Microsoft 365 Android Apps Exposed Billions to Silent Account Takeover via "FlagLeft" Vulnerability
A critical vulnerability in Microsoft’s Android apps dubbed FlagLeft exposed billions of users to silent account takeovers by granting unauthorized access to Microsoft account tokens. The flaw, discovered in production code, stemmed from a single overlooked debug flag (setIsDebugMode(true)) left active in six major Microsoft 365 apps, including LinkedIn.
The issue allowed any third-party app on the same Android device to request and receive valid Microsoft account tokens without user interaction, login prompts, or notifications. No consent or additional permissions were required, making the attack undetectable to end users.
The vulnerability affected a vast user base, as the impacted apps collectively serve billions of Android devices. Microsoft has since addressed the flaw, but the incident underscores the risks of overlooked debug configurations in production environments. The root cause a simple yet consequential oversight highlights the importance of rigorous code review in security-critical applications.
Source: https://www.linkedin.com/feed/update/urn:li:activity:7468096691263614976
Microsoft TPRM report: https://www.rankiteo.com/company/microsoft-365
LinkedIn TPRM report: https://www.rankiteo.com/company/linkedin
"id": "linmic1780539842",
"linkid": "linkedin, microsoft-365",
"type": "Vulnerability",
"date": "6/2026",
"severity": "85",
"impact": "4",
"explanation": "Attack with significant impact with customers data leaks"{'affected_entities': [{'customers_affected': 'Billions of Android users',
'industry': 'Software/Cloud Services',
'location': 'Global',
'name': 'Microsoft',
'size': 'Large (billions of users)',
'type': 'Technology Company'}],
'attack_vector': 'Third-party app on the same Android device',
'data_breach': {'personally_identifiable_information': 'Potentially (if '
'tokens were used to '
'access PII)',
'sensitivity_of_data': 'High (could lead to full account '
'access)',
'type_of_data_compromised': 'Authentication tokens (Microsoft '
'account tokens)'},
'description': 'A critical vulnerability in Microsoft’s Android apps dubbed '
'*FlagLeft* exposed billions of users to silent account '
'takeovers by granting unauthorized access to Microsoft '
'account tokens. The flaw, discovered in production code, '
'stemmed from a single overlooked debug flag '
'(`setIsDebugMode(true)`) left active in six major Microsoft '
'365 apps, including LinkedIn. The issue allowed any '
'third-party app on the same Android device to request and '
'receive valid Microsoft account tokens without user '
'interaction, login prompts, or notifications. No consent or '
'additional permissions were required, making the attack '
'undetectable to end users.',
'impact': {'brand_reputation_impact': 'Potential reputational damage due to '
'silent account takeover risk',
'data_compromised': 'Microsoft account tokens',
'identity_theft_risk': 'High (unauthorized access to Microsoft '
'accounts)',
'systems_affected': 'Six major Microsoft 365 Android apps, '
'including LinkedIn'},
'investigation_status': 'Resolved (vulnerability patched)',
'lessons_learned': 'Overlooked debug configurations in production '
'environments can lead to critical security '
'vulnerabilities. Rigorous code review is essential for '
'security-critical applications.',
'post_incident_analysis': {'corrective_actions': 'Debug flag removed from '
'production code; '
'vulnerability patched',
'root_causes': 'Single overlooked debug flag '
'(`setIsDebugMode(true)`) left '
'active in production code'},
'recommendations': 'Implement strict code review processes, disable debug '
'flags in production, and conduct regular security audits '
'of mobile applications.',
'response': {'containment_measures': 'Vulnerability patched by Microsoft',
'remediation_measures': 'Debug flag removed from production '
'code'},
'title': 'Microsoft 365 Android Apps Exposed Billions to Silent Account '
"Takeover via 'FlagLeft' Vulnerability",
'type': 'Account Takeover',
'vulnerability_exploited': 'Debug flag (`setIsDebugMode(true)`) left active '
'in production code'}