CVE-2026-24490: MobSF has Stored XSS via Manifest Analysis - Dialer Code Host Field
(updated )
A Stored Cross-site Scripting (XSS) vulnerability in MobSF’s Android manifest analysis allows an attacker to execute arbitrary JavaScript in the context of a victim’s browser session by uploading a malicious APK. The android:host attribute from <data android:scheme="android_secret_code"> elements is rendered in HTML reports without sanitization, enabling session hijacking and account takeover.
References
- github.com/MobSF/Mobile-Security-Framework-MobSF
- github.com/MobSF/Mobile-Security-Framework-MobSF/commit/2b08dd050e7685ee2a14fdbb454affab94129eae
- github.com/MobSF/Mobile-Security-Framework-MobSF/releases/tag/v4.4.5
- github.com/MobSF/Mobile-Security-Framework-MobSF/security/advisories/GHSA-8hf7-h89p-3pqj
- github.com/advisories/GHSA-8hf7-h89p-3pqj
- nvd.nist.gov/vuln/detail/CVE-2026-24490
Code Behaviors & Features
Detect and mitigate CVE-2026-24490 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →