A critical vulnerability in a popular Android communication library recently exposed millions of digital asset holders to severe data theft risks.
Security researchers discovered a redirect flaw in EngageSDK, a widely used third-party tool for managing push notifications.
This weakness allowed malicious apps installed on the same device to bypass the Android security sandbox and quietly steal private data, including user credentials and financial information.
The scale of the exposure was massive. More than 30 million installations of cryptocurrency wallet applications relied on vulnerable versions of the SDK, affecting more than 50 million installations across various app categories.
How The Exploit Works
The root of the problem lies in how EngageSDK handles background activities.
When developers import the library, the exported activity MTCommonActivity is automatically added to the application’s merged manifest during the build process.
Because this happens post-build, many developers miss it entirely, leaving the activity publicly accessible to other apps on the user’s device.
Once exposed, a malicious app can send a specially crafted message, known as an intent, to this vulnerable activity.
The activity processes the incoming data and extracts a URI string to create a new intent. Crucially, it processes this using an unsafe flag that grants permissions that should normally be heavily restricted.
Instead of creating a benign, system-resolved action, the SDK generates an explicit intent that runs with the victim application’s trusted privileges.
This grants the attacker persistent read and write access to the targeted app’s private directories. From there, the malicious application can easily scrape sensitive keys and personal data from the victim’s mobile wallet.
Securing Supply Chain Dependencies
This incident highlights the growing danger of opaque dependencies in mobile development. Even when an application is built securely, a small oversight in an upstream library can introduce catastrophic attack surfaces.
Researchers first reported this issue to EngageLab in April 2025, leading to a comprehensive fix later that year where the vulnerable activity was finally restricted from outside access.
According to Microsoft research, developers using EngageSDK must verify they have updated to version 5.2.1 or later.
Furthermore, engineering teams should implement mandatory reviews of their merged Android manifests whenever they introduce or update third-party dependencies.
Monitoring these post-build files is essential for identifying hidden components or overly broad permissions before they reach the end user.
For everyday users, keeping applications updated through official channels like the Google Play Store remains the best defense.
Android has also updated its automatic user protections to provide temporary mitigation against this specific threat. At the same time, developers continue to patch their software.
Follow us on Google News , LinkedIn and X to Get More Instant Updates. Set Cyberpress as a Preferred Source in Google.
