Microsoft Teams CVE-2026-69559

Exploitation requires: (1) the target is running Microsoft Teams for Android on a version below 1416/1.0.0.2026142702; (2) the attacker holds at least a low-privilege authenticated Teams session (PR:L) sufficient to deliver content to the victim; (3) the victim user must actively interact with attacker-controlled content within the Teams client (UI:R); (4) attack complexity is high (AC:H), meaning specific timing or environmental conditions must align for the origin validation bypass to succeed. Exploitation is limited by: the mandatory user interaction step, the high attack complexity constraint, and the requirement that the attacker already possess an authenticated Teams identity. Default configurations of Microsoft Teams for Android are potentially vulnerable without any additional misconfiguration required.

The CVSS 3.1 score of 5.8 reflects meaningful exploitation barriers: AC:H (high complexity, requiring specific conditions and timing), PR:L (an authenticated Teams session is needed), and UI:R (victim must interact with attacker-controlled content). Despite the moderate composite score, the C:H impact with S:C indicates that successful exploitation yields high-value cross-origin data, which could include tokens, session data, or content from a separate origin within the Teams client. EPSS data is not provided in the input, and the vulnerability is not listed in CISA KEV, consistent with no confirmed active exploitation. No public proof-of-concept has been identified. Real-world risk is therefore moderate: the attack is constrained by requiring a socially-engineered user interaction and elevated complexity, making mass exploitation unlikely, but targeted attacks against high-value Teams users remain plausible. The scope change elevates residual risk beyond what the numeric score alone suggests.

An attacker who has obtained a low-privilege Teams session (PR:L) serves malicious cross-origin content - for example via a crafted link or embedded web resource shared in a Teams chat. When the victim interacts with that content (UI:R), the Teams Android client fails to enforce origin validation, allowing the attacker's origin to read sensitive data scoped to a trusted origin within the application, such as authentication tokens or chat content from another domain.