To prevent `Intent`-based vulnerability exploits, the Flutter Android embedder (`FlutterActivity` and `FlutterFragmentActivity`) now verifies the sender of `Intent` objects before processing `EXTRA_INITIAL_ROUTE`, `EXTRA_DART_ENTRYPOINT`, `EXTRA_DART_ENTRYPOINT_ARGS`, `EXTRA_CACHED_ENGINE_ID`, and `EXTRA_CACHED_ENGINE_GROUP_ID`.
Original behavior
Previously, the Flutter Android embedder accepted routing, entrypoint, and engine configuration directly from `Intent` extras. This allowed external apps or malicious actors to:
New behavior
In release builds, the Android embedder strictly validates `Intent` extras: `"route"`, `"dart_entrypoint"`, `"dart_entrypoint_args"`, `"cached_engine_id"`, and `"cached_engine_group_id"`.
- Who is affected
- Applications and packages relying on the previous behaviour or signature. Code that uses Intent, FlutterActivity, FlutterFragmentActivity and related APIs.
- Practical impact
- Behaviour or API differences that can break builds or change runtime behaviour.
- What action should I take?
- Follow the official migration guide below, update affected call sites, run `dart fix --apply` where a fix is available, then run your tests.
Official migration guide (excerpt, © The Flutter Authors, CC BY 3.0)
You do not need to migrate if:
- You do not pass
route,dart_entrypoint,dart_entrypoint_args,cached_engine_id, orcached_engine_group_idextras inIntents. - Your target
FlutterActivityorFlutterFragmentActivityis not exported (android:exported="false").
If you pass these extras to an exported activity, choose one of the following migration strategies:
Set host activities to non-exported
If external apps do not need to open your activity directly,
set android:exported="false" in AndroidManifest.xml:
<activity
android:name=".MyFlutterActivity"
android:exported="false">
</activity>and CATEGORY_LAUNCHER) must remain exported so that the system launcher
can launch your app.
To route to specific screens from external sources,
shortcuts, or notifications,
use standard [deep links][] instead of EXTRA_INITIAL_ROUTE:
Intent intent = new Intent(context, MainActivity.class);
intent.setAction(Intent.ACTION_VIEW);
intent.setData(Uri.parse("myapp://product_details"));Declare matching <intent-filter> entries in AndroidManifest.xml
so the embedder can validate the incoming URL.
Declare entrypoints and routes in AndroidManifest.xml
For static entrypoints or initial routes,
declare them as <meta-data> in AndroidManifest.xml:
<activity
android:name=".MyFlutterActivity"
android:exported="true">
<meta-data
android:name="io.flutter.Entrypoint"
android:value="myCustomEntrypoint" />
<meta-data
android:name="io.flutter.InitialRoute"
android:value="/customRoute" />
</activity>Use startActivityForResult on Android 13 and earlier
For internal app launches to an exported activity on Android 13 and earlier,
call startActivityForResult() instead of startActivity():
- startActivity(intent);
+ startActivityForResult(intent, REQUEST_CODE);This populates getCallingPackage(), allowing the embedder to verify
that the Intent originated from your app.
You do not need to handle the result in onActivityResult().
Override configuration methods in an activity subclass
To provide dynamic entrypoints or arguments without relying on Intent extras,
subclass FlutterActivity or FlutterFragmentActivity
and override the configuration methods:
public class MyFlutterActivity extends FlutterActivity {
@NonNull
@Override
public String getDartEntrypointFunctionName() {
return ConfigManager.getEntrypoint();
}
@Nullable
@Override
public List<String> getDartEntrypointArgs() {
return ConfigManager.getArgs();
}
}AI_PROVIDER (for example to openai-compatible with a local Ollama or LM Studio endpoint) to enable grounded explanations. Everything else on this page works without an AI provider.Listed in the official breaking-changes index (docs.flutter.dev/release/breaking-changes).
An official announcement or migration guide documents an intended behaviour or API change. A verified source change (git diff) shows code changed but does not by itself prove a public API is breaking. AI interpretations are labelled and never used to classify a change.
- Source commit
- b3045439b7c0
- Source last updated
- Oct 21, 2026
- Last synchronized
- Oct 21, 2026
- Publication status
- published
Publication history
- Oct 21, 2026, 8:31 PM: new → published (ingestion) — Backed by an official breaking-change/migration guide.
AI_PROVIDER (for example to openai-compatible with a local Ollama or LM Studio endpoint) to enable grounded explanations. Everything else on this page works without an AI provider.