Loading story…
Microsoft disclosed CVE-2026-42835, an Important-severity information disclosure vulnerability in Microsoft Teams for Android that could allow a remote, authenticated low-privileged attacker to access small portions of heap memory without user interaction. The flaw, classified as CWE-74 for improper neutralization of special elements in output used by a downstream component, carries a CVSS 3.1 score of 8.1 and may expose sensitive runtime data including authentication tokens, session information, or cached credentials.
Microsoft said the vulnerability was responsibly reported by Ofek Levin of Enclave through its coordinated disclosure program and has released a security update through the Google Play Store. The company stated that exploitation is considered less likely and that it had seen no public disclosure or evidence of active exploitation at the time of publication, but organizations using Teams for sensitive internal communications were urged to update affected Android clients promptly.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
3 events from the most recent confirmed update back to the earliest known activity.
Microsoft disclosed that CVE-2026-42835 is a CWE-74 injection issue in Teams for Android that could let an authenticated low-privileged attacker remotely disclose small portions of heap memory without user interaction. Microsoft rated the flaw CVSS 8.1, assessed exploitation as less likely, and said no public disclosure or active exploitation had been observed at the time of reporting.
Microsoft said the Teams for Android information disclosure flaw CVE-2026-42835 was responsibly disclosed by Ofek Levin of Enclave through Microsoft's coordinated vulnerability disclosure program.
On 2026-06-09, Microsoft released an Important-severity security update for Microsoft Teams for Android addressing CVE-2026-42835. The update was made available through the Google Play Store.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Microsoft disclosed and patched **CVE-2026-32185**, an **Important** spoofing vulnerability in **Microsoft Teams for Android** caused by improper access to files or directories, mapped to `CWE-552`. The flaw could allow an unauthorized **local attacker** to spoof trusted elements in the app and potentially trick users into accepting malicious content or communications. Microsoft assigned the issue a **CVSS 3.1 score of 5.5** and said exploitation requires local access and user interaction, but could still have a high confidentiality impact. Microsoft said the vulnerability was **not publicly disclosed**, **not exploited in the wild**, and had **no public proof-of-concept** at the time of publication, with exploitation assessed as less likely. The company released a fix through the **Google Play Store** and advised users to update **Microsoft Teams for Android** to version **`1.0.0.2026092103` or later**. Microsoft credited **Ofek Levin of Enclave** with responsibly reporting the issue.
Jun 29, 2026
Researchers at Check Point disclosed four critical vulnerabilities in Microsoft Teams that allowed attackers to impersonate executives, alter chat history, and forge notifications or caller identities without detection. These flaws, now patched, enabled manipulation of message content without the usual 'Edited' label, spoofing of alerts to appear from trusted colleagues, and renaming of chats to misrepresent participants. The vulnerabilities exploited Teams' messaging architecture, including the reuse of unique message identifiers and manipulation of hidden conversation parameters, fundamentally undermining the trust in digital communications for over 320 million monthly users. Microsoft was notified of the issues in March 2024 and addressed them through a series of patches, with the final fix released in October 2025. The vulnerabilities, tracked as CVE-2024-38197 among others, affected both internal users and external guests, posing significant risks of social engineering, data theft, and unauthorized actions. Attackers could trick users into clicking malicious links or sharing sensitive information by making messages and calls appear to originate from high-profile executives or trusted sources, highlighting the importance of prompt patching and ongoing vigilance in collaboration platforms.
Jun 29, 2026
Researchers at Enclave disclosed a vulnerability dubbed **FlagLeft** in six Microsoft 365 Android apps that allowed any co-installed third-party app to silently obtain valid Microsoft account tokens from a signed-in user. The flaw stemmed from a production debug setting, `setIsDebugMode(true)`, left enabled in a shared Microsoft SDK, which disabled the authorization check meant to ensure tokens were handed only to trusted Microsoft apps. Affected apps included **Word, PowerPoint, Excel, Microsoft 365 Copilot, Microsoft Loop, and OneNote**; **Teams** was reportedly not affected because its production debug flag was configured correctly. Because the apps relied on **FOCI** token sharing for single sign-on, a malicious Android app could potentially capture long-lived refresh tokens and access Microsoft services including **email, OneDrive files, calendars, and messaging functions** without a password, login prompt, or permission prompt. Microsoft confirmed the issue, assigned multiple CVEs—including four covering Copilot, Word, PowerPoint, and Excel with CVSS scores ranging from **4.4 to 7.7**—and shipped fixes through Google Play updates. Researchers said there was no public evidence of active exploitation before remediation, but warned that previously exposed refresh tokens may remain valid after app updates, making token revocation and verification of patched app versions important for affected organizations.
Jun 29, 2026