The Microsoft Defender Security Research Team has made public a serious vulnerability in the EngageLab SDK, which is a third-party Android SDK for Push Notifications and User Engagement. The vulnerability would have allowed malicious apps installed on the same device to access sensitive private data by bypassing Android's security sandbox.
The EngageLab SDK was integrated into multiple applications, especially in the cryptocurrency and digital wallet space. Microsoft's assessment of the situation indicates that there are over 30 million installations of wallet applications which used the SDK in question. If all other non-wallet applications utilizing the SDK are included in the assessment, there were over 50 million total installation of the SDK.
The EngageLab vulnerability is identified as "Intent Redirection". Intents are used to convey messaging objects between app components and request some form of action to occur. Any app running on an Android device which does not properly implement the handling of an Intent could have the potential to be exploited by a malicious app which would allow for a third party to access a protected component or data which belongs to another application.
After being informed of the issue by Microsoft in April 2025, EngageLab released version 5.2.1 of the SDK, and all identified installations of affected applications have been removed from the Google Play store.
Currently, there is no sign that this vulnerability has been exploited in real life. However, the effect could be extreme for those who use cryptocurrencies and were able to find their wallets (as there is a risk that wallet recovery phrases or private keys may be disclosed).
Why It Matters
This incident is representative of a larger risk in mobile, third-party SDK supply chain risks. Many app creators utilize some form of third-party library for things like push notifications, analytics or other user engagement. Any weakness in the SDKs being used introduce one significant point of failure that can propagate to affect millions of users across multiple applications.
As Microsoft stated, when weaknesses in upstream SDKs are utilized, it is also likely that there may be cascading impacts from those issues into higher dollar sectors (like digital asset management, where financial data is sensitive).
Recommendations for Developers and Users
For App Developers:
1. Verify your app uses the EngageLab SDK and update to version 5.2.1 or later right away.
2. Review third-party SDK's for any currently known vulnerabilities and maintain an up to date list of all of your app’s third-party dependencies.
3. When integrating external libraries always observe the principle of least privilege.
4. Audit the permissions and exported components in the app on a regular basis.
For End Users:
1. Users should only use the Google Play Store to upgrade their application.
2. Be careful when allowing access to apps with access to photos, (Gallery) or storage, (wallet and financial apps).
3. Users of mobile devices should seriously consider using hardware wallets for their large amounts of cryptocurrency that may help reduce the risk associated with the loss/ theft of a device containing large amounts of crypto currency.
This incident is a reminder of the potential for serious security issues to occur in the software supply chain, even from very small parts in that chain. In the rapidly evolving world of mobile and cryptocurrency applications, maintaining strong supply chain security hygiene is more important than ever.
And if you work for an org that is either developing or using Android apps that rely on third-party SDK’s, be sure to periodically review the status of your dependency management practices and confirmation all your components are up-to-date.
Source: The Hacker News
