CVE-2026-35394 - Vulnerability Analysis

Overview

Mobile Next mobile-mcp < 0.0.50 contains a command injection caused by lack of scheme validation in mobile_open_url tool passing user-supplied URLs to Android's intent system, letting attackers execute arbitrary Android intents, exploit requires crafted URL input.

Severity & Score

Impact

Attackers can execute arbitrary Android intents, including USSD codes, phone calls, SMS, and content provider access, potentially leading to unauthorized actions on the device.

Mitigation

Update to version 0.0.50 or later.

References

• https://github.com/mobile-next/mobile-mcp/security/advisories/GHSA-5qhv-x9j4-c3vm

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner