From 9cc1242edf0f9e2e3def3f643a30aa067b2acce9 Mon Sep 17 00:00:00 2001
From: basavaraj-sm05 <basavaraj@digiscrypt.com>
Date: Thu, 30 Jul 2026 17:25:21 +0530
Subject: [PATCH] use SecureRandom for web socket mask keys

---
 okhttp/src/commonJvmAndroid/kotlin/okhttp3/OkHttpClient.kt | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/okhttp/src/commonJvmAndroid/kotlin/okhttp3/OkHttpClient.kt b/okhttp/src/commonJvmAndroid/kotlin/okhttp3/OkHttpClient.kt
index ff478913b0d2..23b89a88091e 100644
--- a/okhttp/src/commonJvmAndroid/kotlin/okhttp3/OkHttpClient.kt
+++ b/okhttp/src/commonJvmAndroid/kotlin/okhttp3/OkHttpClient.kt
@@ -18,8 +18,8 @@ package okhttp3
 import java.net.Proxy
 import java.net.ProxySelector
 import java.net.Socket
+import java.security.SecureRandom
 import java.time.Duration
-import java.util.Random
 import java.util.concurrent.ExecutorService
 import java.util.concurrent.TimeUnit
 import java.util.concurrent.TimeUnit.MILLISECONDS
@@ -363,7 +363,7 @@ open class OkHttpClient internal constructor(
         taskRunner = taskRunner,
         originalRequest = request,
         listener = listener,
-        random = Random(),
+        random = SecureRandom(),
         pingIntervalMillis = pingIntervalMillis.toLong(),
         // extensions is always null for clients:
         extensions = null,