CVE-2026-35394

The record

Mobile Next is an MCP server for mobile development and automation. Prior to 0.0.50, the mobile_open_url tool in mobile-mcp passes user-supplied URLs directly to Android's intent system without any scheme validation, allowing execution of arbitrary Android intents, including USSD codes, phone calls, SMS messages, and content provider access. This vulnerability is fixed in 0.0.50.

Affected packages

Related vulnerabilities

• GHSA-5qhv-x9j4-c3vm @mobilenext/mobile-mcp: Arbitrary Android Intent Execution via mobile_open_url Same vulnerability
• CVE-2026-33989 Mobile Next is an MCP server for mobile development and automation. Also affects @mobilenext/mobile-mcp
• GHSA-3p2m-h2v6-g9mx @mobilenext/mobile-mcp alllows arbitrary file write via Path Traversal in mobile screen… Also affects @mobilenext/mobile-mcp
• CVE-2026-73335 Android application "Myna Point" is vulnerable to Improper Authorization in Handler for… CWE-939
• CVE-2026-21075 Improper authorization in handler for custom URL scheme in My Galaxy prior to version 6.3… CWE-939
• CVE-2026-21062 Authorization bypass in SemClipboardService prior to SMR Aug-2026 Release 1 allows local… CWE-939
• CVE-2026-59717 Home Assistant is open source home automation software focused on local control and… CWE-939
• CVE-2026-12189 A flaw has been found in Moovit Bus & Public Transit App 1.18 on Android. CWE-939