CVE-2026-35394: Mobile Next has Arbitrary Android Intent Execution via mobile_open_url

Severity: high (CVSS 8.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2026-04-06 · updated 2026-07-24
Weakness: CWE-939

Description

Mobile Next is an MCP server for mobile development and automation. Prior to 0.0.50, the mobile_open_url tool in mobile-mcp passes user-supplied URLs directly to Android's intent system without any scheme validation, allowing execution of arbitrary Android intents, including USSD codes, phone calls, SMS messages, and content provider access. This vulnerability is fixed in 0.0.50.

Affected products

mobile-next mobile-mcp: before 0.0.50 — fixed in 0.0.50

How to fix

Upgrade to a fixed version: mobile-next mobile-mcp 0.0.50. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2026-35394 or the next vulnerability affects your stack