Cross-site scripting in Microsoft Teams for Android - CVE-2026-116926
Published: November 11, 2026
Vulnerability identifier: #VU165188
CSH Severity: Medium
CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N]
CVE-ID: CVE-2026-116926
CWE-ID: CWE-79
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to perform spoofing and disclose sensitive information.
The vulnerability exists due to improper neutralization of input during web page generation in Microsoft Teams for Android when rendering web content. A remote attacker can supply specially crafted input that is interpreted as executable web content to perform spoofing and disclose sensitive information.
Affected software
Microsoft Teams for Android
How to mitigate CVE-2026-116926
Install security update from vendor's website.
Microsoft Teams for Android - update to 1416/1.0.0.2026202302