Taiwan Information Security Association
Join TWISA
Menu

Certificate trustMon, 26 Oct 2026

Flutter and Firebase certificate trust: update SDKs and release rebuilt apps

Embedded TLS trust data can remain outdated after an OS update. Check the SDK and platform, then rebuild and redistribute affected applications.

Download PDF (Traditional Chinese)View applicable solutionsBack to Security alerts
01

Article

An eMudhra key-generation flaw made intermediate CA private keys recoverable. An attacker on the network path could impersonate a backend with a forged TLS certificate and read or alter traffic, including personal data or tokens. Firebase updated its guidance on October 25. The Dart dart:io advisory excludes Web, iOS and macOS for that validation path. Check Firestore separately on each platform.

Google expected to push removal of emSign ECC Root CA - G3 from the Chrome Root Store on the morning of October 27 PDT. For sites using that chain, replace the certificate at every TLS endpoint and failover node, then verify service from actual clients.

Fixed releases by branch
  • Dart 3.13.7 / 3.14.0-315.3.beta; Flutter 3.47.8 / 3.50.0-0.2.pre
  • FlutterFire cloud_firestore 7.1.0; iOS/macOS 6.10.1 or Windows 6.10.2 on the earlier line
  • FirebaseFirestore Apple SDK 13.1.1 or 12.19.3 (CocoaPods: 12.19.3)
  • Firebase Unity SDK 14.1.0 or 13.17.1; Firebase C++ SDK 14.1.0 or 13.13.1
Attack flowAttack path
  1. 01

    Intercept traffic

  2. 02

    Present a forged TLS certificate

  3. 03

    Read or modify data and tokens

Response flowResponse steps
  1. 01

    Identify the TLS components

    Inventory shipped apps, lockfiles, CI builds and embedded trust stores. Include managed apps and internal tools.

    See what to doResources: 1

    TWISA member solutions

    Identify the TLS components

    Inventory shipped apps, lockfiles, CI builds and embedded trust stores. Include managed apps and internal tools.

  2. 02

    Update and rebuild by release line

    Update the affected SDKs or plugins, rebuild, and distribute through approved channels.

    View guidanceResources: 1

    Response guidance

    Update and rebuild by release line

    Update the affected SDKs or plugins, rebuild, and distribute through approved channels.

  3. 03

    Track rollout to users

    Check store and enterprise distribution versions and track devices still using the old build.

  4. 04

    Verify certificate trust and business connections

    In an authorized test environment, check that untrusted chains fail and sign-in, Firestore and internal APIs still work.

    See what to doResources: 2

    TWISA member solutions

    Verify certificate trust and business connections

    In an authorized test environment, check that untrusted chains fail and sign-in, Firestore and internal APIs still work.

Defense architectureLayered defenses

Allow authorized traffic and apply controls at each layer.

  1. 01

    Identify the TLS components

    Inventory shipped apps, lockfiles, CI builds and embedded trust stores. Include managed apps and internal tools.

  2. 02

    Update and rebuild by release line

    Update the affected SDKs or plugins, rebuild, and distribute through approved channels.

  3. 03

    Track rollout to users

    Check store and enterprise distribution versions and track devices still using the old build.

Feed logs and traffic data from each layer into monitoring and response.

  1. Verify certificate trust and business connectionsIn an authorized test environment, check that untrusted chains fail and sign-in, Firestore and internal APIs still work.

TWISA member solutions

Sources and further reading

Alert updated: 2026/10/26. Check vendor guidance for the latest support and patch status.