← Back

CVE-2026-35394

nvd nist
Published: Apr 6, 2026Modified: Jul 24, 2026

JSON object

Loading...
8.8
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Exploitability: 2.8 / Impact: 5.9
Source: NVD

Description

Mobile Next is an MCP server for mobile development and automation. Prior to 0.0.50, the mobile_open_url tool in mobile-mcp passes user-supplied URLs directly to Android's intent system without any scheme validation, allowing execution of arbitrary Android intents, including USSD codes, phone calls, SMS messages, and content provider access. This vulnerability is fixed in 0.0.50.

Affected (1)

Mobilenexthq
1 product
Mobile Mcp
Configuration A
1 vulnerable
Vulnerable SoftwareAffected Versions
Mobile Mcp
Before 0.0.50

Related CWEs

CWE-939
Improper Authorization in Handler for Custom URL Scheme
The product uses a handler for a custom URL scheme, but it does not properly restrict which actors can invoke the handler using the scheme.

References (2)

Source: security-advisories@github.com
ExploitMitigationPatchVendor Advisory
Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0
ExploitMitigationPatchVendor Advisory

Timeline

No history available yet.