Microsoft 365 Android Apps Let Any App Steal Account Tokens via Leftover Debug Flag

Exclusive: How One Line of Code Put Billions of Microsoft Android App Downloads at Risk

A debug flag in 6 Microsoft Android apps (Word, PowerPoint, Excel, Copilot, Loop, OneNote) exposed token theft: any installed app could steal FOCI credentials that provide full access to Microsoft account data. Supply chain attack vector via auto-updated malware. Governance failure—debug mode shipped to production across major apps. Microsoft patched CVE-2026-41100/41101/41102 May 12; users must update.