Microsoft 365 Android Apps Let Any App Steal Account Tokens via Leftover Debug Flag

A debug flag left enabled in Microsoft 365 Android apps bypassed token-sharing security checks, allowing any app on the device to steal account tokens and access email, files, calendar, and messages.

• •Vulnerability called FlagLeft was caused by setIsDebugMode(true) left in production code within a shared Microsoft SDK
• •Affected six apps: Word, PowerPoint, Excel, Copilot, Loop, and OneNote with billions of downloads combined
• •Attackers could obtain FOCI refresh tokens that persist across app updates and allow long-term unauthorized access
• •Microsoft issued four CVEs with CVSS scores ranging from 4.4 to 7.7, patching through Google Play updates
• •Users should update affected apps and revoke refresh tokens to prevent unauthorized access from previously compromised devices