Microsoft patched high-severity flaw CVE-2026-80097 (CVSS 8.6) in Authenticator for Android, allowing malicious apps with no declared permissions to steal work account access tokens due to improper authentication in its broker component. Microsoft classified the flaw as a local elevation-of-privilege vulnerability. The issue affected Android devices with Microsoft Authenticator installed and a signed-in work account. […]
This article has been indexed from Cyber Security News
Read the original article:
Microsoft Authenticator Flaw Lets Malicious Android Apps Steal Account Tokens With Zero Permissions