Fix 'Unsafe App Blocked' When Installing Citra MMJ APK

You downloaded the Citra MMJ APK, tapped install, and Android stopped you cold: “Unsafe app blocked — this app may be harmful.” Your first instinct might be that something is wrong with the file. In the vast majority of cases, nothing is wrong at all — this is just Android doing its job a little too aggressively.

This guide explains what the warning actually means, how to safely install anyway, and how to verify your APK is legitimate.

What “Unsafe App Blocked” Actually Means

The warning comes from Google Play Protect, Android’s built-in app scanner. Here’s the key fact most people miss:

Play Protect flags virtually every sideloaded APK — any app installed from outside the Play Store. The warning is triggered by the installation method, not by anything it found in the file.

Citra MMJ isn’t on the Google Play Store (Nintendo’s legal action against emulation projects in 2024 keeps emulator distribution off official storefronts), so the only way to install it is sideloading — which is exactly what Play Protect warns about. The same warning appears for countless legitimate open-source apps installed the same way.

In short: “Unsafe app blocked” means “this didn’t come from the Play Store,” not “this is malware.”

Is It Safe to Install Anyway? How to Decide

The warning is generic, so you have to do the verification Play Protect can’t. Ask yourself two questions:

1. Where did the APK come from? If you downloaded it from the official source — the weihuoya/citra GitHub repository releases page, which is where Citra MMJ builds are published — you’re getting the genuine build. If it came from a random APK mirror site, a Telegram channel, or a YouTube description link, treat it with suspicion.
2. Does the file check out? (Verification steps below.)

If the answer to #1 is the official GitHub releases page, installing anyway is the normal, expected process — every Citra MMJ user does it.

How to Install Anyway (Step by Step)

Android 13 / 14 / 15

1. When the “Unsafe app blocked” dialog appears, tap More details (or the small arrow/expand option).
2. Tap Install anyway.
3. If the button isn’t there, go to Settings → Security → Google Play Protect and check the scan result — then return and retry; the option usually appears on the second attempt.
4. Alternatively: Settings → Apps → Special app access → Install unknown apps → select your browser (or file manager) → enable Allow from this source. Then reinstall the APK.

Android 10 / 11 / 12

1. On the blocked dialog, tap Install anyway directly (older versions show it without the “More details” step).
2. If blocked: Settings → Apps & notifications → Special app access → Install unknown apps → enable for your browser/file manager.

💡 Tip: After installing, you can turn “Install unknown apps” back off for your browser. It only needs to be on during the actual installation.

How to Verify Your APK Is Genuine

Even from the official source, it’s good practice to verify the file. Here’s how:

1. Download only from weihuoya/citra releases. Bookmark the releases page and never install a Citra MMJ APK from anywhere else. The official MMJ builds (like the 20250221 storage-access and antutu variants) are published there.
2. Check the file size. Compare your downloaded APK’s size against the size listed on the GitHub release page. A genuine MMJ APK is tens of megabytes; a file that’s only a few KB is a fake or a broken download.
3. Check the hash if provided. Some releases publish SHA-256 checksums. On Android, you can verify with a checksum app; on a PC, use sha256sum filename.apk (Linux/Mac) or certutil -hashfile filename.apk SHA256 (Windows) and compare.
4. Check the signing certificate on update. When updating, Android verifies the new APK is signed by the same key as the installed one. If an “update” APK refuses to install over your existing MMJ with a signature error, don’t force it — it may be from a different source.

When to Actually Worry

Install-anyway is routine — but stay alert for these genuine red flags:

Red flag	Why it matters
APK from a random mirror/Telegram/YouTube link	Could be repackaged with malware
File size wildly different from the GitHub release	Tampered or fake file
App asks for SMS, contacts, or call permissions	An emulator has no legitimate need for these
Aggressive pop-up ads inside the “emulator”	Genuine MMJ builds have no ads
Signature mismatch when updating	Different signer = different source

A legitimate Citra MMJ build asks only for storage/files permission (to read your dumps and write saves) and possibly microphone access for games that use it. Anything beyond that is suspicious.

⚠️ Before Proceeding: If you already installed an APK from an untrusted source and it shows any red flag above, uninstall it immediately, then install fresh from the official GitHub releases. When in doubt, start clean.

”Install Anyway” Button Missing? Try This

Some Android skins (especially Xiaomi’s MIUI/HyperOS, Oppo’s ColorOS, and Samsung’s One UI) make the bypass harder to find than stock Android:

• Xiaomi/HyperOS: The dialog may say “Installation blocked” with no bypass option. Go to Settings → Privacy protection → Special app access → Install unknown apps, enable it for your browser, then install from the file manager instead of the browser’s download prompt.
• Samsung: If Play Protect blocks it, open the Play Store → profile icon → Play Protect → Settings and temporarily turn off Scan apps with Play Protect, install the APK, then turn scanning back on.
• Android 14+ “Restricted setting”: If the “Allow from this source” toggle is greyed out, Android may have flagged the installer app as restricted. Open the installer app’s info page (e.g., Chrome) in Settings → Apps, tap the three-dot menu, and choose Allow restricted settings.

💡 Tip: These restrictions are anti-malware friction aimed at the average user. For a file you’ve verified from the official GitHub releases, working through them is safe and expected.

Keeping MMJ Updated Without Re-triggering the Warning

Every time you update Citra MMJ to a newer build, you’ll sideload again — and Play Protect will warn you again. That’s normal; the process doesn’t get “trusted” over time. To keep updates painless:

1. Always download the new APK from the same official releases page.
2. Install it directly over the existing app — your settings and saves in citra-emu are preserved.
3. If Android reports a signature conflict, stop: the new APK was signed by a different key, which means it’s not from the same source. Verify before proceeding.
4. After major updates, clear the shader cache (old shaders can crash the new build) — see our shader cache explainer.

After Installing

Once Citra MMJ is installed:

1. Grant Files and media / Storage permission when prompted (or via Settings → Apps → Citra MMJ → Permissions).
2. If you’re new, our complete beginner guide walks through setup from zero.
3. Grab your dumped system files and configure graphics with our best settings guide.
4. If the app crashes on launch after installing, work through the crashing fix checklist.

The “Unsafe app blocked” warning feels alarming the first time you see it, but for Citra MMJ it’s simply the cost of sideloading an app Google doesn’t distribute. Download from the official source, verify the file, tap “Install anyway” — and you’re in.