Loading story…
Microsoft disclosed a severe intent redirection vulnerability in EngageLab’s third-party Android EngageSDK that could allow a malicious app on the same device to bypass Android sandbox protections and access sensitive data from affected apps. The flaw was tied to an exported activity, MTCommonActivity, which was introduced through the SDK into an app’s merged manifest and could process attacker-controlled intent URIs, causing intents to launch with the vulnerable app’s identity and permissions. Microsoft said the exposure was especially serious for cryptocurrency and digital wallet apps, with affected wallet applications alone accounting for more than 30 million installations.
Microsoft identified the issue in EngageSDK version 4.5.4, reported it to EngageLab in April 2025, and escalated it to the Android Security Team in May 2025. EngageLab fixed the vulnerability in version 5.2.1, released on November 3, 2025, while Google Play removed detected apps using vulnerable SDK versions and Android added automatic protections to mitigate the specific risk as developers update. Microsoft said it found no evidence of in-the-wild exploitation, but warned that insecure third-party mobile SDKs can create broad supply-chain exposure affecting more than 50 million app installations overall.
See affected versions and whether adversaries are exploiting it.
6 events from the most recent confirmed update back to the earliest known activity.
Microsoft publicly disclosed the vulnerability and said affected wallet apps alone accounted for more than 30 million installations, with total exposure across wallet and non-wallet apps exceeding 50 million. Microsoft said it had found no evidence of in-the-wild exploitation at the time of disclosure.
Apps detected as using vulnerable EngageLab SDK versions were removed from Google Play as part of mitigation efforts. Android also added automatic user protections to reduce risk from the specific EngageSDK issue while developers update their apps.
EngageLab fixed the vulnerability in EngageSDK version 5.2.1, released on November 3, 2025. The patch addressed the intent redirection issue that had exposed apps using vulnerable SDK versions to potential data access by malicious local apps.
Microsoft escalated the EngageLab SDK vulnerability to the Android Security Team in May 2025. The issue involved an exported activity, MTCommonActivity, that could process attacker-controlled intent URIs and launch intents with the vulnerable app's identity and permissions.
Microsoft notified EngageLab about the vulnerability in April 2025 after finding the issue in EngageSDK version 4.5.4. The bug affected a widely used SDK embedded in Android apps, including cryptocurrency and digital wallet applications.
Microsoft Defender Security Research identified a severe intent redirection vulnerability in the third-party Android EngageLab EngageSDK, affecting apps that integrated the SDK. The flaw could let a malicious app on the same device bypass Android sandbox protections and access sensitive data from vulnerable apps.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
5 references tracked. Mallory keeps watching after this page renders.
scworld.com
Open sourcecybersecuritynews.com
Open sourcetechrepublic.com
Open sourcethehackernews.com
Open sourcemicrosoft.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Microsoft disclosed **CVE-2026-42835**, an Important-severity information disclosure vulnerability in **Microsoft Teams for Android** that could allow a remote, authenticated low-privileged attacker to access small portions of heap memory without user interaction. The flaw, classified as **CWE-74** for improper neutralization of special elements in output used by a downstream component, carries a **CVSS 3.1 score of 8.1** and may expose sensitive runtime data including authentication tokens, session information, or cached credentials. Microsoft said the vulnerability was responsibly reported by **Ofek Levin of Enclave** through its coordinated disclosure program and has released a security update through the **Google Play Store**. The company stated that exploitation is considered less likely and that it had seen no public disclosure or evidence of active exploitation at the time of publication, but organizations using Teams for sensitive internal communications were urged to update affected Android clients promptly.
Jun 29, 2026
A vulnerability in Microsoft Authenticator, tracked as **CVE-2026-26123**, allowed malicious Android and iOS apps to hijack the app’s unclaimed `ms-msa://` deep link and intercept authentication tokens during onboarding and sign-in flows. The flaw affected QR-code-based setup scenarios in which a user scanned a legitimate Microsoft QR code with a mobile camera and opened the resulting link, enabling an attacker-controlled app to capture login data with little visible warning to the victim. Researchers reported that the issue could lead to full takeover of Microsoft accounts and downstream access to services including **Outlook, OneDrive, Teams, Office, and Skype**. Microsoft acknowledged the vulnerability, assigned a CVE, and mitigated the issue, while coverage warned that the bug could expose login codes for large numbers of users on both major mobile platforms. Users and organizations were advised to update Microsoft Authenticator and ensure proper verified app-link handling as the primary remediation.
Jun 29, 2026
Microsoft disclosed **"Dirty Stream"**, a path traversal-related vulnerability pattern in Android apps that accept shared files from other apps and trust filenames supplied by remote content providers. The flaw can let a malicious app overwrite files inside a target app’s private directory, creating paths to **arbitrary code execution**, theft of authentication tokens, and exposure of other sensitive data. Microsoft said the issue affected multiple popular Google Play apps with a combined install base exceeding **4 billion**. Microsoft highlighted vulnerable apps including **Xiaomi File Manager** and **WPS Office**, and demonstrated code execution in Xiaomi File Manager. The company said exploitation could also expose stored **SMB** and **FTP** credentials and enable access to local network shares beyond the device itself. Microsoft coordinated fixes with affected developers by February 2024 and worked with Google on developer guidance for safer Android file-sharing implementations, reinforcing the need for apps handling shared content to validate filenames and file paths before writing data.
Aug 15, 2026