Over 150 Firebase-Powered Mobile Apps Expose Sensitive User Data via Misconfigurations

Security researchers revealed Firebase misconfigurations in over 150 popular mobile apps, exposing sensitive data to unauthenticated access via Realtime Databases, Storage, Firestore, and Remote Config. Analyzing 1,200 apps across three categories (of 32-34), they found issues in millions-download apps—exceeding Tea's 500K breach—and estimate 4,800 vulnerable services globally, as Firebase powers ~80% of apps. Exposed: payments, PII (IDs, locations), chats, passwords, and tokens (GitHub/AWS), enabling broad attacks.


Root cause: Developers extend "test mode" past 30 days for public access, due to weak rule knowledge and permissive examples; keys from google-services.json stay unprotected. OpenFirebase scanner, built by researchers, extracts APK configs and tests multiple services—surpassing limited tools.


Scans (937+ projects): Storage (44 public, e.g., 100M+ photos); Realtime DB (35 public with creds/chats); Remote Config (383 public, 30 secrets); Firestore (50 public DBs). Urgently audit: Use production rules, Firebase Auth, OpenFirebase monitoring, and best practices to secure data and mitigate risks.
NPAV offers a robust solution to combat cyber fraud. Protect yourself with our top-tier security product, Z Plus Security