CVE-2026-35394
Published:April 06, 2026
Updated:April 20, 2026
Mobile Next is an MCP server for mobile development and automation. Prior to 0.0.50, the mobile_open_url tool in mobile-mcp passes user-supplied URLs directly to Android's intent system without any scheme validation, allowing execution of arbitrary Android intents, including USSD codes, phone calls, SMS messages, and content provider access. This vulnerability is fixed in 0.0.50.
Affected Packages
https://github.com/mobile-next/mobile-mcp.git (GITHUB):
Affected version(s) >=v0.0.31-beta <0.0.50Fix Suggestion:
Update to version 0.0.50@mobilenext/mobile-mcp (NPM):
Affected version(s) >=0.0.6 <0.0.50Fix Suggestion:
Update to version 0.0.50Related Resources (5)
Do you need more information?
Contact UsCVSS v4
Base Score:
7.2
Attack Vector
NETWORK
Attack Complexity
LOW
Attack Requirements
NONE
Privileges Required
NONE
User Interaction
PASSIVE
Vulnerable System Confidentiality
LOW
Vulnerable System Integrity
HIGH
Vulnerable System Availability
HIGH
Subsequent System Confidentiality
NONE
Subsequent System Integrity
NONE
Subsequent System Availability
NONE
CVSS v3
Base Score:
8.3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
REQUIRED
Scope
UNCHANGED
Confidentiality
LOW
Integrity
HIGH
Availability
HIGH
Weakness Type (CWE)
Improper Authorization in Handler for Custom URL Scheme
EPSS
Base Score:
0.05
