Debug-Mode Flaw in Six Microsoft Android Apps Could Expose Account Tokens
Summary
Enclave found a debug-mode flaw in six Microsoft Android apps that could let other apps obtain access tokens. Microsoft confirmed and fixed the flaws, assigning three CVEs; users should update their apps.
Key points
- Enclave found the same debug-mode setting enabled in Word, PowerPoint, Excel, Microsoft 365 Copilot, Microsoft Loop and OneNote for Android.
- The setting bypassed a restriction intended to prevent non-Microsoft apps from receiving Microsoft access tokens.
- Enclave said a malicious or modified Android app could request a token; the article describes potential access to data exposed through the affected app context.
- Microsoft confirmed and fixed the flaws, assigning CVE-2026-41100, CVE-2026-41101 and CVE-2026-41102.
- Patches were distributed through Microsoft's Patch Tuesday mechanism; the PowerPoint fix was also released as a patched build through Google Play on May 12.
- The article reports no confirmed exploitation and says users should be protected if their apps are up to date.
Article Details
- Vulnerability Types
- Debug-mode misconfiguration that bypassed restrictions on sharing access tokens with untrusted Android apps
- Access-control bypass exposing Microsoft access tokens to requesting apps
- Exploitation Status
- unknown
- Exploit Availability
- unknown
- Patch Status
- available
MITRE ATT&CK
T1195.002 · Compromise Software Supply ChainYanir Tsarimi described a hypothetical scenario in which malicious code is included in an app update and delivered to users.T1528 · Steal Application Access TokenIn the described potential attack, a malicious Android app requests and obtains an access token from an affected Microsoft app.T1550.001 · Application Access TokenThe article says stolen Microsoft access tokens could be reused to act through the associated Microsoft account.
CVE
People
Vendors
Products
AndroidSix Microsoft 365 Android apps contain an identical flaw that could risk billions of downloads being compromised.ExcelIt is nothing more than a single debug flag being left in the production code of Word, PowerPoint, Excel, Microsoft 365 Copilot, Microsoft Loop and OneNote for Android.Microsoft 365 CopilotIt is nothing more than a single debug flag being left in the production code of Word, PowerPoint, Excel, Microsoft 365 Copilot, Microsoft Loop and OneNote for Android.Microsoft LoopIt is nothing more than a single debug flag being left in the production code of Word, PowerPoint, Excel, Microsoft 365 Copilot, Microsoft Loop and OneNote for Android.Microsoft Office OneNoteIt is nothing more than a single debug flag being left in the production code of Word, PowerPoint, Excel, Microsoft 365 Copilot, Microsoft Loop and OneNote for Android.Microsoft PowerPointIt is nothing more than a single debug flag being left in the production code of Word, PowerPoint, Excel, Microsoft 365 Copilot, Microsoft Loop and OneNote for Android.WordIt is nothing more than a single debug flag being left in the production code of Word, PowerPoint, Excel, Microsoft 365 Copilot, Microsoft Loop and OneNote for Android.