Tag: Microsoft 365 Android Apps

The check that restricts account-token sharing to trustworthy Microsoft applications was deactivated in production builds of multiple Microsoft 365 Android apps due to a development flag that was left enabled. In order to read emails, open files, view the calendar, and send messages as that user, any other app on the same phone could request and obtain the token of the logged-in user. No login screen, no password, and no need for permission. If you use Microsoft 365 apps on Android, please update them as Microsoft has corrected the issue. Word, PowerPoint, Excel, Microsoft 365 Copilot, Microsoft Loop, and OneNote were among the six programs with billions of downloads that were affected by the flaw, which Enclave refers to as FlagLeft. Enclave interprets this as a slip rather than...