SB2026111167 - Multiple vulnerabilities in Microsoft Teams for Android

Description

This security bulletin contains information about 2 vulnerabilities.

1) Cross-site scripting (CVE-ID: CVE-2026-116926)

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N]

The vulnerability allows a remote attacker to perform spoofing and disclose sensitive information.

The vulnerability exists due to improper neutralization of input during web page generation in Microsoft Teams for Android when rendering web content. A remote attacker can supply specially crafted input that is interpreted as executable web content to perform spoofing and disclose sensitive information.

2) Origin validation error (CVE-ID: CVE-2026-69901)

CWE-ID: CWE-346 - Origin Validation Error

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to access tokens beyond a user's typical privileges.

The vulnerability exists due to an origin validation error in Microsoft Teams for Android when handling network communications. A remote attacker can spoof the origin of communications to obtain tokens beyond a user's typical privileges.

Remediation

Install update from vendor's website.

References

• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-116926
• https://play.google.com/store/apps/details?id=com.microsoft.teams
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-69901