Google's Firebase payload bug crashed thousands of iPhone apps

Google's Analytics for Firebase iOS software development kit crashed thousands of iPhone and iPad apps on launch starting at 17:41 US/PDT on 28 September 2026, because of an incorrectly formatted payload delivered from Google's servers. Google software engineer Nick Cooke said a fix was fully rolled out by 19:52 US/PDT the same day, and no SDK updates were required from developers.heise.de

The incident matters because Firebase is integrated into thousands of apps on both Android and iOS, and the crash was entirely on Google's side, outside any developer's control. Some developers reported tens of thousands of crashes from their users, with some seeing far more. The fix removes the need for app updates, but caching meant some devices kept crashing for hours after the rollout completed.

What Google confirmed about the payload

Nick Cooke, a software engineer at Google, published a timeline of the incident. He wrote that the issue began on Monday, 2026-09-28 at 17:41 US/PDT, when Analytics for Firebase iOS+ experienced crashes on launch caused by an incorrectly formatted payload received by the SDK. He confirmed the fix was fully rolled out by 19:52 US/PDT that day, and stated that no SDK updates were required on developers' ends.

Because of caching behaviour, Cooke said, some app instances could still crash for up to four hours after the rollout finished, and those cases should have resolved themselves by 23:52 US/PDT on 2026-09-28. Heise reported that Google announced the fix rollout complete at 4:52 CEST on 29 September, and that crashes could still occur up to four hours later because of caching.

Developers of affected apps could do nothing but report the problem to Google and wait. Some initially believed the crashes came from their own apps. One developer said he had burned through many artificial-intelligence tokens while debugging. The incident shows the risk of widely used third-party SDKs that depend on external servers, since Firebase is used by many iOS developers to track how users interact with their apps.

Why developers could not fix it themselves

Firebase collects automatic events such as app launches, first launches after installation, app updates and screen views, and developers can also set their own events to measure feature uptake. Heise noted that Firebase's Crashlytics tool, which helps developers find bugs in their apps, is also popular because Apple's own developer tools offer the same function only with a delay.

The crash happened less than a second after an app started, once the SDK had loaded its configuration from Google's servers, according to a bug report on GitHub cited by Heise. The first crash report appeared at 2:41 CEST on 29 September 2026, and the fault struck at the moment of launch every time, so affected apps never reached their main interface.

This rules out the Apple software update as a cause and points instead to the payload Google's servers sent to the SDK, which lacked working error handling for that case.

For European developers the outage landed in the middle of the night, so by the time the sun rose in Germany the fault had cleared for most of them. Google confirmed the fix rollout was complete without going into further detail about what had gone wrong in the payload itself.

The chain of failure is straightforward: Google's servers delivered a wrongly formatted payload to the Analytics for Firebase iOS SDK, the SDK had no working error handling for that payload, and the app crashed immediately on launch before the user could do anything. Because the fault sat on Google's servers, no developer could patch it locally.

How the crash chain worked

Google's fix, fully rolled out by 19:52 US/PDT on 28 September 2026, corrected the payload at the source, so no SDK or app updates were needed. Caching on individual devices meant residual crashes could persist for up to four hours, until 23:52 US/PDT on 28 September 2026, after which Google considered the issue resolved.

Developers whose users reported crashes should see them stop without shipping an update, and Google has not announced any follow-up investigation or change to how the SDK handles malformed payloads. The next checkpoint is whether Google publishes further detail on the payload error; the incident itself was closed by 23:52 US/PDT on 28 September 2026.