github.com
https://github.com/mobile-next/mobile-mcp CVE-2026-35394
HIGH
Mobile Next has Arbitrary Android Intent Execution via mobile_open_url
Record summary
CVE-2026-35394 has a selected CVSS score of 8.3 (high).
Description
Mobile Next is an MCP server for mobile development and automation. Prior to 0.0.50, the mobile_open_url tool in mobile-mcp passes user-supplied URLs directly to Android's intent system without any scheme validation, allowing execution of arbitrary Android intents, including USSD codes, phone calls, SMS messages, and content provider access. This vulnerability is fixed in 0.0.50.
Description source: CVE List
Exploitation context
CISA SSVC decision
ExploitationPoC
AutomatableNo
Technical impactPartial
CISA Coordinator · SSVC 2.0.3 · Evaluated Apr 7, 2026 · Source: CVE List
Affected products and versions
2| Product | Source | Version range | Status |
|---|---|---|---|
mobile-mcpBrowse mobile-next / mobile-mcp | CVE List | < 0.0.50 | affected |
@mobilenext/mobile-mcpBrowse npm / @mobilenext/mobile-mcp | GitHub Advisory | Before 0.0.50 · Fixed in 0.0.50 | affected |
References
5github.com
https://github.com/mobile-next/mobile-mcp/pull/299 github.com
https://github.com/mobile-next/mobile-mcp/releases/tag/0.0.50 github.comConfirmation
https://github.com/mobile-next/mobile-mcp/security/advisories/GHSA-5qhv-x9j4-c3vm nvd.nist.gov
https://nvd.nist.gov/vuln/detail/CVE-2026-35394