CVE-2026-65767 Overview
CVE-2026-65767 is a cross-site scripting (XSS) vulnerability in Microsoft Teams for Android. The flaw stems from improper neutralization of input during web page generation, classified under [CWE-79]. An authorized attacker can exploit this weakness over a network to perform spoofing attacks against Teams users on Android devices.
Microsoft assigned this vulnerability a CVSS score of 8.8 with vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. The EPSS score of 0.716% places it in the 50.5th percentile for exploit likelihood. No public proof-of-concept code or in-the-wild exploitation has been reported at the time of publication.
Critical Impact
An authenticated attacker can inject malicious script content into Teams for Android, enabling spoofing that compromises confidentiality, integrity, and availability of the mobile client.
Affected Products
- Microsoft Teams for Android
Discovery Timeline
- 2026-08-11 - CVE-2026-65767 published to NVD
- 2026-08-11 - Last updated in NVD database
Technical Details for CVE-2026-65767
Vulnerability Analysis
The vulnerability resides in how Microsoft Teams for Android processes and renders user-supplied input within web page generation logic. The application fails to properly neutralize special characters before embedding attacker-controlled data into rendered content. This allows arbitrary script content to execute within the Teams client rendering context.
The attack impacts all three security properties of the mobile client. An attacker can read sensitive data visible to the client, tamper with displayed content to impersonate legitimate entities, and disrupt normal application behavior. Because the vulnerability facilitates spoofing, it becomes a stepping stone for phishing and social engineering attacks conducted within a trusted collaboration platform.
Root Cause
The root cause is missing or insufficient output encoding in the Teams Android client when rendering user-controlled content into web views. Input that should be treated as data reaches contexts where it is interpreted as executable script or HTML markup. This is a classic [CWE-79] failure to sanitize untrusted input during page generation.
Attack Vector
Exploitation requires network access and low-level privileges, typically an authenticated Teams account. The attacker delivers crafted content, such as a chat message, meeting invitation, or shared resource, that contains embedded script payloads. When a victim's Teams for Android client renders the content, the malicious script executes within the client context and can display spoofed interface elements or exfiltrate session data.
No user interaction beyond normal message viewing is required. Refer to the Microsoft CVE-2026-65767 Advisory for authoritative technical details.
Detection Methods for CVE-2026-65767
Indicators of Compromise
- Unexpected script tags, javascript: URIs, or HTML event handlers appearing in Teams chat messages, channel posts, or meeting metadata.
- Anomalous outbound network connections initiated by the Teams Android application to domains not associated with Microsoft services.
- Reports from users describing unexpected dialogs, spoofed login prompts, or content that appears to originate from trusted contacts.
Detection Strategies
- Inspect mobile device management (MDM) telemetry for Teams for Android version data and correlate against the patched release published by Microsoft.
- Monitor Microsoft 365 audit logs for unusual message content patterns, high-volume messaging from single accounts, or external federated communications containing HTML payloads.
- Deploy content inspection on messaging gateways to identify script markup embedded in Teams messages traversing federation boundaries.
Monitoring Recommendations
- Track authentication anomalies for Teams accounts, including session token reuse and impossible-travel scenarios that may indicate post-exploitation activity.
- Enable Microsoft Defender for Cloud Apps policies to flag suspicious Teams message content and account behavior.
- Establish user reporting workflows for suspected spoofed messages so incident responders can triage potential exploitation attempts.
How to Mitigate CVE-2026-65767
Immediate Actions Required
- Update Microsoft Teams for Android to the fixed version identified in the Microsoft CVE-2026-65767 Advisory across all managed devices.
- Enforce update compliance through mobile device management platforms and block access from non-compliant Android endpoints.
- Notify users of active phishing and spoofing risk within Teams and instruct them to report suspicious messages.
Patch Information
Microsoft has issued guidance through the Microsoft Security Response Center. Review the Microsoft CVE-2026-65767 Advisory for the specific fixed build and deployment guidance. Distribute the update through Google Play managed configurations or enterprise MDM channels.
Workarounds
- Restrict external federation in Microsoft Teams to trusted domains until all Android clients are patched.
- Disable or limit rich content and HTML message rendering in Teams policies where operationally feasible.
- Require users on unpatched Android devices to access Teams through the desktop or web client under stricter conditional access policies.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
