Image: Wikimedia Commons / RaddP, CC BY-SA 4.0 — the Flutter logo. It illustrates the framework, not the security fix itself: the fix lives inside the SDK's TLS code, where no screenshot exists.
TL;DR — flutter 3.47.8 emudhra fix explained: Flutter 3.47.8 and Dart 3.13.7 block eight compromised eMudhra intermediate certificates that could let an attacker on the network forge valid certificates for any website. If you ship a Dart or Flutter app on Android, Windows or Linux, upgrading your SDK is only step one — you must rebuild the app and ship the new build, because the old build already on users' phones keeps trusting the bad certificates until it is replaced.
📌 KEY HIGHLIGHTS
- What happened: eight intermediate Certificate Authority (CA) certificates issued by eMudhra were disclosed as compromised in October 2026, after weak key-generation entropy made their private keys derivable.
- The fix: Dart 3.13.7 (stable) and Flutter 3.47.8 (stable) update the built-in BoringSSL engine to distrust those certificates outright. Beta builds are Dart 3.14.0-315.3.beta and Flutter 3.50.0-0.2.pre.
- The catch most developers miss: the trust list is compiled into your app's binary. An app already in the store stays vulnerable until you rebuild and redeploy it — installing the new SDK on your own machine patches nothing for existing users.
- Who is affected: Dart/Flutter apps making outbound HTTPS connections on Android, Windows and unpatched or containerized Linux. Web, iOS and macOS apps are not affected.
- Severity: rated high by the Dart team (improper certificate validation); no CVE number has been assigned, and no widespread exploitation has been reported.
Flutter 3.47.8 eMudhra fix explained: what was actually compromised
Every time your app talks to a server over HTTPS, it checks the server's certificate against a chain of trust: the server's certificate was signed by an intermediate certificate, which was signed by a root certificate your device trusts. If any link in that chain is sound, the connection is trusted. The eMudhra incident broke a link in the middle.
Eight eMudhra intermediate certificates were publicly disclosed as compromised because they were generated with weak randomness (entropy). Weak entropy means an attacker sitting on the network path could work out the intermediates' private keys — and with a private key, you can forge a certificate that looks valid for any domain at all. That is the classic man-in-the-middle attack: your app thinks it is talking to your API, but it is talking to the attacker, who can read or alter the traffic.
Why did Dart and Flutter need their own fix when browsers and operating systems were already pushing emergency blocklists? Because on Android and Windows, Dart's dart:io networking code validates certificates using its own compiled-in copy of BoringSSL (Google's TLS library), and that copy does not read the operating system's intermediate-certificate blocklists. The operating system could block the bad certificates all day; a Dart app would keep trusting them anyway. On Linux, apps are affected only where the system certificate bundle has not been updated — typically static containers or unpatched hosts. Web, iOS and macOS apps escape entirely because they hand certificate checking to the browser or to Apple's Security framework, which did pick up the blocklists.
In plain English: BoringSSL is the lock-checking code baked into every Dart and Flutter app. When the Dart team distrusts a certificate, they ship a new BoringSSL inside a new SDK — and only apps rebuilt with that SDK carry the new lock-checker. That is why this story is about rebuilding, not just updating: the lock lives in the app, not on the phone's operating system.
Why upgrading alone does not fix your users' apps
This is the single most important sentence in the advisory, and the easiest to get wrong: the fix is in the compiled binary, not in your source code. Running flutter upgrade updates the SDK on your machine. It does nothing to the app your users installed last month, because that build still contains the old BoringSSL trust list with the compromised certificates in it.
So the real sequence is three steps, in order: upgrade the SDK, rebuild every affected app or binary, and redeploy it — then nudge your users to update. If your CI pipeline pins an old SDK version (in GitHub Actions, FVM, Codemagic or wherever you build), the pipeline will quietly keep shipping the vulnerable build even after you upgraded locally. Pin the patched version in CI first, then rebuild.
There is also a beta trap worth knowing. The patched beta builds are Dart 3.14.0-315.3.beta and Flutter 3.50.0-0.2.pre. A beta like 3.50.0-0.1.pre looks numerically newer than 3.47.8, but it predates the fix and is still vulnerable — check the exact build, not just "3.50 or later". One forward-looking change softens this whole class of problem: on Android 14 and later, dart:io now loads system root certificates from the updatable Conscrypt module, so future revocations delivered through Google Play system updates will be honoured without waiting for a new app build.
Who is affected, and who is not
| Platform | Affected? | What to do |
|---|---|---|
| Android apps | Yes | Upgrade to Flutter 3.47.8, rebuild, release a new store build |
| Windows apps / binaries | Yes | Upgrade, rebuild, redeploy the binary |
| Linux apps / binaries | Only in containers or unpatched hosts | Update the system ca-certificates bundle, or rebuild with the patched SDK |
| Web, iOS, macOS apps | No | No action needed for this advisory (browser/Apple verification already blocks the certificates) |
| Firebase Firestore apps | Check separately | cloud_firestore 7.1.0, or backports 6.10.1 (iOS/macOS) / 6.10.2 (Windows); see developer coverage linked below |
Two more side-fixes surfaced in developer coverage of the advisory, worth checking while you are in there: the Firebase App Distribution Gradle plugin for Android should be at 5.3.1 or later (that one needs no app redeploy), and Firestore bundles its own root certificates, which is why its apps need the package update even on Apple platforms. You do not need to rewrite your networking code — no changes to Dio, http or similar packages are required. Upgrading and rebuilding is enough.
Should you care? ✅ / ⏳
✅ Yes, today, if you ship a Flutter or Dart app on Android, Windows or Linux — the fix is a rebuild away, the severity is high, and every day the old build stays in the store is a day it trusts certificates it should not. ⏳ No panic if you only ship web, iOS or macOS apps — those were never affected by this advisory, and there is no reported evidence of forged certificates being used in the wild. Either way, the window where patching is free and quiet is exactly now: no known exploitation yet is the best time to ship a fix, not a reason to skip it.
FAQs
What is the Flutter 3.47.8 eMudhra fix? A security release in which Flutter 3.47.8 (with Dart 3.13.7) updates its built-in BoringSSL engine to distrust eight compromised eMudhra intermediate CA certificates, closing a man-in-the-middle hole for Android, Windows and Linux apps.
Do I need to rebuild my app, or is upgrading the SDK enough? You must rebuild and redeploy. The certificate trust list is compiled into your app's binary, so an already-shipped build keeps trusting the compromised certificates until users install a new build made with the patched SDK.
Which Flutter and Dart versions have the fix? Stable: Flutter 3.47.8 with Dart 3.13.7. Beta: Flutter 3.50.0-0.2.pre with Dart 3.14.0-315.3.beta. Beware the trap: an earlier beta such as 3.50.0-0.1.pre is still vulnerable despite its higher-looking number.
Are iOS, macOS and web Flutter apps affected? No. Those builds rely on the browser's or Apple's certificate verification, which already blocks the compromised certificates. Only Android, Windows and unpatched/containerized Linux builds using dart:io are affected.
Takeaway: Flutter 3.47.8 is a small version bump with a big operational moral — in a world where trust lists ship inside your binary, "I upgraded" and "my users are safe" are two different sentences. Upgrade, pin it in CI, rebuild, ship, and tell your users to update. For the wider eMudhra story, see our earlier coverage: Python 3.15.2's security release blocking compromised eMudhra keys, the PHP Windows builds bundling the Brotli fix, and Apple's iOS 27.2 update from the same October security wave.
Follow World Tech on TechByCountry for the next update.
📸 Get tech in the last 24 hours on Instagram — follow @_techinlast24hrs for daily posts (9 AM–9 PM) and reels at 12:30 PM & 8:30 PM.
Sources
Dart SDK security advisory GHSA-frr6-h895-5pxp — TLS MitM vulnerability due to compromised eMudhra intermediate CA certificates
Flutter announce — [Security Advisory] Dart 3.13.7 and Flutter 3.47.8 Released
BlurBrahLab — Flutter 3.47.8 Revokes 8 Compromised CA Certs (27 Oct 2026 roundup)
Comments
Post a Comment