FAR FROM RANDOM: THREE MISTAKES FROM DART/FLUTTER'S WEAK PRNG

Summary from the TLDR Web Dev newsletter

This report explains three vulnerabilities that stem from a weak pseudo-random number generator (PRNG) in Dart/Flutter. The vulnerabilities affected the Dart SDK, Proton Wallet, and SelfPrivacy, allowing attacks ranging from arbitrary file access to the compromise of user accounts. The weakness arose from a 32-bit truncation of the PRNG's 64-bit seed, reducing its entropy and making it easily brute-forceable.