Microsoft patches Authenticator flaw (CVE-2026-80097, CVSS 8.6) letting zero-permission apps steal tokens
basedjensen · x · 2026-10-26
Microsoft patched a high-severity flaw, CVE-2026-80097 (CVSS 8.6), in Microsoft Authenticator for Android that let malicious apps with zero declared permissions steal work-account access tokens due to improper authentication in its broker component.
Enclave researchers found the exported AccountChooserActivity accepted broker requests from untrusted apps: malware could impersonate trusted Microsoft apps like Teams to obtain delegated tokens without user approval, credentials, or extra permissions. Classified as local elevation-of-privilege; affected devices with Authenticator and a signed-in work account.
More from Safety
- UK launches £165m AI biosecurity initiative with world-first £100m lab, DeepMind partners — pushmeet · 2026-10-26
- Claude Code audit finds 214,856 "permanently deleted" photos lurking in Android hidden cache — Loo_Atreides · 2026-10-26
- CNN: AI is exposing how fragile the web really is — and what users can do about it — cnn · 2026-10-26
- IIT Madras hosts AI Governance conclave with 400+ attendees on responsible AI — ravi_iitm · 2026-10-26
- “CIA watching everyone patch ‘security vulnerabilities’” goes viral — tekbog · 2026-10-26
- Weight-tampering worm scenario for near-frontier models called 'somewhat scary' — teortaxesTex · 2026-10-26