What is the CVSS score of CVE-2026-24490?

CVE-2026-24490 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:N. EPSS exploitation probability: 0.0%.

Which versions of Android are affected by CVE-2026-24490?

MobSF, a mobile security testing tool, contains a stored XSS vulnerability that could allow attackers to execute malicious code within user browsers during APK analysis.. A patch is available.

Is there a public PoC exploit available for CVE-2026-24490?

Yes, a public proof-of-concept exploit is available for CVE-2026-24490. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate CVE-2026-24490?

Within 24 hours: Identify all systems running MobSF versions prior to 4.4.5 and restrict access to trusted personnel only. Within 7 days: Upgrade all MobSF installations to version 4.4.5 or later and validate the patch in a test environment first. Within 30 days: Conduct a security audit of any APK files analyzed during the vulnerable period and review user session logs for suspicious activity.

Android CVE-2026-24490

HIGH

Cross-site Scripting (XSS) (CWE-79)

2026-01-27 security-advisories@github.com

GHSA-8hf7-h89p-3pqj

Android XSS Mobile Security Framework

8.1

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

8.1 HIGH

AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:N

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 21:55 vuln.today

PoC Detected

Feb 17, 2026 - 20:36 vuln.today

Public exploit code

Patch released

Feb 17, 2026 - 20:36 nvd

Patch available

CVE Published

Jan 27, 2026 - 01:16 nvd

HIGH 8.1

DescriptionGitHub Advisory

MobSF is a mobile application security testing tool used. Prior to version 4.4.5, a Stored Cross-site Scripting (XSS) vulnerability in MobSF's Android manifest analysis allows an attacker to execute arbitrary JavaScript in the context of a victim's browser session by uploading a malicious APK. The android:host attribute from <data android:scheme="android_secret_code"> elements is rendered in HTML reports without sanitization, enabling session hijacking and account takeover. Version 4.4.5 fixes the issue.

AnalysisAI

MobSF versions prior to 4.4.5 are vulnerable to stored XSS through unsanitized rendering of Android manifest attributes in HTML reports, allowing attackers to inject malicious JavaScript by uploading crafted APK files. Public exploit code exists for this vulnerability, and successful exploitation enables session hijacking and account takeover of security analysts using the framework. Upgrade to version 4.4.5 or later to remediate.

Technical ContextAI

Classified as CWE-79 (Cross-site Scripting (XSS)). Affects Mobile Security Framework. MobSF is a mobile application security testing tool used. Prior to version 4.4.5, a Stored Cross-site Scripting (XSS) vulnerability in MobSF's Android manifest analysis allows an attacker to execute arbitrary JavaScript in the context of a victim's browser session by uploading a malicious APK. The android:host attribute from <data android:scheme="android_secret_code"> elements is rendered in HTML reports without sanitization, enabling session hijacking and account takeover. Version 4.4.5 fix

RemediationAI

A vendor patch is available — apply it immediately. Implement output encoding and Content Security Policy headers. Restrict network access to the affected service where possible.