Skip to content
Boring Doc
BreakingHigh impactOfficial migration guidenot yet in a stable releaselanded 3.50.0-0.1.preandroid

Stricter Android Intent verification for app entrypoints

Framework · Official source

To prevent `Intent`-based vulnerability exploits, the Flutter Android embedder (`FlutterActivity` and `FlutterFragmentActivity`) now verifies the sender of `Intent` objects before processing `EXTRA_INITIAL_ROUTE`, `EXTRA_DART_ENTRYPOINT`, `EXTRA_DART_ENTRYPOINT_ARGS`, `EXTRA_CACHED_ENGINE_ID`, and `EXTRA_CACHED_ENGINE_GROUP_ID`.

Original behavior

Previously, the Flutter Android embedder accepted routing, entrypoint, and engine configuration directly from `Intent` extras. This allowed external apps or malicious actors to:

New behavior

In release builds, the Android embedder strictly validates `Intent` extras: `"route"`, `"dart_entrypoint"`, `"dart_entrypoint_args"`, `"cached_engine_id"`, and `"cached_engine_group_id"`.

Who is affected
Applications and packages relying on the previous behaviour or signature. Code that uses Intent, FlutterActivity, FlutterFragmentActivity and related APIs.
Practical impact
Behaviour or API differences that can break builds or change runtime behaviour.
What action should I take?
Follow the official migration guide below, update affected call sites, run `dart fix --apply` where a fix is available, then run your tests.
Migration checklist0/3
Official migration guide (excerpt, © The Flutter Authors, CC BY 3.0)

You do not need to migrate if:

  • You do not pass route, dart_entrypoint, dart_entrypoint_args, cached_engine_id, or cached_engine_group_id extras in Intents.
  • Your target FlutterActivity or FlutterFragmentActivity is not exported (android:exported="false").

If you pass these extras to an exported activity, choose one of the following migration strategies:

Set host activities to non-exported

If external apps do not need to open your activity directly, set android:exported="false" in AndroidManifest.xml:

<activity
    android:name=".MyFlutterActivity"
    android:exported="false">
</activity>

and CATEGORY_LAUNCHER) must remain exported so that the system launcher can launch your app.

To route to specific screens from external sources, shortcuts, or notifications, use standard [deep links][] instead of EXTRA_INITIAL_ROUTE:

Intent intent = new Intent(context, MainActivity.class);
intent.setAction(Intent.ACTION_VIEW);
intent.setData(Uri.parse("myapp://product_details"));

Declare matching <intent-filter> entries in AndroidManifest.xml so the embedder can validate the incoming URL.

Declare entrypoints and routes in AndroidManifest.xml

For static entrypoints or initial routes, declare them as <meta-data> in AndroidManifest.xml:

&#x3C;activity 
    android:name=".MyFlutterActivity"
    android:exported="true">
    &#x3C;meta-data
        android:name="io.flutter.Entrypoint"
        android:value="myCustomEntrypoint" />
    &#x3C;meta-data
        android:name="io.flutter.InitialRoute"
        android:value="/customRoute" />
&#x3C;/activity>

Use startActivityForResult on Android 13 and earlier

For internal app launches to an exported activity on Android 13 and earlier, call startActivityForResult() instead of startActivity():

- startActivity(intent);
+ startActivityForResult(intent, REQUEST_CODE);

This populates getCallingPackage(), allowing the embedder to verify that the Intent originated from your app. You do not need to handle the result in onActivityResult().

Override configuration methods in an activity subclass

To provide dynamic entrypoints or arguments without relying on Intent extras, subclass FlutterActivity or FlutterFragmentActivity and override the configuration methods:

public class MyFlutterActivity extends FlutterActivity {
    @NonNull
    @Override
    public String getDartEntrypointFunctionName() {
        return ConfigManager.getEntrypoint(); 
    }
    
    @Nullable
    @Override
    public List&#x3C;String> getDartEntrypointArgs() {
        return ConfigManager.getArgs();
    }
}
Migration assistantAI-generated · grounded in cited sources
AI explanations are not configured
Set AI_PROVIDER (for example to openai-compatible with a local Ollama or LM Studio endpoint) to enable grounded explanations. Everything else on this page works without an AI provider.
Official migration guide·Verified classification (95%)

Listed in the official breaking-changes index (docs.flutter.dev/release/breaking-changes).

An official announcement or migration guide documents an intended behaviour or API change. A verified source change (git diff) shows code changed but does not by itself prove a public API is breaking. AI interpretations are labelled and never used to classify a change.

Source commit
b3045439b7c0
Source last updated
Oct 21, 2026
Last synchronized
Oct 21, 2026
Publication status
published
Publication history
  • Oct 21, 2026, 8:31 PM: new → published (ingestion) — Backed by an official breaking-change/migration guide.
AI explanationAI-generated · grounded in cited sources
AI explanations are not configured
Set AI_PROVIDER (for example to openai-compatible with a local Ollama or LM Studio endpoint) to enable grounded explanations. Everything else on this page works without an AI provider.
Was this useful?