EngageSDK Flaw Exposes 50 Million Android Users to Data Theft

Microsoft Defender found a severe intent redirection vulnerability in the widely used EngageSDK (formerly EngageLab) for Android that could let a co-resident malicious app trick MTCommonActivity to access private app storage. The flaw impacted over 30 million crypto wallet installs and more than 50 million total app installations, risking PII, credentials, and financial data. EngageSDK 5.2.1 (released 2025-11-03) fixes the issue by setting the activity to non-exported; Microsoft reported no known exploitation in the wild and affected apps were removed from Google Play.