CVE-2026-35394

EUVD-2026-19492 · Published Apr 6, 2026

Mobile Next is an MCP server for mobile development and automation. Prior to 0.0.50, the mobile_open_url tool in mobile-mcp passes user-supplied URLs directly to Android's intent system without any scheme validation, allowing execution of arbitrary Android intents, including USSD codes, phone calls, SMS messages, and content provider access. This vulnerability is fixed in 0.0.50.

Technologies

Mobilenexthq Mobile McpMobilenext Mobile-Mcp

Weaknesses

CWE-939

CVSS scores

v3.18.8CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

MITRE ATT&CK

Inferred

Where this vulnerability fits in an attack

ReconImpact

Initial Access

T1190Exploit Public-Facing Application

References

https://github.com/mobile-next/mobile-mcp/security/advisories/GHSA-5qhv-x9j4-c3vm
https://nvd.nist.gov/vuln/detail/CVE-2026-35394
https://github.com/mobile-next/mobile-mcp/pull/299
https://github.com/mobile-next/mobile-mcp
https://github.com/mobile-next/mobile-mcp/releases/tag/0.0.50

Potentially impacted assets

See if this affects your attack surface