Threats affecting pkg:github/mobile-next/mobile-mcp

1 threat

Severity	CVSS	Signals	Threat	Source	Published	Score and star
High	8.3	EPSS 0.4%	CVE-2026-35394mobile-mcp · Improper Authorization in Handler for Custom URL Scheme High8.3EPSS 0.4%2026-04-06CVE Database V5CVE-2026-35394 CVE-2026-35394 is a high-severity vulnerability in the mobile-next mobile-mcp product prior to version 0.0.50. The mobile_open_url tool improperly authorizes user-supplied URLs by passing them directly to Android's intent system without validating the URL scheme. This allows attackers to execute arbitrary Android intents, potentially triggering USSD codes, phone calls, SMS messages, or accessing content providers. The vulnerability is fixed in version 0.0.50. EPSS 0.4%Vulnerability mobile-next CWE-939	CVE Database V5	2026-04-06

Page 1 of 1