Repository navigation
[Android] Unauthorized executing of arbitrary Dart entrypoints via Intent extras #190452
Description
Activity
My proposed solution: Implement a tiered trust model based on build mode and
Intentsource:- Unconditionally allow
Intentuse for specifying Dart entrypoint args in debug and profile modes to preserve developer velocity - In release mode, only trust the route if it originates internally from the app itself, allowing secure self-routing for notifications. Fall back to args defined in the manifest.
- Unconditionally allow
- added a commit that references this issue
on Sep 26, 2026 - added a commit that references this issue
on Oct 6, 2026 This thread has been automatically locked since there has not been any recent activity after it was closed. If you are still experiencing a similar issue, please open a new bug, including the output of
flutter doctor -vand a minimal reproduction of the issue.- locked as resolved and limited conversation to collaborators
on Oct 10, 2026
Note
This bug is for tracking b/525537374.
Exported Android activities extending
FlutterActivity(like the defaultMainActivity) unconditionally parseIntentextras (EXTRA_DART_ENTRYPOINTandEXTRA_DART_ENTRYPOINT_ARGS) to configure and launch the initial Dart isolate. Because the launcher activity is exported by default, any co-resident, zero-permission application can send a targeted explicitIntentspecifying an alternate top-level Dart function annotated with@pragma('vm:entry-point')along with arbitrary arguments. The host application then boots the attacker-specified entrypoint instead of its standardmain()UI isolate, executing malicious workflows entirely inside the victim's process and security sandbox.Related to #190450