A security gap that was fixed has been found in EngageLab SDK, a popular third-party toolkit for Android app developers. It could have endangered cryptocurrency wallet users.

“The flaw allowed apps on the same device to circumvent Android’s security measures and gain unauthorized access to private information,” the Microsoft Defender Security Research Team stated in a report released today.

EngageLab SDK provides a push notification feature designed to send “timely notifications” based on user behavior. When added to an app, the SDK allows for personalized notifications and real-time user engagement.

Microsoft noted that many apps using the SDK are related to cryptocurrency and digital wallets, with over 30 million installations. This number exceeds 50 million when counting apps not related to wallets that also use the SDK.

Microsoft withheld app names but said that all detected apps with vulnerable SDK versions were removed from the Google Play Store. Following responsible disclosure in April 2025, EngageLab released version 5.2.1 in November 2025 to patch the security hole.

The issue, present in version 4.5.4, is labeled as an intent redirection vulnerability. Intents in Android are communication objects used to request actions from other app components.

Intent redirection happens when a vulnerable app’s intent contents are manipulated, exploiting its trusted permissions to access protected parts, expose private data, or elevate permissions within the Android system.

A malicious app installed on the device could exploit this flaw to access internal app directories associated with an app using the SDK, resulting in unauthorized access to sensitive information.

There’s no proof the vulnerability was exploited maliciously. However, developers using the SDK should upgrade to the latest version immediately, as small flaws in shared libraries can cause widespread problems, affecting millions of devices.

“This situation demonstrates how vulnerabilities in third-party SDKs can have significant security consequences, particularly in valuable areas like digital asset management,” Microsoft stated. “Apps increasingly depend on third-party SDKs, resulting in substantial and often unclear supply-chain dependencies. These risks increase when integrations expose exported components or rely on trust assumptions that aren’t validated across app boundaries.”