Microsoft Uncovers EngageLab SDK Flaw in 50M Android Apps

Microsoft security researchers have uncovered a critical vulnerability in the EngageLab SDK, a widely used third-party tool for Android apps that could have allowed malicious software to bypass core device protections and access sensitive user data on more than 50 million installations.

The flaw, identified in version 4.5.4 of the SDK, involved an intent redirection issue that enabled one app to manipulate communications with another, exploiting the trusted permissions of vulnerable applications. According to the Microsoft Defender Security Research Team, this stemmed from an exported component called MTCommonActivity, which was automatically included in app builds but left accessible to other programs on the same device. A malicious app could send a crafted intent to a vulnerable one, tricking it into granting unauthorized read and write access to private files, including personally identifiable information, user credentials, and financial details stored in app directories.

The vulnerability particularly threatened cryptocurrency and digital wallet apps, which accounted for over 30 million of the affected installations. EngageLab, which provides the SDK for push notifications...