Flutter's Emergency 3.47.8 Release Blocks a Certificate Authority Whose Private Key Was the Number 4

Flutter apps using dart:io on Android, Windows, or Linux can trust a forged certificate from the compromised eMudhra chain even after OS vendors blacklist it, because the runtime checks its own BoringSSL copy. Upgrading to 3.47.8 is the only way to close that gap on those platforms.

eMudhra, a company whose business is digital trust, let eight intermediate CA private keys ride on the global trust chain for eighteen months. The keys were single-digit integers; one was literally 4. A P-384 private key should be a random integer near 2^384, so anyone who noticed could impersonate the CA and forge valid TLS certificates for arbitrary domains. The exposure ended only after the weak keys were discovered and browsers and OS vendors pushed emergency blacklists.

Those blacklists do not reach every Flutter app. dart:io on Android, Windows, and Linux validates TLS chains with the bundled BoringSSL engine, which does not read the operating system's intermediate CA blacklist. Flutter 3.47.8 and Dart 3.13.7 update BoringSSL so the compromised eMudhra intermediate certificates are blocked during TLS verification itself. On Android 14+, dart:io now loads system roots from the updatable Conscrypt APEX module, so future root store revocations delivered through Google Play system updates apply automatically. Apps that ignore certificate verification entirely won't get any protection from this fix.