Critical Microsoft 365 Android App Flaw Allowed Account Takeovers

Key Takeaways

• A critical vulnerability, dubbed “FlagLeft,” in a shared Microsoft SDK for Android apps allowed unauthorized account takeovers.
• The flaw affected Microsoft Word, PowerPoint, Excel, Microsoft 365 Copilot, Microsoft Loop, and OneNote on Android, potentially exposing billions of users.
• The root cause was a forgotten debug flag, setIsDebugMode(true), left active in production code, which bypassed critical authorization checks.
• Exploitation allowed any co-installed app to silently obtain long-lived Microsoft account tokens without user interaction or consent.
• Microsoft has released patches for all affected applications, and users are urged to update immediately.

Microsoft 365 Android Apps Exposed to Account Takeover Due to Forgotten Debug Flag

A significant security flaw, originating from a single overlooked development flag, recently jeopardized billions of Microsoft 365 users on Android devices. This critical vulnerability enabled unauthorized account takeovers across six core Microsoft 365 applications by silently granting Microsoft account tokens to any application installed on the same Android device, requiring no user interaction or explicit consent.

Dubbed “FlagLeft,” the vulnerability permitted any third-party application residing on an Android device to surreptitiously request and acquire valid Microsoft account tokens. This process occurred without triggering any login prompts, permission requests, or notifications to the user, making exploitation difficult to detect.

The underlying cause was surprisingly straightforward: a single line of debug code, specifically setIsDebugMode(true), remained enabled within the production builds of the affected applications. This active debug flag effectively disabled the authorization mechanism intended to ensure that only trusted Microsoft applications could request account tokens from other Microsoft applications on the same device.

The vulnerability was confirmed to impact Microsoft Word, PowerPoint, Excel, Microsoft 365 Copilot, Microsoft Loop, and Microsoft OneNote on the Android platform. Notably, Microsoft Teams remained unaffected, as its corresponding debug flag was correctly set to false in its production release. The widespread impact stemmed from the vulnerable flag’s presence within a shared Microsoft SDK, causing the flawed code to propagate across all six applications simultaneously.

The Mechanics of the Flaw: Bypassing FOCI Trust

Microsoft 365 applications leverage a token-sharing framework known as FOCI (Family of Client IDs) to facilitate seamless single sign-on experiences across the suite. This legitimate design allows users to log into one application, such as Word, and automatically gain access to others like PowerPoint or Excel without needing to re-authenticate.

However, the persistent setIsDebugMode(true) flag critically bypassed the essential trust verification step designed to differentiate legitimate Microsoft applications from untrusted third-party apps. Consequently, with debug mode active, any co-installed application could mimic a legitimate Microsoft app’s token request and receive full FOCI tokens in return.

These compromised tokens posed a severe risk due to their characteristics: they are long-lived, refreshable, and their usage generates no suspicious activity in system logs, appearing as entirely normal traffic. An attacker exploiting this flaw could silently perform a range of malicious activities under the victim’s identity, including reading emails, accessing OneDrive files, sending messages, and viewing calendar data.

Microsoft Security Response Center (MSRC) acknowledged and subsequently patched all reported issues, assigning multiple CVEs. CVE-2026-41100, impacting Microsoft 365 Copilot for Android, received a CVSS score of 4.4 (Medium). CVE-2026-41101 for Word for Android and CVE-2026-41102 for PowerPoint for Android were both rated 7.1 (High). The broader Microsoft Office for Android vulnerability was assigned a CVSS score of 7.7 (Important). All identified issues fall under CWE-284 Improper Access Control and were publicly disclosed on May 12, 2026.

Impact and Remediation

Researchers at Enclave, alongside Ofek Levin, were instrumental in uncovering this critical flaw embedded within a shared Microsoft SDK utilized by numerous Microsoft 365 Android applications. The combined install base of the six affected applications spans billions of Android devices globally, meaning every signed-in user was potentially vulnerable to silent token theft by any co-installed malicious application, with no observable indicators of compromise on the user’s device.

Microsoft has since released patches for all six affected applications. It is imperative that users update Word, PowerPoint, Excel, Microsoft 365 Copilot, Microsoft Loop, and OneNote to their latest Android versions without delay. Enterprise Mobile Device Management (MDM) administrators are advised to confirm the deployment of these patched versions across all managed devices and to audit OAuth token activity within Microsoft Defender for Cloud Apps for any unusual behavior.

This incident serves as a stark reminder of how a seemingly minor development artifact, such as a single boolean flag, can profoundly compromise an entire authentication trust model when inadvertently released into production. The vulnerability was not inherent in the FOCI token-sharing design itself, but rather in the absent gatekeeper meant to control access to it. Because the code was shared via an SDK, a single oversight instantly affected six major applications and billions of users concurrently. Enclave’s AI-assisted variant analysis played a crucial role in swiftly mapping the full extent of this vulnerability across the entire Microsoft 365 Android portfolio.

What You Should Do

• Update Immediately: Ensure all Microsoft 365 Android applications (Word, PowerPoint, Excel, Microsoft 365 Copilot, Microsoft Loop, OneNote) are updated to their latest versions from the Google Play Store.
• Review Installed Apps: Exercise caution when installing third-party applications on your Android device, especially those that might request extensive permissions.
• Enterprise Administrators: Verify that all managed devices have received and installed the necessary updates.
• Monitor for Anomalies: Enterprise security teams should monitor OAuth token activity in Microsoft Defender for Cloud Apps for any suspicious or anomalous behavior.
• Educate Users: Remind users about the importance of keeping all applications updated and the risks associated with installing untrusted apps.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.