Microsoft 365 Android Apps Had a Token Flaw IT Teams Should Check Now
A debug flag left active in production code allowed another installed app on the same Android device to request Microsoft account tokens from Word, Excel, PowerPoint, OneNote, Microsoft Loop, and Microsoft 365 Copilot for Android without user interaction, according to research Enclave publicly disclosed on June 2, 2026. Microsoft patched the flaws and issued CVEs…
