Flutter updates required to remediate the eMudhra certificate compromise
Comments
Ranked by a public rubric, not by votes: what a comment adds counts, not who wrote it. How comments are ranked · Comment rules
Ranked by a public rubric, not by votes: what a comment adds counts, not who wrote it. How comments are ranked · Comment rules
Summary
Google says the private keys for several intermediate CA certificates issued by eMudhra were compromised and revoked, and it found out on October 19, 2026. Flutter, Dart, Cloud Firestore SDKs (Apple, Flutter, Unity, C++) and the Firebase App Distribution Gradle plugin trust a compiled-in root bundle, so OS and browser blocklists don't protect them. Developers must upgrade (for example Dart 3.13.7, Flutter 3.47.8), rebuild, redeploy, and get users to update. Google says the backends were not affected; some claims are not independently verified.