CVE-2026-35394: 
JavaScript vulnerability analysis and mitigation

CVE-2026-35394 is an improper authorization vulnerability in the mobile_open_url tool of the @mobilenext/mobile-mcp npm package that allows arbitrary Android intent execution without URL scheme validation. It affects all versions of mobile-mcp prior to 0.0.50 and was published on April 2, 2026, by researcher manthanghasadiya, with the advisory added to the GitHub Advisory Database on April 4, 2026. The vulnerability carries a CVSS v3.1 base score of 8.3–8.8 (High), depending on the scoring source (GitHub Advisory, mobile-next Advisory).

The root cause is classified as CWE-939 (Improper Authorization in Handler for Custom URL Scheme): the mobile_open_url tool passes user-supplied URLs directly to adb shell am start -a android.intent.action.VIEW -d without validating or restricting the URL scheme. This allows any Android intent scheme — including tel:, sms:, mailto:, content://, and market:// — to be executed on a connected device. Because MCP servers are typically operated by AI agents susceptible to prompt injection, a malicious document or website can inject instructions that cause the AI agent to invoke mobile_open_url with a dangerous payload. A concrete proof-of-concept JSON-RPC payload is publicly available in the advisory (GitHub Advisory, mobile-next Advisory).

Successful exploitation allows an attacker to execute arbitrary Android intents on a device connected to the MCP server, enabling actions such as triggering USSD codes (e.g., tel:*#06# to expose the device IMEI, or device-specific factory reset codes), initiating calls to premium-rate numbers, drafting SMS messages with attacker-controlled content, accessing sensitive content providers (contacts, SMS history, call logs), and opening app installation prompts. The confidentiality, integrity, and availability of the affected device are all at risk, with potential for financial harm (premium-rate calls), data exfiltration (IMEI, contacts), and device disruption (GitHub Advisory).

A proof-of-concept exploit is publicly available in the GitHub Security Advisory, consisting of concrete JSON-RPC payloads that can be sent directly to the mobile_open_url tool to trigger the vulnerability. The EPSS score is approximately 0.027% (0.039% per Feedly), placing it in the 8th percentile for near-term exploitation likelihood. There is no current evidence of in-the-wild exploitation, no known threat actor attribution, and the vulnerability is not listed in the CISA KEV catalog (GitHub Advisory, mobile-next Advisory).

1. Identify target: Locate an environment running @mobilenext/mobile-mcp version prior to 0.0.50 with an Android device connected via ADB.
2. Craft prompt injection payload: Embed malicious instructions in a document, webpage, or data source that the AI agent will process — instructing it to call the mobile_open_url tool with a dangerous URL scheme.
3. Trigger USSD code execution: Send or cause the AI agent to issue the following JSON-RPC call to expose the device IMEI:

{"jsonrpc":"2.0","id":1,"method":"tools/call","params":{"name":"mobile_open_url","arguments":{"device":"<device_id>","url":"tel:*#06#"}}}

4. Draft attacker-controlled SMS: Alternatively, use the sms: scheme to pre-fill an SMS message:

{"jsonrpc":"2.0","id":1,"method":"tools/call","params":{"name":"mobile_open_url","arguments":{"device":"<device_id>","url":"sms:1234567890?body=HACKED"}}}

5. Access content providers: Use content:// URIs to query sensitive data such as contacts or call logs via the same mechanism.
6. Achieve objective: The ADB command adb shell am start -a android.intent.action.VIEW -d <attacker_url> executes on the device without any scheme restriction, completing the attack (GitHub Advisory, mobile-next Advisory).

• Logs: MCP server logs showing mobile_open_url tool calls with non-HTTP/HTTPS URL schemes (e.g., tel:, sms:, content://, market://); ADB command logs containing am start -a android.intent.action.VIEW -d tel: or similar non-web schemes.
• Network: Unexpected outbound connections from the MCP server host to ADB-connected devices; JSON-RPC requests to the MCP server containing mobile_open_url with suspicious URL parameters.
• Device Behavior: Unexpected USSD dialogs appearing on connected Android devices; SMS drafts or sent messages to unknown numbers; unsolicited app installation prompts; phone dialer opening without user action.
• File System: Presence of @mobilenext/mobile-mcp npm package at a version below 0.0.50 (package.json or node_modules/@mobilenext/mobile-mcp/package.json) (GitHub Advisory).

Upgrade @mobilenext/mobile-mcp to version 0.0.50 or later, which restricts mobile_open_url to http:// and https:// schemes by default. Organizations that legitimately require other URL schemes can opt in by setting the environment variable MOBILEMCP_ALLOW_UNSAFE_URLS=1, though this should be done with caution. Additionally, implement prompt injection defenses in AI agent pipelines that use MCP servers, and educate users about the risks of processing untrusted documents or websites through AI agents connected to mobile devices (GitHub Advisory, mobile-next Advisory).

The vulnerability was reported by researcher manthanghasadiya and published by gmegidish (a maintainer of mobile-next/mobile-mcp) on April 2, 2026. Coverage appeared on security aggregators including infinitsec.net, VulDB, and radar.offseq.com shortly after disclosure. The advisory highlights a broader concern about AI agent security: MCP servers operated by AI agents are particularly susceptible to prompt injection attacks that can weaponize otherwise-benign tools against connected devices (GitHub Advisory).