Why should you update Microsoft Authenticator on Android right now?

Microsoft has disclosed a flaw in Microsoft Authenticator for Android (CVE-2026-80097) that could let a malicious app already on your phone steal account tokens without permissions you knowingly granted. It does not mean you were hacked — it means the fix is sitting in Google Play, and updating is a two-minute job worth doing today.

You tap “approve” to sign in at work and assume the little Authenticator app just quietly does its job in the background. Short answer: Microsoft has disclosed a security flaw in Microsoft Authenticator for Android, tracked as CVE-2026-80097, and its guidance is simple — update the app through Google Play as soon as you can, because the patched version closes the hole. Why it matters: the flaw is described as improper authentication that could let a malicious app already on your phone steal account tokens or elevate its privileges, without needing permissions you knowingly granted.

Tokens are the behind-the-scenes proof your app holds that you already signed in — exactly what an attacker would love to copy. To be clear, this does not mean everyone was hacked; it means a door existed that a bad app on the same phone could have tried, and the update locks it.1. Open Google Play.

Tap your profile picture, then “Manage apps & device,” and look for pending updates.2. Update Microsoft Authenticator. Install the latest version now rather than letting it sit in the queue.3.

Turn on auto-updates for it. On the app’s Play Store page, open the menu and enable auto-update so the next fix lands on its own.4. Clear out apps you do not recognise.

Remove anything you do not remember installing, especially anything sideloaded from outside the Play Store — the flaw only matters if a bad app is on the phone.5. Glance over your sign-ins. If anything about your work or school account looks odd, check recent sign-in activity, and keep your screen lock on as always.Pro tip: Never install an “authenticator helper” or a copycat sign-in app — the only one to trust is the official Microsoft Authenticator, published by Microsoft in Google Play.Ad’s take: The app that guards the keys has to be kept patched too — that is the part people forget.

This is a two-minute fix, so do it today and then forget about it with a clear conscience.