Loading story…
Microsoft disclosed "Dirty Stream", a path traversal-related vulnerability pattern in Android apps that accept shared files from other apps and trust filenames supplied by remote content providers. The flaw can let a malicious app overwrite files inside a target app’s private directory, creating paths to arbitrary code execution, theft of authentication tokens, and exposure of other sensitive data. Microsoft said the issue affected multiple popular Google Play apps with a combined install base exceeding 4 billion.
Microsoft highlighted vulnerable apps including Xiaomi File Manager and WPS Office, and demonstrated code execution in Xiaomi File Manager. The company said exploitation could also expose stored SMB and FTP credentials and enable access to local network shares beyond the device itself. Microsoft coordinated fixes with affected developers by February 2024 and worked with Google on developer guidance for safer Android file-sharing implementations, reinforcing the need for apps handling shared content to validate filenames and file paths before writing data.
See affected versions and whether adversaries are exploiting it.
6 events from the most recent confirmed update back to the earliest known activity.
Microsoft publicly disclosed the 'dirty stream' attack as a common Android app vulnerability pattern that could lead to arbitrary code execution and theft of authentication tokens and other sensitive data. The company said the affected Google Play apps it identified represented more than four billion installs.
Microsoft said fixes had been deployed for the identified vulnerable apps by February 2024. Xiaomi addressed the issue in File Manager version V1-210593, and WPS Office addressed it as of version 17.0.0.
Microsoft collaborated with Google to publish guidance on the Android Developers website to help developers avoid trusting filenames supplied by remote content providers. The guidance recommended using generated filenames, sanitizing paths, and ensuring cached files stay within dedicated directories.
Microsoft achieved arbitrary code execution in WPS Office version 16.8.1 using the same vulnerability pattern involving untrusted filenames from remote content providers.
Microsoft achieved arbitrary code execution against Xiaomi File Manager version V1-210567 by exploiting the vulnerable file-handling pattern. It also found the app exposed stored SMB and FTP credentials, enabling potential access to local network shares through the compromised device.
Microsoft identified a path traversal-related vulnerability pattern in Android apps that process shared files from other apps, allowing malicious apps to overwrite files in a target app's private directory. Microsoft found the issue affected multiple popular Google Play apps, including Xiaomi File Manager and WPS Office.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
2 references tracked. Mallory keeps watching after this page renders.
developer.android.com
Open sourcemicrosoft.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Microsoft disclosed a severe **intent redirection** vulnerability in EngageLab’s third-party Android `EngageSDK` that could allow a malicious app on the same device to bypass Android sandbox protections and access sensitive data from affected apps. The flaw was tied to an exported activity, `MTCommonActivity`, which was introduced through the SDK into an app’s merged manifest and could process attacker-controlled intent URIs, causing intents to launch with the vulnerable app’s identity and permissions. Microsoft said the exposure was especially serious for cryptocurrency and digital wallet apps, with affected wallet applications alone accounting for more than **30 million installations**. Microsoft identified the issue in `EngageSDK` version `4.5.4`, reported it to EngageLab in April 2025, and escalated it to the Android Security Team in May 2025. EngageLab fixed the vulnerability in version `5.2.1`, released on November 3, 2025, while Google Play removed detected apps using vulnerable SDK versions and Android added automatic protections to mitigate the specific risk as developers update. Microsoft said it found **no evidence of in-the-wild exploitation**, but warned that insecure third-party mobile SDKs can create broad supply-chain exposure affecting more than **50 million app installations** overall.
Jun 29, 2026
Researchers at Enclave disclosed a vulnerability dubbed **FlagLeft** in six Microsoft 365 Android apps that allowed any co-installed third-party app to silently obtain valid Microsoft account tokens from a signed-in user. The flaw stemmed from a production debug setting, `setIsDebugMode(true)`, left enabled in a shared Microsoft SDK, which disabled the authorization check meant to ensure tokens were handed only to trusted Microsoft apps. Affected apps included **Word, PowerPoint, Excel, Microsoft 365 Copilot, Microsoft Loop, and OneNote**; **Teams** was reportedly not affected because its production debug flag was configured correctly. Because the apps relied on **FOCI** token sharing for single sign-on, a malicious Android app could potentially capture long-lived refresh tokens and access Microsoft services including **email, OneDrive files, calendars, and messaging functions** without a password, login prompt, or permission prompt. Microsoft confirmed the issue, assigned multiple CVEs—including four covering Copilot, Word, PowerPoint, and Excel with CVSS scores ranging from **4.4 to 7.7**—and shipped fixes through Google Play updates. Researchers said there was no public evidence of active exploitation before remediation, but warned that previously exposed refresh tokens may remain valid after app updates, making token revocation and verification of patched app versions important for affected organizations.
Jun 29, 2026
Microsoft disclosed **CVE-2026-42835**, an Important-severity information disclosure vulnerability in **Microsoft Teams for Android** that could allow a remote, authenticated low-privileged attacker to access small portions of heap memory without user interaction. The flaw, classified as **CWE-74** for improper neutralization of special elements in output used by a downstream component, carries a **CVSS 3.1 score of 8.1** and may expose sensitive runtime data including authentication tokens, session information, or cached credentials. Microsoft said the vulnerability was responsibly reported by **Ofek Levin of Enclave** through its coordinated disclosure program and has released a security update through the **Google Play Store**. The company stated that exploitation is considered less likely and that it had seen no public disclosure or evidence of active exploitation at the time of publication, but organizations using Teams for sensitive internal communications were urged to update affected Android clients promptly.
Jun 29, 2026