Back Securityaffairs.Co

EngageLab SDK flaw opens door to private data on 50M Android devices

Securityaffairs.Co •Pierluigi Paganini • April 10, 2026

A flaw in EngageLab SDK exposed up to 50M Android users, including 30M crypto wallets, letting apps bypass security and access private data. Microsoft researchers found a critical flaw in EngageSDK that lets apps bypass Android sandbox protections and access private data. The flaw put millions of users, including over 30M crypto wallet installs, at […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Critical Android SDK Vulnerability Exposes Millions of Crypto Wallets A significant vulnerability in the EngageLab SDK has left over 50 million Android users, including 30 million cryptocurrency wallet users, at risk of data theft. The flaw allows malicious applications to bypass Android's security sandbox, potentially exposing personally identifiable information (PII), authentication credentials, and sensitive financial data. Microsoft Defender's security research team reported that the vulnerability could be exploited by malicious apps installed on the same device, which could craft manipulated messages to gain unauthorized access to the wallet's private data. Fortunately, there is currently no evidence that this vulnerability has been actively exploited in the wild. Swift actions are being taken across the Android ecosystem to mitigate the threat, including patch deployment. The flaw is particularly concerning given the high value of the data stored in cryptocurrency wallets. Developers are urged to address this vulnerability promptly to protect user assets. 8 sources 52

Extracted Entities

EngageLab SDK flaw opens door to private data on 50M Android devices

The full story

Extracted Entities

Attack Types (1)

Companies (1)

Platforms (1)