Critical Microsoft UFO Framework Bug Enables Unauthenticated Remote Control of Android Devices

A severe security flaw has been identified in Microsoft’s open‑source UFO automation framework that could let attackers take full control of Android phones without any login or user interaction, security researchers said.

The vulnerability, catalogued as CVE-2026-73296, carries a CVSS rating of 9.4, placing it in the “critical” severity tier. It exploits how UFO communicates with Android devices, allowing a remote actor to execute commands that display the screen, capture input, and manipulate applications at will.

UFO, short for "Unified Functional Orchestration," is widely used by developers to script UI tests and automate repetitive tasks on Android platforms. Because the framework runs with elevated privileges to interact with device internals, a flaw that bypasses authentication can have far‑reaching consequences for any device where UFO is installed or invoked.

According to the initial report from cybersecuritynews, the exploit does not require the victim to click a malicious link or install additional software. Instead, an attacker can send specially crafted network traffic that triggers the back‑door functionality, effectively turning the phone into a remote‑controlled endpoint.

Microsoft has acknowledged the issue and is preparing a patch. The company recommends that organizations using UFO immediately restrict network access to the framework, apply any available updates, and monitor for suspicious activity on affected devices. Security teams are also advised to review logs for unexpected commands that could indicate exploitation.

Experts warn that the bug underscores the broader risk of open‑source tools that operate at a low level on mobile devices. While such frameworks accelerate development, they also expand the attack surface when vulnerabilities go unnoticed. The incident is expected to prompt renewed scrutiny of supply‑chain security practices and may accelerate the adoption of stricter code‑review processes for publicly available automation libraries.