Critical EngageLab SDK Vulnerability Exposed Millions of Android Crypto Wallet Users Security researchers at Microsoft Defender uncovered a severe vulnerability in the EngageLab SDK, a widely used third-party component embedded in Android applications, which posed a major risk to cryptocurrency wallet users. The flaw allowed malicious apps on the same device to bypass Android’s security sandbox, granting unauthorized access to sensitive data stored in crypto wallet apps. The vulnerability enabled attackers to: - Steal private keys from cryptocurrency wallets - Extract account credentials and transaction histories - Inject malicious code to manipulate transactions The issue stemmed from the SDK’s improper handling of inter-app data access, effectively undermining Android’s core sandboxing protections. Given the broad adoption of the EngageLab SDK across multiple apps, the flaw had the potential to expose users across the Android ecosystem simultaneously. Following Microsoft Defender’s disclosure, EngageLab released a patch to address the vulnerability. Developers integrating the SDK were urged to apply the fix immediately to prevent exploitation. The incident underscores the risks posed by third-party software components, particularly in applications managing high-value financial data.

Microsoft Uncovers EngageLab SDK Flaw Affecting 50 Million Android Devices Microsoft security researchers identified a critical intent redirection vulnerability in the EngageLab SDK, a widely used software development kit for Android apps. The flaw, discovered in April 2025, allowed malicious apps on the same device to bypass Android’s security sandbox and access private user data. The vulnerability affected version 4.5.4 of the SDK, with a patch released in November 2025 (version 5.2.1). At least 50 million Android devices had apps containing the bugged SDK, with 30 million installs tied to cryptocurrency applications, amplifying the potential risk. All vulnerable apps were subsequently removed from the Google Play Store. While Microsoft found no evidence of active exploitation before the flaw’s discovery, the incident highlights the supply-chain risks posed by third-party SDKs, particularly in high-value sectors like digital asset management. The case underscores how unvalidated trust assumptions in app integrations can lead to large-scale security exposures.