EngageLab Android SDK Flaw Exposed 50 Million Apps to Intent Redirection Risk

Microsoft disclosed a severe intent redirection vulnerability in EngageLab’s third-party Android EngageSDK that could allow a malicious app on the same device to bypass Android sandbox protections and access sensitive data from affected apps. The flaw was tied to an exported activity, MTCommonActivity, which was introduced through the SDK into an app’s merged manifest and could process attacker-controlled intent URIs, causing intents to launch with the vulnerable app’s identity and permissions. Microsoft said the exposure was especially serious for cryptocurrency and digital wallet apps, with affected wallet applications alone accounting for more than 30 million installations.

Microsoft identified the issue in EngageSDK version 4.5.4, reported it to EngageLab in April 2025, and escalated it to the Android Security Team in May 2025. EngageLab fixed the vulnerability in version 5.2.1, released on November 3, 2025, while Google Play removed detected apps using vulnerable SDK versions and Android added automatic protections to mitigate the specific risk as developers update. Microsoft said it found no evidence of in-the-wild exploitation, but warned that insecure third-party mobile SDKs can create broad supply-chain exposure affecting more than 50 million app installations overall.