Flutter Security Brief: Upgrade 3.47.8, Then Rebuild the App
A source-checked reading of a Flutter 3.47.8 emergency update, separating the developer summary from the Dart SDK advisory and its concrete remediation scope.
Published / Methodology
What the source reports
A Juejin post by a Flutter and Dart developer, displayed as published October 26, 2026, says Flutter released 3.47.8 and Dart 3.13.7 after compromised eMudhra certificate keys were disclosed. The author explains the issue in colloquial terms and recommends upgrading. That is a developer’s summary, not an exploit reproduction or an independent audit.
The official Dart SDK advisory, published October 23, gives the checkable scope: Flutter stable versions before 3.47.8 and Dart stable versions before 3.13.7 are affected for the described TLS path. It lists Android, Windows and unpatched or containerized Linux as affected contexts, while Web, iOS and macOS use different verification paths for this issue.
What the official advisory adds
The advisory says eight eMudhra intermediate CA certificates were compromised after weak key generation made their private keys recoverable. It describes a network-path attacker forging certificates for arbitrary domains and explains that Android and Windows dart:io used a compiled-in BoringSSL engine that did not consume OS intermediate-certificate blocklists.
The remediation is operational: upgrade the SDK, rebuild the Android, Windows and Linux applications or compiled binaries, and redeploy them. The advisory identifies a BoringSSL change that explicitly distrusts the compromised intermediates and an Android 14+ change that loads system root certificates from the updatable Conscrypt APEX module. ThreadEast did not reproduce the chain or inspect a production app.
The practical reading
Treat 3.47.8 as a build input, not a label to paste into a release note. Verify the SDK in CI, regenerate every affected artifact, record its digest and review certificate-validation overrides. A source listing or hot-list position can establish that the topic was observed; it cannot establish how many apps were exposed or how many developers upgraded.
ThreadEast first observed this Juejin item on October 26 and captured the selected observation at 01:35 China Standard Time on October 28. The official advisory date is October 23. Today’s briefing records the October 28 editorial check, not a new vulnerability disclosure. The accompanying guide provides a platform-by-platform release checklist.
Sources & further reading
- Juejin developer report
- Official Dart SDK security advisory
- Flutter release notes
- Google security context
- Practical guide: checking a Flutter TLS security update
- October 28 reviewed daily briefing
- Preserved October 28 Flutter reading
Found an error? Request a correction.