CVE-2026-35394: @mobilenext/mobile-mcp: Arbitrary Android Intent Execution via mobile_open_url

April 4, 2026 (updated April 6, 2026)

The mobile_open_url tool in mobile-mcp passes user-supplied URLs directly to Android’s intent system without any scheme validation, allowing execution of arbitrary Android intents, including USSD codes, phone calls, SMS messages, and content provider access.

References

github.com/advisories/GHSA-5qhv-x9j4-c3vm
github.com/mobile-next/mobile-mcp
github.com/mobile-next/mobile-mcp/pull/299
github.com/mobile-next/mobile-mcp/releases/tag/0.0.50
github.com/mobile-next/mobile-mcp/security/advisories/GHSA-5qhv-x9j4-c3vm
nvd.nist.gov/vuln/detail/CVE-2026-35394

Code Behaviors & Features

Detect and mitigate CVE-2026-35394 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →