EngageLab SDK flaw compromises 50M Android users, 30M crypto wallets

EngageLab SDK flaw triggers Android sandbox breach

The EngageLab SDK flaw, now patched, exposed an estimated ↓ 50M Android devices, including roughly ↓ 30M cryptocurrency wallets, to cross‑app data leakage.

“This vulnerability permits apps sharing the same device to circumvent Android’s sandbox and harvest private data,” Microsoft Defender warned.

Security researchers traced the root cause to insufficient validation of inter‑process communication within the SDK, allowing malicious code to read wallet private keys and personal identifiers. Immediate updates were released by major app developers, but older versions remain in circulation. Reuters reported that the breach could have facilitated phishing schemes, while Bloomberg noted potential market ripple effects for crypto assets.

Analysis by: Mia Sterling

Freelance Intelligence Contributor
(Note: Mia Sterling is covering this desk while Nova Stirling is on special assignment.)