Executive Summary
In April 2025, a critical intent redirection vulnerability was discovered in the EngageLab SDK, a widely used third-party Android library for managing messaging and push notifications. This flaw allowed malicious applications to exploit the SDK's exported activity, MTCommonActivity, to gain unauthorized access to private data by bypassing Android's security mechanisms. The vulnerability affected numerous applications, including cryptocurrency wallets, with over 30 million installations, exposing sensitive user information to potential risk. EngageLab addressed the issue by releasing version 5.2.1 on November 3, 2025, which set the vulnerable activity to non-exported, mitigating the risk.
This incident underscores the significant security implications of vulnerabilities in third-party SDKs, especially in high-value sectors like digital asset management. It highlights the necessity for developers to rigorously review and monitor third-party components integrated into their applications to prevent similar security breaches.
Why This Matters Now
The EngageLab SDK vulnerability exemplifies the critical need for developers to scrutinize third-party libraries, as such flaws can introduce significant security risks. With the increasing reliance on external SDKs, ensuring their security is paramount to protect sensitive user data and maintain trust.
Attack Path Analysis
An intent redirection vulnerability in the EngageSDK allowed malicious apps to exploit exported activities, leading to unauthorized access to sensitive data. Attackers could escalate privileges by leveraging the vulnerable app's permissions to access private components. This access facilitated lateral movement within the device, enabling further exploitation of other applications. The compromised app could then establish command and control channels to communicate with external servers. Sensitive user data was exfiltrated through these channels. The attack culminated in significant impact, including potential financial loss and privacy breaches for users.
Kill Chain Progression
Initial Compromise
Description
Malicious applications exploited the intent redirection vulnerability in the EngageSDK to gain unauthorized access to sensitive data.
MITRE ATT&CK® Techniques
Exploitation for Privilege Escalation
Hijack Execution Flow
Impair Defenses
Input Injection
Ingress Tool Transfer
Potential Compliance Exposure
Mapping incident impact across multiple compliance frameworks.
PCI DSS 4.0 – Ensure all system components and software are protected from known vulnerabilities
Control ID: 6.2
NYDFS 23 NYCRR 500 – Cybersecurity Policy
Control ID: 500.03
DORA – ICT Risk Management Framework
Control ID: Article 5
CISA ZTMM 2.0 – Data Security
Control ID: Pillar 3: Data
NIS2 Directive – Cybersecurity Risk Management Measures
Control ID: Article 21
Sector Implications
Industry-specific impact of the vulnerabilities, including operational, regulatory, and cloud security risks.
Financial Services
Supply-chain vulnerability in third-party SDK exposed 30+ million crypto wallets to intent redirection attacks, compromising encrypted traffic and egress security controls.
Computer Software/Engineering
Intent redirection vulnerability in EngageSDK demonstrates critical supply-chain risks in third-party libraries, requiring enhanced zero trust segmentation and multicloud visibility controls.
Computer/Network Security
Android SDK vulnerability bypassed security sandboxes through intent redirection, highlighting need for improved threat detection and anomaly response in mobile security frameworks.
Telecommunications
Mobile wallet applications using vulnerable SDK exposed encrypted traffic to potential compromise, necessitating strengthened east-west traffic security and kubernetes security measures.
Sources
- Intent redirection vulnerability in third-party SDK exposed millions of Android wallets to potential riskhttps://www.microsoft.com/en-us/security/blog/2026/04/09/intent-redirection-vulnerability-third-party-sdk-android/Verified
- Remediation for Intent Redirection Vulnerability - Google Helphttps://support.google.com/faqs/answer/9267555?hl=enVerified
- Intent redirection | Security | Android Developershttps://developer.android.com/privacy-and-security/risks/intent-redirectionVerified
Frequently Asked Questions
Cloud Native Security Fabric Mitigations and ControlsCNSF
Aviatrix Zero Trust CNSF is pertinent to this incident as it would likely limit the attacker's ability to move laterally and exfiltrate data by enforcing strict segmentation and controlled egress policies.
Control: Cloud Native Security Fabric (CNSF)
Mitigation: The attacker's ability to access sensitive data would likely be constrained by enforcing strict workload isolation and identity-aware policies.
Control: Zero Trust Segmentation
Mitigation: The attacker's ability to escalate privileges would likely be limited by enforcing least-privilege access controls and strict segmentation.
Control: East-West Traffic Security
Mitigation: The attacker's lateral movement would likely be restricted by enforcing east-west traffic controls and microsegmentation.
Control: Multicloud Visibility & Control
Mitigation: The attacker's ability to establish command and control channels would likely be constrained by monitoring and controlling outbound communications.
Control: Egress Security & Policy Enforcement
Mitigation: The attacker's data exfiltration efforts would likely be limited by enforcing strict egress policies and monitoring outbound traffic.
The overall impact of the attack would likely be reduced by limiting the attacker's ability to move laterally and exfiltrate data.
Impact at a Glance
Affected Business Functions
- Digital Wallet Transactions
- User Authentication
- Financial Data Management
Estimated downtime: N/A
Estimated loss: N/A
Potential exposure of personally identifiable information (PII), user credentials, and financial data of over 30 million users.
Recommended Actions
Key Takeaways & Next Steps
- • Review and update all applications to ensure they do not contain vulnerable versions of third-party SDKs.
- • Implement Zero Trust Segmentation to limit the impact of potential breaches by enforcing least privilege access.
- • Enhance East-West Traffic Security to monitor and control internal communications, preventing unauthorized lateral movement.
- • Deploy Threat Detection & Anomaly Response systems to identify and respond to suspicious activities promptly.
- • Educate developers on secure coding practices to prevent vulnerabilities like intent redirection in future applications.
