Skip to content

[Android] Unauthorized executing of arbitrary Dart entrypoints via Intent extras #190452

New issue
New issue
Closed
#190249
Closed
[Android] Unauthorized executing of arbitrary Dart entrypoints via Intent extras#190452
#190249
Assignees
camsim99
Labels
P1High-priority issues at the top of the work listengineflutter/engine related. See also e: labels.platform-androidAndroid applications specificallyteam-androidOwned by Android platform teamtriaged-androidTriaged by Android platform team

Description

@camsim99
camsim99
opened on Aug 3, 2026

Note

This bug is for tracking b/525537374.

Exported Android activities extending FlutterActivity (like the default MainActivity) unconditionally parse Intent extras (EXTRA_DART_ENTRYPOINT and EXTRA_DART_ENTRYPOINT_ARGS) to configure and launch the initial Dart isolate. Because the launcher activity is exported by default, any co-resident, zero-permission application can send a targeted explicit Intent specifying an alternate top-level Dart function annotated with @pragma('vm:entry-point') along with arbitrary arguments. The host application then boots the attacker-specified entrypoint instead of its standard main() UI isolate, executing malicious workflows entirely inside the victim's process and security sandbox.

Related to #190450

Activity

  1. camsim99
    self-assigned this
    on Aug 3, 2026
  2. camsim99
    added
    platform-androidAndroid applications specifically
    engineflutter/engine related. See also e: labels.
    P1High-priority issues at the top of the work list
    team-androidOwned by Android platform team
    triaged-androidTriaged by Android platform team
    on Aug 3, 2026

  3. camsim99 commented on Aug 3, 2026

    @camsim99
    camsim99
    on Aug 3, 2026
    ContributorAuthor

    My proposed solution: Implement a tiered trust model based on build mode and Intent source:

    • Unconditionally allow Intent use for specifying Dart entrypoint args in debug and profile modes to preserve developer velocity
    • In release mode, only trust the route if it originates internally from the app itself, allowing secure self-routing for notifications. Fall back to args defined in the manifest.
  4. auto-submit
    closed this as completedin #190249on Sep 26, 2026
  5. pull
    added a commit that references this issue on Sep 26, 2026

    [Android] Refuse external setters of engine entrypoint and cached eng…

    4759fcb
  6. DanTup
    added 2 commits that reference this issue on Sep 28, 2026

    [Android] Refuse external setters of engine entrypoint and cached eng…

    0c99c87

    [Android] Refuse external setters of engine entrypoint and cached eng…

    2d0d1bf
  7. sfshaza2
    added a commit that references this issue on Oct 6, 2026

    [Android] Add breaking change page for hardened entrypoint and cached…

    4ec1505

  8. github-actions commented on Oct 10, 2026

    @github-actions
    github-actionsBot
    on Oct 10, 2026 – with GitHub Actions

    This thread has been automatically locked since there has not been any recent activity after it was closed. If you are still experiencing a similar issue, please open a new bug, including the output of flutter doctor -v and a minimal reproduction of the issue.

  9. github-actions
    locked as resolved and limited conversation to collaborators on Oct 10, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

Labels

P1High-priority issues at the top of the work listengineflutter/engine related. See also e: labels.platform-androidAndroid applications specificallyteam-androidOwned by Android platform teamtriaged-androidTriaged by Android platform team

Type

No type

Projects

No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions