Description

Firebase SDK Security Scanner Findings – GoogleAppMeasurement 12.17.0

Overview

A NowSecure scan of our iOS application identified several security findings originating from Firebase/Google SDK binaries.

We verified that our application source code does not use CC_MD5, CC_SHA1, CommonCrypto hashing, or generate/store the flagged JWT.

Environment

• Firebase iOS SDK: 12.17.0
• GoogleAppMeasurement: 12.17.0
• GoogleDataTransport: 10.1.1
• Integration: Swift Package Manager
• Products: FirebaseAnalyticsCore + FirebaseCrashlytics
• IDFA/Ad-ID: Disabled
• Scanner: NowSecure Static + Dynamic Analysis

Findings

1. MD5 / SHA-1 Hashing

NowSecure detected CC_MD5 and CC_SHA1 inside the GoogleAppMeasurement binary.

The hashing appears to be used for analytics event/instance identification and deduplication. The resulting data is passed to GoogleDataTransport and persisted in its local event cache.

Request: Please confirm that these hashes are used only for non-security analytics purposes and provide any planned migration from MD5/SHA-1 to a modern algorithm such as SHA-256.

2. JWT in GoogleDataTransport Cache

An ES256 JWT was detected in:

Library/Caches/google-sdks-events/GDTCORFlatFileStorage/gdt_event_data/...

This appears to be an SDK-managed Google/Firebase transport token rather than an application or user credential.

Request: Please confirm the token's purpose, lifetime, security classification, and whether its on-disk storage is expected SDK behavior.

3. Tracking Domains

NowSecure identified the following hardcoded domains within Firebase/Google SDK binaries:

firebase-settings.crashlytics.com
www.googleadservices.com

Our configuration uses FirebaseAnalyticsCore and Crashlytics with IDFA/Ad-ID disabled. We do not enable ATT tracking.

Request: Please confirm whether these domains should be considered tracking domains in this configuration and whether keeping:

NSPrivacyTracking = false

is correct.

Current Disposition

All findings have been identified as SDK-internal and are not caused by application code.

We are currently risk-accepting these findings pending vendor clarification/remediation, as disabling Analytics or Crashlytics is not an option for our application.

Requested Vendor Response

Please provide:

1. Confirmation of the purpose and security relevance of the MD5/SHA-1 operations.
2. Remediation timeline, if MD5/SHA-1 replacement is planned.
3. Confirmation regarding the JWT stored by GoogleDataTransport.
4. Privacy/tracking classification of the identified domains.
5. Any supported mitigation that avoids these findings without disabling Firebase Analytics or Crashlytics.

An official response or statement would be helpful for our security audit documentation.

Reproducing the issue

No response

Firebase SDK Version

12.17.0

Xcode Version

26.6

Installation Method

Swift Package Manager

Firebase Product(s)

Analytics, Crashlytics

Targeted Platforms

iOS

Relevant Log Output

If using Swift Package Manager, the project's Package.resolved

Replace this line with the contents of your Package.resolved.

If using CocoaPods, the project's Podfile.lock

Replace this line with the contents of your Podfile.lock!