect the revocation and continue trusting the fake credentials. As a result, attackers on the network can pull off man-in-the-middle attacks to impersonate the real impersonate backend servers, including Firestore and any HTTPS endpoints contacted by affected Flutter/Dart apps or the App Distribution Gradle plugin, secretly intercepting, stealing, or tampering with sensitive user data.

To protect client connections against this compromised certificate authority, we mitigated this issue by removing the root certificates that chain to the compromised eMudhra intermediates in the following:

Cloud Firestore SDKs for Apple, Flutter, Unity, and C++

The Cloud Firestore backend was not affected, and neither was any other part of the Cloud Firestore product.
The Flutter SDK and the FlutterFire plugin for Cloud Firestore
The Firebase App Distribution Gradle plugin

The App Distribution backend was not affected, and neither was any other part of the App Distribution product.