Malformed Firebase Payload Crashed iOS Apps at Launch, No Update Needed

Apps using Google's Firebase SDK on iOS began crashing at launch at 5:41 p.m. Pacific on Monday, Sept. 28, after a server response handed the SDK a dictionary entry with no key. Google finished a server-side fix at 7:52 p.m., and said no developer had to ship an update.

The account rests on a GitHub issue filed against the firebase-ios-sdk repository, Google's Firebase status dashboard, and reports from 9to5Google and Android Authority.

What the stack trace shows about Firebase iOS SDK 12.14.0

The reporter, a GitHub user named conquests, pasted the fatal exception: NSInvalidArgumentException *** -[__NSDictionaryM setObject:forKeyedSubscript:]: key cannot be nil. The trace below it runs through Analytics classes that build an experiment snapshot from a protobuf response, then copy each experiment into a mutable dictionary. The issue title ties the crash to a response from sdk-exp.

The report lists SDK version 12.14.0 and says the crash hit 56 users in the first 18 minutes, across four already-released builds of the same app. Four builds failing in the same window points at the input rather than the code, since none of them had changed. That reading is an inference from the report, not Google's statement.

The timeline, in Pacific time

Time on Sept. 28	Event	Source
5:41 p.m.	Crashes begin (00:41 UTC on Sept. 29)	GitHub issue, 9to5Google
7:52 p.m.	Fix fully rolled out	GitHub issue
11:52 p.m.	Crashes expected to stop after caching clears	GitHub issue

Why no app update could fix it

A crash at launch leaves the user no screen to reach and the developer no build to point them to. Nick Cooke, a Google software engineer, wrote in the issue thread that the problem was resolved on Google's side, and that "Due to caching behavior, some app instances may still experience crashes for up to 4 hours after the rollout completed," according to 9to5Google.

Android Authority reported that some apps saw crash counts more than 5,000 times their normal level. It also quoted a developer who said they spent a large number of AI tokens debugging an app they believed they had broken. Neither figure is Google's, and Android Authority named no affected app.

Silent input surprises have a long record in developer tools. The Postgres AT TIME ZONE footgun is another case where the code was correct and the data underneath it was not what the caller expected. For another developer tool whose callers are increasingly automated, see the site's report on the cf CLI Cloudflare built for agents.

What Google has and has not said

The dashboard carries one line about the event: "Google Analytics for Firebase iOS+ experienced an issue causing crashes on launch due to an incorrectly formatted payload received by the SDK. A fix has rolled out." When The Terminal loaded the page on Sept. 29, its status read "No incidents," and Android Authority reported that the dashboard had logged no incident for the event when it published at 6:51 a.m. Eastern.

Android Authority also said Google had not fully accounted for the root cause. The Terminal found no post-incident writeup on the dashboard or in the issue thread. A developer who wants to check exposure can search Crashlytics for the exception string above between 00:41 UTC and 06:52 UTC on Sept. 29, the span from the first crash to Google's expected all-clear.