Repository navigation
[Android] Arbitrary route injection via unvalidated explicit Intents #190450
Description
Note
This bug is for tracking b/525525393.
Flutter applications generated with the default template are vulnerable to arbitrary route injection because maybeGetInitialRouteFromIntent unconditionally parses the data URI of incoming explicit Intents without validating the Intent action (ACTION_VIEW), verifying the caller identity, or matching the URI against declared Intent filters. Since deep-linking defaults to enabled, a zero-permission co-resident app can send an explicit Intent directly targeting the exported default MainActivity, bypassing Android App Links domain verification and forcing the application to navigate to sensitive routes.
Related to: #190452
Activity
camsim99 commentedon Aug 3, 2026
My proposed solution: Implement a tiered trust model based on build mode and
Intentsource:Intentuse for specifying routes in debug and profile modes to preserve developer velocityACTION_VIEWand matches a declared<intent-filter>in the application's manifest[Android] Refuse external setters of engine entrypoint and cached eng…
[Android] Refuse external setters of engine entrypoint and cached eng…
[Android] Refuse external setters of engine entrypoint and cached eng…
[Android] Add breaking change page for hardened entrypoint and cached…
github-actions commentedon Oct 10, 2026
This thread has been automatically locked since there has not been any recent activity after it was closed. If you are still experiencing a similar issue, please open a new bug, including the output of
flutter doctor -vand a minimal reproduction of the issue.