Microsoft 365 Android Apps Exposed Billions to Silent Account Takeover via "FlagLeft" Vulnerability A critical vulnerability in Microsoft’s Android apps dubbed FlagLeft exposed billions of users to silent account takeovers by granting unauthorized access to Microsoft account tokens. The flaw, discovered in production code, stemmed from a single overlooked debug flag (`setIsDebugMode(true)`) left active in six major Microsoft 365 apps, including LinkedIn. The issue allowed any third-party app on the same Android device to request and receive valid Microsoft account tokens without user interaction, login prompts, or notifications. No consent or additional permissions were required, making the attack undetectable to end users. The vulnerability affected a vast user base, as the impacted apps collectively serve billions of Android devices. Microsoft has since addressed the flaw, but the incident underscores the risks of overlooked debug configurations in production environments. The root cause a simple yet consequential oversight highlights the importance of rigorous code review in security-critical applications.