Debug Flag Left in Microsoft Android Apps Exposes Billions to Token Theft
A forgotten debug flag (setIsDebugMode = true) left enabled in production code of six Microsoft 365 Android apps let any co‑installed app silently obtain valid Microsoft account tokens. The flaw, dubbed FlagLeft, affected Word, Excel, PowerPoint, Copilot, Loop and OneNote, exposing billions of downloads to silent account takeover. Microsoft has released patches.