Millions of Android Devices Exposed by SDK Flaw

A critical vulnerability within the EngageLab SDK, a tool for app engagement features, has impacted an estimated 50 million Android devices. Microsoft researchers discovered an "intent redirection vulnerability" that enabled apps to circumvent Android's security sandbox, granting unauthorized access to sensitive private data. This flaw presented a significant risk, especially given that at least 30 million of the affected installations were cryptocurrency apps.

The vulnerability was identified in April 2025 and subsequently patched in version 5.2.1 of the SDK in November of the same year. Google removed all applications utilizing the compromised SDK from its Play Store. While Microsoft reported no evidence of this flaw being exploited as a zero-day attack, developers are strongly urged to update to the latest SDK version immediately. This incident highlights the widespread security implications stemming from third-party SDK weaknesses, particularly within high-value sectors like digital asset management, underscoring the growing supply-chain risks in app development.