Critical Android SDK Vulnerability Exposes Millions of Crypto Wallets
Severity: Medium (Score: 51.9)
Sources: En.Bloomingbit, U.Today
Summary
A significant vulnerability in the EngageLab SDK has left over 50 million cryptocurrency wallet installations exposed to potential data theft. The flaw allows malicious applications to bypass Android's security sandbox, enabling them to access sensitive user data, including Personally Identifiable Information (PII) and financial credentials. Microsoft Defender Security Research Team identified that the vulnerability affects more than 30 million installations of third-party crypto wallet apps. Despite the severity of the flaw, there is currently no evidence that it has been exploited in the wild. The vulnerability stems from a component (MTCommonActivity) that was improperly exported, allowing malicious apps on the same device to gain unauthorized access. Swift mitigation efforts have been initiated across the Android ecosystem to address the threat. The incident highlights the ongoing risks associated with mobile-based wallets in the cryptocurrency sector. Key Points: • Over 50 million crypto wallet installations are at risk due to an Android SDK vulnerability. • The vulnerability allows malicious apps to access sensitive data by exploiting a specific SDK component. • No confirmed exploitation of the vulnerability has been reported to date.
Key Entities
- Data Breach (attack_type)
- Android (platform)
- Android SDK (platform)
- EngageLab SDK (platform)