EUVD-2026-56774
GHSA-mf53-3wq6-8v46
Severity by source
AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N
PR:L confirmed by requirement for a valid Teams account; UI:R and S:C reflect victim-triggered cross-boundary WebView script execution; no availability impact applies.
Primary rating from Vendor (microsoft).
CVSS VectorNVD
Lifecycle Timeline
6DescriptionNVD
Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Teams for Android allows an authorized attacker to perform spoofing over a network.
AnalysisAI
Cross-site scripting in Microsoft Teams for Android (versions below 1.0.76.202611302) enables an authenticated attacker to inject and render malicious content within a target user's Teams client, achieving spoofing of interface elements or participants over the network. The scope-changed CVSS vector (S:C, C:H) indicates the vulnerability can expose data beyond the Teams application boundary - potentially including session tokens or cross-context information - when a victim views attacker-controlled content. No public exploit code has been identified and SSVC classifies exploitation as none, though the high confidentiality impact warrants prioritized patching for organizations reliant on Teams for sensitive communications.
Technical ContextAI
CWE-79 (Improper Neutralization of Input During Web Page Generation) describes a classic reflected or stored XSS condition in which user-supplied input is rendered in a web context without adequate sanitization or encoding. Microsoft Teams for Android (CPE: cpe:2.3:a:microsoft:teams:*:*:*:*:*:android:*:*) embeds a WebView or equivalent web rendering engine to display rich content such as messages, adaptive cards, or tab web content. When attacker-controlled input reaches this rendering layer without neutralization, script execution occurs in the context of the Teams application or its embedded web context. The S:C (scope changed) component of the CVSS vector confirms the injected script's effects extend beyond the Teams application's own security boundary, consistent with WebView-based script execution that can access broader Android application context or cross-origin data. The ENISA EUVD entry (EUVD-2026-56774) corroborates the NVD classification.
RemediationAI
The primary fix is to update Microsoft Teams for Android to version 1.0.76.202611302 or later, available through the Google Play Store or via managed enterprise deployment channels (Microsoft Intune, managed Google Play). The Microsoft Security Response Center advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-65767 should be consulted for official guidance. If immediate patching is not possible, organizations can restrict who is permitted to send external or guest messages within Teams tenant policies, which reduces the attacker surface by limiting who can deliver malicious content to internal users. Enabling Microsoft Defender for Endpoint on Android provides additional behavioral detection. Workarounds carry the trade-off of limiting legitimate collaboration with external parties.
Privilege elevation in Microsoft Teams lets a remote, unauthenticated attacker gain unauthorized access across a network
Path-traversal-driven remote code execution affects the Microsoft Teams client for Android in all builds prior to 1.0.0.
A library injection vulnerability exists in Microsoft Teams (work or school) 24046.2813.2770.1094 for macOS. Rated criti
A library injection vulnerability exists in the WebView.app helper app of Microsoft Teams (work or school) 24046.2813.27
A library injection vulnerability exists in the com.microsoft.teams2.modulehost.app helper app of Microsoft Teams (work
Privilege elevation in Microsoft Teams allows an authenticated attacker with low-level access to bypass authentication c
Heap buffer overflow in libwebp in Google Chrome prior to 116.0.5845.187 and libwebp 1.3.2 allowed a remote attacker to
Cryptographic signature spoofing in Microsoft Teams exposes enterprise collaboration environments to unauthenticated ide
The Microsoft Teams online service contains a stored cross-site scripting vulnerability in the displayName parameter tha
Microsoft Teams Remote Code Execution Vulnerability. Rated high severity (CVSS 8.8), this vulnerability is remotely expl
Microsoft Teams Remote Code Execution Vulnerability. Rated high severity (CVSS 8.8), this vulnerability is remotely expl
Information disclosure in Microsoft Teams for Android allows an authenticated remote attacker to extract sensitive data
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today