What the Microsoft 365 Android Vulnerability Was
The Microsoft 365 Android vulnerability was a debug-flag mistake in several popular Microsoft 365 mobile apps that turned off token-sharing checks, letting any installed Android app request and receive powerful account tokens without user interaction, passwords, or permissions, putting email, files, and calendars at risk of silent compromise. In normal operation, Microsoft 365 Android apps share account tokens only with other trusted Microsoft apps so users enjoy single sign-on across Word, Excel, and PowerPoint. Enclave researchers found that a single line, setIsDebugMode(true), left in production builds disabled this trust check. As a result, an untrusted app on the same device could ask for the signed-in user’s token and use it to read email, open files, browse the calendar, or send messages. Microsoft has now shipped a Microsoft security patch, but affected users and IT teams still have work to do.
How Android Token Theft Became Possible
The flaw sat inside a shared Microsoft software development kit used by multiple Microsoft 365 Android apps. When the debug mode flag was enabled, the SDK skipped the verification that should confirm only trusted Microsoft apps receive account tokens. Enclave’s proof-of-concept showed that a third-party Android app, with no special permissions, could quietly request tokens from Word, Excel, PowerPoint, OneNote, Microsoft Loop, or Microsoft 365 Copilot. These were FOCI tokens, a token family designed for cross-app access within Microsoft’s ecosystem and intended to support long-lived single sign-on sessions. Because FOCI tokens refresh and their traffic looks normal, stolen tokens could enable persistent access that blends into routine logs. According to Enclave’s research, a malicious app update could pull tokens in the background, giving an attacker email or document access without passwords, login prompts, or suspicious permission dialogs.
Which Microsoft 365 Android Apps Were Affected and Patched
Six Microsoft 365 Android apps were exposed: Word, PowerPoint, Excel, Microsoft 365 Copilot, Microsoft Loop, and OneNote. Teams used the same SDK but shipped with the flag set correctly and was not affected. On May 12, Microsoft issued a Microsoft security patch and assigned four CVEs: CVE-2026-41100 for Microsoft 365 Copilot, CVE-2026-41101 for Word, CVE-2026-41102 for PowerPoint, and CVE-2026-42832 for Excel and Office on Android. NVD lists the fixed Word build as 16.0.19822.20190, with earlier versions vulnerable, and the other apps received updated builds through Google Play on the same timeline. Public advisories state that no in-the-wild exploitation has been confirmed so far, but now that the technical details are out, the window for Android token theft attempts is open unless devices are updated.
Risks for Account Token Security and Persistent Access
The core risk is account token security: once a malicious app steals FOCI refresh tokens, attackers can reuse or refresh them over long periods. Because these tokens are meant for seamless single sign-on across Microsoft 365 apps, their use appears as routine traffic, making detection harder in everyday log reviews. Depending on which app issued the token, an attacker might gain access to email, SharePoint or OneDrive files, calendar data, Office documents, or Copilot-enhanced workflows that may handle highly sensitive information. The flaw is classified as a local spoofing issue, meaning the attacker must already have a malicious or compromised Android app installed on the device. However, in environments with many unmanaged phones and generous third-party app policies, the combination of easy installation and silent token theft can lead to persistent account compromise even after users update their apps.
Actions for Users and IT Teams to Verify Patches
End users should open Google Play and update Word, PowerPoint, Excel, Microsoft 365 Copilot, Loop, and OneNote immediately to reduce exposure to the Microsoft 365 Android vulnerability. After updating, they should watch for suspicious account activity, such as unexpected sign-in alerts, unknown devices, or unusual emails sent from their account. For higher-risk accounts, consider signing out on all devices and re-authenticating. IT teams need to confirm that all managed Android devices run patched app versions, ideally at or beyond Word build 16.0.19822.20190, and use mobile device management to enforce Microsoft security patch deployment. Where old builds ran alongside untrusted apps, administrators should revoke refresh tokens and require new sign-ins. They should also review third-party app policies on Android, tighten installation rules where possible, and add mobile app governance checks to existing Microsoft 365 identity and access reviews.
