Summary & Impact
In October 2026, eight intermediate Certificate Authority (CA) certificates issued by eMudhra were publicly disclosed as compromised due to weak key generation entropy, allowing an attacker on the network path to derive their private keys and forge valid TLS/HTTPS certificates for arbitrary domains.
Scope of the Vulnerability
Dart and Flutter applications that make outbound TLS/HTTPS connections (dart:io) on Android, Windows, and Linux are vulnerable to Man-in-the-Middle (MitM) TLS interception using certificates forged by the compromised intermediate CAs until rebuilt with a patched SDK:
- Android & Windows:
dart:io validates TLS certificate chains using its compiled-in BoringSSL engine and does not read OS-managed intermediate certificate blocklists.
- Linux: Applications are affected only in environments (such as static containers or unpatched hosts) that have not updated their system
ca-certificates bundle to remove the affected roots.
- Web, iOS, and macOS: Applications on Web, iOS, and macOS are not affected, as they rely on browser or Apple
Security.framework certificate verification.
Affected Platforms & Versions
- Affected Platforms: Android, Windows, and unpatched/containerized Linux
- Affected Versions:
- Dart SDK stable versions prior to
3.13.7 (and beta versions prior to 3.14.0-315.3.beta)
- Flutter SDK stable versions prior to
3.47.8 (and beta versions prior to 3.50.0-0.2.pre)
Patches & Remediation
Upgrade your SDK, rebuild your Android, Windows, and Linux applications or compiled binaries, and redeploy them:
- Dart SDK: Fixed in stable
3.13.7 and beta 3.14.0-315.3.beta
- Flutter SDK: Fixed in stable
3.47.8 and beta 3.50.0-0.2.pre
What changed
- BoringSSL was updated (
ecb2c83516) to explicitly distrust the compromised eMudhra intermediate certificates during TLS chain verification.
- On Android 14+,
dart:io now loads system root certificates from the updatable Conscrypt APEX module (a9e26a21af), honoring future over-the-air root store revocations delivered via Google Play system updates.
References
Summary & Impact
In October 2026, eight intermediate Certificate Authority (CA) certificates issued by eMudhra were publicly disclosed as compromised due to weak key generation entropy, allowing an attacker on the network path to derive their private keys and forge valid TLS/HTTPS certificates for arbitrary domains.
Scope of the Vulnerability
Dart and Flutter applications that make outbound TLS/HTTPS connections (
dart:io) on Android, Windows, and Linux are vulnerable to Man-in-the-Middle (MitM) TLS interception using certificates forged by the compromised intermediate CAs until rebuilt with a patched SDK:dart:iovalidates TLS certificate chains using its compiled-in BoringSSL engine and does not read OS-managed intermediate certificate blocklists.ca-certificatesbundle to remove the affected roots.Security.frameworkcertificate verification.Affected Platforms & Versions
3.13.7(and beta versions prior to3.14.0-315.3.beta)3.47.8(and beta versions prior to3.50.0-0.2.pre)Patches & Remediation
Upgrade your SDK, rebuild your Android, Windows, and Linux applications or compiled binaries, and redeploy them:
3.13.7and beta3.14.0-315.3.beta3.47.8and beta3.50.0-0.2.preWhat changed
ecb2c83516) to explicitly distrust the compromised eMudhra intermediate certificates during TLS chain verification.dart:ionow loads system root certificates from the updatable Conscrypt APEX module (a9e26a21af), honoring future over-the-air root store revocations delivered via Google Play system updates.References