> Documentation index: https://firebase.google.com/support/guides/llms.txt
On October 19, 2026, Google became aware of a compromised certificate authority
(eMudhra). To address this security issue, we immediately issued security
patches to several areas of our ecosystem.
This page helps you understand
[the affected app types and any required actions](https://firebase.google.com/support/guides/compromised-emudhra-intermediate-ca.md.txt#action-needed) to
remediate this eMudhra certificate compromise. We also provide
[detailed information about the security issue](https://firebase.google.com/support/guides/compromised-emudhra-intermediate-ca.md.txt#detailed-what-happened).
## Affected app types and required actions
**Due to the nature of this security issue, it affected many different types of
apps. If your app type is listed here, then it was likely affected. Review the
applicable section to learn what actions you need to take.**
- [Flutter apps](https://firebase.google.com/support/guides/compromised-emudhra-intermediate-ca.md.txt#flutter-apps) (regardless of target platform or product)
- [Apple platform apps (native) that use Cloud Firestore](https://firebase.google.com/support/guides/compromised-emudhra-intermediate-ca.md.txt#apple-native-apps-firestore)
- [Unity apps that target Apple or desktop platforms *and* use Cloud Firestore](https://firebase.google.com/support/guides/compromised-emudhra-intermediate-ca.md.txt#unity-apps-firestore)
- [C++ apps that target Apple or desktop platforms *and* use Cloud Firestore](https://firebase.google.com/support/guides/compromised-emudhra-intermediate-ca.md.txt#cpp-apps-firestore)
- [Android apps (native) that use the Firebase App Distribution Gradle plugin](https://firebase.google.com/support/guides/compromised-emudhra-intermediate-ca.md.txt#android-apps-distro-gradle-plugin)
Other community-supported platforms are affected, as well (for example,
[React Native apps that target Apple platforms *and* use Cloud Firestore](https://github.com/invertase/react-native-firebase/blob/main/CHANGELOG.md)).
> [!IMPORTANT]
> **Important:** **At a high level, here are the required actions for all affected
> apps:**
> (1) **Update to the latest versions** of the SDKs or plugins, (2) **Republish** the new version of your app, and (3) **Encourage end users to update** to your new app version that has the fix.
> *(except the remediation for the App Distribution Gradle plugin, which
> only requires an update)*.
*** ** * ** ***
### Flutter apps
Flutter apps were affected in various ways. Review the applicable section to
understand which actions you need to take.
#### Flutter apps that target Android, Windows, or Linux
While browsers and operating systems pushed emergency intermediate certificate
blocklists, `dart:io` on Android, Windows, and Linux validates TLS certificate
chains using its own compiled-in BoringSSL engine and does not read OS
intermediate certificate blocklists. For details, see the
[Dart SDK security advisory](https://github.com/dart-lang/sdk/security/advisories/GHSA-frr6-h895-5pxp).
Take the following actions if you have Flutter or Dart apps that target Android,
Windows, or Linux:
1. **Upgrade to the following Dart and Flutter versions:**
- Dart 3.13.7 or later
- Flutter 3.47.8 or later (with Dart 3.13.7 or later)
2. **Rebuild your app.**
3. **Redeploy your app or binary.**
Redeploy your Android, Windows, and Linux apps or binaries so they include
the updates with the security fix.
After you redeploy your app, you need to **encourage your end users to update to
the latest version of your app**. Because the TLS certificate validation logic
is compiled into the application binary, operating system updates alone don't
remediate previously installed application builds.
#### Flutter apps that target Apple or Windows platforms *and* use Cloud Firestore
Take the following actions if you have a Flutter app that targets
Apple or Windows platforms ***and*** your app uses Cloud Firestore:
1. **Determine the plugin version appropriate for your app.**
Refer to the following table to determine which plugin version with the
security fix is appropriate for your app.
FlutterFire plugin for Cloud Firestore (`cloud_firestore`) ---
iOS, macOS, or Windows
| Affected plugin versions | Plugin versions with the security fix |
|---|---|
| `cloud_firestore` `7.0.0` and earlier (excluding `6.10.1` and `6.10.2`) | - Option 1: `cloud_firestore` `7.1.0` (FlutterFire BoM `5.1.0` or later) *(recommended)* - Option 2: - iOS and macOS: `cloud_firestore` `6.10.1` (FlutterFire BoM `4.20.1`) - Windows: `cloud_firestore` `6.10.2` (FlutterFire BoM `4.20.2`) > [!NOTE] > **Note:** Firebase recently released a major version with breaking changes. To accommodate apps that haven't yet upgraded to this latest major version, we've backported the security fix into a new patch version of the last major plugin version. |
2. **Update your app.**
Run `flutter pub upgrade` to update the
`cloud_firestore` plugin to the appropriate version.
3. **Rebuild your app.**
4. **Republish your app.** Republish your app that has the updated plugin
version (for example, to the Apple App Store or your desktop distribution
channels).
After you republish your app, you need to **encourage your end users to update
to the latest version of your app**. Because the TLS root certificate bundle is
compiled into the application binary, operating system updates or server-side
changes alone don't remediate previously installed application builds.
*** ** * ** ***
### Apple platform apps (native) that use Cloud Firestore
Take the following actions if you have a native Apple platform app (like iOS,
macOS, etc.) ***and*** your app uses Cloud Firestore:
1. **Determine the SDK version appropriate for your app.**
Refer to the following table to determine which SDK version with the
security fix is appropriate for your app.
Firebase SDK for Apple platforms (specifically, `FirebaseFirestore`)
| Affected SDK versions | SDK versions with the security fix |
|---|---|
| `13.1.0` and earlier (excluding `12.19.3`) | - Option 1: `13.1.1` or later *(recommended)* - Option 2: `12.19.3` > [!NOTE] > **Note:** Firebase recently released a major version with breaking changes. To accommodate apps that haven't yet upgraded to this latest major version, we've backported the security fix into a new patch version of the last major SDK version. |
2. **Update your app.**
Follow the instructions for your distribution channel:
- **SPM** : Update your `firebase-ios-sdk` package dependency version in
Xcode or `Package.swift`.
- **Zip Distribution** : From
[GitHub Releases](https://github.com/firebase/firebase-ios-sdk/releases),
download `Firebase.zip` for the appropriate version and replace the
existing `.xcframework` bundles in your project.
- **Carthage** : Update your `Cartfile` to target the appropriate version and
update dependencies via Carthage.
3. **Republish your app.**
Republish your app that has the updated SDK version
(for example, to the Apple App Store or your desktop distribution channels).
After you republish your app, you need to **encourage your end users to update
to the latest version of your app**. Because the TLS root certificate bundle is
compiled into the application binary, operating system updates or server-side
changes alone don't remediate previously installed application builds.
> [!NOTE]
> **Note:** **Do you still use CocoaPods?** If so, you also need to take action. The affected versions are `12.19.2` and earlier, and you'll need to update to `12.19.3` (when you update your `Podfile`, make sure it's not locked to a previous version). Be aware that Firebase 12 is the final major version published to CocoaPods. Learn more about the [CocoaPods deprecation](https://firebase.google.com/docs/ios/cocoapods-deprecation.md.txt).
*** ** * ** ***
### Unity apps that target Apple or desktop platforms *and* use Cloud Firestore
Take the following actions if you have a Unity app that targets
Apple or desktop platforms ***and*** your app uses Cloud Firestore:
1. **Determine the new SDK version appropriate for your app.**
Refer to the following table to determine which SDK version with the
security fix is appropriate for your app.
Firebase SDK for Unity (`firebase-unity-sdk`) --- iOS or Desktop
(macOS, Windows, Linux)
| Affected SDK versions | SDK versions with the security fix |
|---|---|
| `14.0.0` and earlier (excluding `13.17.1`) | - Option 1: `14.1.0` or later *(recommended)* - Option 2: `13.17.1` > [!NOTE] > **Note:** Firebase recently released a major version with breaking changes. To accommodate apps that haven't yet upgraded to this latest major version, we've backported the security fix into a new patch version of the last major SDK version. |
2. **Update your app.**
Download the Firebase Unity SDK for the appropriate version from the
[GitHub releases page](https://github.com/firebase/firebase-unity-sdk/releases),
and then import the updated packages into your Unity project.
3. **Rebuild your app.**
Rebuild your player binary.
4. **Republish your app.**
Republish your app that has the updated SDK version (for example, to the
Apple App Store or your desktop distribution channels).
After you republish your app, you need to **encourage your end users to update
to the latest version of your app**. Because the TLS root certificate bundle is
compiled into the application binary, operating system updates or server-side
changes alone don't remediate previously installed application builds.
*** ** * ** ***
### C++ apps that target Apple or desktop platforms *and* use Cloud Firestore
Take the following actions if you have a C++ app that targets
Apple or desktop platforms ***and*** your app uses Cloud Firestore:
1. **Determine the new SDK version appropriate for your app.**
Refer to the following table to determine which SDK version with the
security fix is appropriate for your app.
Firebase SDK for C++ (`firebase_cpp_sdk`) --- iOS or Desktop
(macOS, Windows, Linux)
| Affected SDK versions | SDK versions with the security fix |
|---|---|
| `14.0.0` and earlier (excluding `13.13.1`) | - Option 1: `14.1.0` or later *(recommended)* - Option 2: `13.13.1` > [!NOTE] > **Note:** Firebase recently released a major version with breaking changes. To accommodate apps that haven't yet upgraded to this latest major version, we've backported the security fix into a new patch version of the last major SDK version. |
2. **Update your app.**
Download the Firebase C++ SDK for the appropriate version from the
[GitHub releases page](https://github.com/firebase/firebase-cpp-sdk/releases),
and then update your project dependencies with the new SDK libraries.
3. **Link and rebuild your app.**
Recompile and relink your application binary.
4. **Republish your app.**
Republish your app that has the updated SDK version
(for example, to the Apple App Store or your desktop distribution channels).
After you republish your app, you need to **encourage your end users to update
to the latest version of your app**. Because the TLS root certificate bundle is
compiled into the application binary, operating system updates or server-side
changes alone don't remediate previously installed application builds.
*** ** * ** ***
### **Android** apps (native) that use the Firebase App Distribution Gradle plugin
Take the following actions if you have a native Android app that uses the
Firebase App Distribution Gradle plugin:
1. **Determine the new plugin version appropriate for your app.**
Depending on your current plugin version, choose a plugin version that's
appropriate for your app.
Firebase App Distribution Gradle plugin
(`com.google.firebase.appdistribution`)
| Affected plugin versions | Plugin versions with the security fix |
|---|---|
| `5.3.0` and earlier (excluding `4.2.1` and `3.2.1`) | - Option 1: `5.3.1` or higher *(recommended)* - Option 2: - Plugin 4.x: `4.2.1` - Plugin 3.x: `3.2.1` > [!NOTE] > **Note:** To accommodate apps that haven't yet upgraded to the latest major version, we've backported the security fix into new patch versions of earlier major plugin versions. |
2. **Update your Gradle file.**
In your root-level (project-level) Gradle file
(`/build.gradle.kts` or `/build.gradle`),
update the App Distribution Gradle plugin to your desired version with
the security fix:
### Kotlin
```kotlin
plugins {
// ...
// Update the version in the dependency for the App Distribution Gradle plugin.
// Make sure to use a version that has the security fix (5.3.1 or higher, 4.2.1, or 3.2.1).
id("com.google.firebase.appdistribution") version "5.3.1" apply false
}
```
### Groovy
```groovy
plugins {
// ...
// Update the version in the dependency for the App Distribution Gradle plugin.
// Make sure to use a version that has the security fix (5.3.1 or higher, 4.2.1, or 3.2.1).
id 'com.google.firebase.appdistribution' version '5.3.1' apply false
}
```
### buildscript (legacy)
```groovy
buildscript {
dependencies {
// ...
// Update the version in the dependency for the App Distribution Gradle plugin.
// Make sure to use a version that has the security fix (5.3.1 or higher, 4.2.1, or 3.2.1).
classpath 'com.google.firebase:firebase-appdistribution-gradle:5.3.1'
}
}
```
3. **Clean and verify your CI/CD workflows.**
Ensure your automated build and deployment pipelines (such as
GitHub Actions, GitLab CI, or Jenkins) pull the updated plugin version when
executing tasks like `./gradlew appDistributionUpload`.
> [!NOTE]
> **Note:** Redeploying your app is ***not*** required.
*** ** * ** ***
## Detailed information about what happened
On October 19, 2026, Google became aware that the private keys for several
intermediate certificate authority (CA) certificates issued by a third-party
certificate authority (eMudhra) were compromised and subsequently revoked (for
more details, see the
[Google Security Blog post](https://blog.google/security/protecting-chrome-and-android-users-from-compromised-emudhra-intermediate-ca-certificates/)).
Attackers possessing the compromised certificate authority keys can forge
legitimate-looking HTTPS certificates. Because affected apps fail to detect the
revocation and continue trusting the fake credentials, attackers on the network
can conduct man-in-the-middle attacks to impersonate legitimate backend servers
(including Cloud Firestore and any HTTPS endpoints contacted by affected apps or
the App Distribution Gradle plugin), which means that attackers can secretly
intercept, steal, or tamper with sensitive user data.
While operating systems and web browsers have distributed updates to distrust
these intermediate certificates in system trust stores, the impacted products
listed on this page validate Transport Layer Security (TLS) connections using an
embedded root certificate bundle compiled into the binary.
To protect client connections against this compromised certificate authority, we
mitigated this issue by removing the root certificates that chain to the
compromised eMudhra intermediates in the following components of our ecosystem:
- **The Flutter SDK and the Dart SDK**
- **Cloud Firestore SDKs for Apple, Flutter, Unity, and C++**
The Cloud Firestore backend was not affected by this issue, and neither was any
other part of the Cloud Firestore product.
- **The Firebase App Distribution Gradle plugin**
The App Distribution backend was not affected by this issue, and neither
was any other part of the App Distribution product.