# Debug Flag Left in Production: Microsoft 365 Android Apps Expose Account Tokens to Any Installed App
## The Threat
Microsoft shipped a development debugging flag enabled in production builds of six of its most widely used Android applications, creating a vulnerability that allows any malicious app already installed on a device to steal valid account authentication tokens without triggering a password prompt, permission dialog, or any visible notification to the user.
The flaw centers on a single line of code—setIsDebugMode(true)—that disabled a critical security check governing how Microsoft 365 apps share account access. When a user signs into Word on Android, they shouldn't have to sign in again to PowerPoint or Excel; instead, the apps use a token-sharing mechanism to maintain seamless single sign-on across the Microsoft ecosystem. That handoff is supposed to verify that only trusted Microsoft applications can request these tokens. The debug flag bypassed this verification entirely, opening a window for any third-party app on the same device to request and obtain valid authentication tokens.
The vulnerability lived in a shared Microsoft SDK, meaning the same flaw cascaded across Word, PowerPoint, Excel, Microsoft 365 Copilot, Loop, and OneNote—six applications collectively accounting for billions of downloads. An attacker with a malicious app installed on a victim's device could extract FOCI tokens (family-of-client-IDs refresh tokens) that remain valid for extended periods and can be refreshed repeatedly without re-authentication. With a stolen token, the attacker gains the ability to read the victim's email, access OneDrive files, browse calendar entries, and send messages—all while the device owner remains completely unaware that their account has been compromised. No phishing required. No credential theft. No user interaction of any kind.
## Severity and Impact
| Field | Details |
|-------|---------|
| CVE IDs | CVE-2026-41100 (Copilot), CVE-2026-41101 (Word), CVE-2026-41102 (PowerPoint), CVE-2026-42832 (Excel) |
| CWE | CWE-284: Improper Access Control |
| CVSS Scores | 4.4 (Copilot) / 7.1 (Word, PowerPoint) / 7.7 (Excel) |
| CVSS Vector | CVSS:3.1/AV:L/PR:L/AU:N/C:H/I:L/A:N |
| Attack Complexity | Low |
| Authentication Required | No (attacker merely needs pre-installed malicious app) |
| User Interaction | None |
| Scope of Impact | Confidentiality High, Integrity Low, Availability None |
| Affected Versions | Word for Android < 16.0.19822.20190; all earlier builds of PowerPoint, Excel, Copilot, Loop, OneNote |
| Patch Date | May 12, 2026 (via Google Play) |
The classification as a "local spoofing" vulnerability undersells the practical risk. While the attack does require that a malicious app be present on the device, Android's open ecosystem means users frequently install third-party applications from unknown developers, side-load apps, or receive trojans disguised as legitimate software. The prerequisite is not as high a bar as it might sound.
## Affected Products
Microsoft 365 Suite (Android):
All versions prior to the May 12, 2026 patch are affected. Microsoft Teams shipped with the debug flag set to false and was not impacted, suggesting this was a configuration slip rather than an architectural flaw.
## Mitigations
Immediate Actions:
Post-Patch Remediation:
Prevention:
## References
---
## HackWire Analysis
This vulnerability is a textbook example of how a single line of debugging code can cascade into a billion-device security incident. The fact that the debug flag lived in a shared SDK compounds the risk—one mistake propagated across six applications simultaneously. But what's more telling is that Teams shipped with the same flag set correctly, which tells us this was not an architectural oversight or a deliberate security-by-design choice. It was a configuration mistake that slipped through code review, testing, and multiple release cycles before security researchers at Enclave caught it.
The timing is worth noting. We're in mid-2026, and this vulnerability has already been patched for nearly a month. But patch adoption on Android remains notoriously slow—enterprise users often lag 30-60 days behind, and consumer users frequently never apply updates at all. For attackers, this window is golden. A malicious app distributed through the Google Play Store, alternative app markets, or direct download links could silently extract tokens from millions of devices running vulnerable builds. The attacker's payload doesn't need to be flashy or obvious; it just needs to exist on the device and make a single API call to steal the tokens.
What's missing from most coverage of this issue: FOCI tokens are designed to be long-lived. They survive app uninstalls and updates, and they can be refreshed indefinitely without fresh authentication. An attacker who extracts a FOCI token can use it long after the patch is deployed on the victim's device—potentially for months or years, until the token naturally expires or the account owner manually revokes it. This means organizations that pushed the patch but didn't revoke existing tokens may have a false sense of security.
The broader pattern is troubling. We've seen development flags left in production code before—it's a recurring vulnerability class. It usually signals insufficient automation in the build and release process: no gates that flag setIsDebugMode(true) as a violation, no difference between debug and release builds, and no enforcement of secure defaults. For organizations deploying to mobile platforms with billions of users, that's a control that should be non-negotiable.
— HackWire Editorial
---
## Related Coverage