Microsoft 365 Android Apps Let Any App Steal Account Tokens via Leftover Debug Flag
A development flag left enabled in production builds of six Microsoft 365 Android apps disabled the check that restricts account-token sharing to trusted Microsoft apps, letting any other app on the same phone request the signed-in user's token without a...