Dart 3.13.7 and Flutter 3.47.8 Patch Critical TLS Interception Vulnerability
Developers must rebuild Android, Windows, and Linux apps using updated SDKs to mitigate a certificate forgery risk stemming from compromised eMudhra intermediate CAs.
Dart 3.13.7 and Flutter 3.47.8 fix a TLS interception vulnerability. You must rebuild your apps with the patched SDK because upgrading the SDK alone does nothing.
The flaw stems from eight eMudhra intermediate certificate authorities. Private keys for these intermediates had insufficient randomness, letting network attackers derive them and forge valid HTTPS certificates. Six intermediates handled TLS and two handled code signing. A researcher reported this on October 17, and eMudhra revoked them within 14 hours.
Dart's dart:io library uses a compiled-in BoringSSL engine on Android and Windows rather than operating system blocklists. This means apps built with older SDKs still trust the compromised intermediates even on fully patched OSes. Linux environments with unpatched CA bundles are also affected. Web, iOS, and macOS apps are safe.
Affected versions include Dart stable before 3.13.7, Dart beta before 3.14.0-315.3.beta, Flutter stable before 3.47.8, and Flutter beta before 3.50.0-0.2.pre. The fix updates BoringSSL to distrust the keys. Additionally, Android 14 and newer now load system root certificates via the Conscrypt module for future revocations.
To fix it, rebuild Android, Windows, and Linux binaries with the new SDK and redeploy. Python released similar fixes, and eMudhra is exiting the global TLS business.