Firebase Cloud Messaging is Google’s push-messaging service for sending notifications and data messages to mobile apps and web clients. It lets a server address a specific app instance through a registration token, then deliver messages even when the app is not actively open. In practice, FCM is the transport layer behind many legitimate alerts, from account warnings and chat messages to security prompts and device updates.
FCM matters in cyber security because the same delivery path can be used for trust abuse. Attackers and scam operators may rely on compromised apps, abusive sites, or deceptive permission prompts to push fake warnings, phishing links, or other social-engineering content directly to users. Defenders reduce that risk with permission controls, reputation checks, rate limiting, and app vetting. FCM is not inherently malicious; it is a high-reach channel that becomes dangerous when senders abuse the trust users place in notifications.