Microsoft: Third-Party Android Vulnerability Leaves Over 50M Users Exposed

A critical intent-redirection vulnerability in the widely used EngageLab Android SDK allowed unprivileged, malicious apps to send crafted intents to exported SDK components and have those intents executed with the host app’s permissions, risking access to private files and exfiltration of sensitive data (notably crypto wallet keys). Microsoft discovered the flaw, coordinated disclosure with EngageLab (patch v5.2.1) and Android/Google removed flagged apps; over 50 million installs were affected but no known in-the-wild exploitation had been observed as of April 9, 2026.