CVE-2026-65767
HighCVSS 8.8Exploitation Probability (EPSS)
Low risk37th percentile - higher than 37% of all known CVEs
Summary
Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Teams for Android allows an authorized attacker to perform spoofing over a network.
Risk Assessment
An authorized attacker could exploit the vulnerability to spoof content, potentially leading to fraud or data theft.
Recommendation
Update Microsoft Teams for Android to the latest version containing the fix.
Other vulnerabilities in Microsoft Teams for Android
See all- CVE-2026-69559Medium
Origin validation error in Microsoft Teams for Android allows an authorized attacker to disclose information over a network.
- CVE-2026-65768High
Improper limitation of a pathname to a restricted directory ('path traversal') in Microsoft Teams for Android allows an unauthorized attacker to execute code over a network.
- CVE-2026-42835High
Improper neutralization of special elements in output used by a downstream component ('injection') in Microsoft Teams for Android allows an authorized attacker to disclose information over a network.
Original NVD description (English source)
Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Teams for Android allows an authorized attacker to perform spoofing over a network.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS