CVE-2026-35394

PoC —

CVSS 3.1

8.8 high

EPSS

<1%p32

Published

Apr 6, 2026 (Apr 6, 2026)

Modified

Jul 24, 2026

Description

Mobile Next is an MCP server for mobile development and automation. Prior to 0.0.50, the mobile_open_url tool in mobile-mcp passes user-supplied URLs directly to Android's intent system without any scheme validation, allowing execution of arbitrary Android intents, including USSD codes, phone calls, SMS messages, and content provider access. This vulnerability is fixed in 0.0.50.

Vendors: mobilenexthq
Products: mobile mcp
Weakness: CWE-939
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

NVD CVE.org GitHub PoCs EPSS (0.4%)

In the news0 stories

No ingested article mentions this CVE yet.