What is the CVSS score of CVE-2026-35394?

CVE-2026-35394 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Google are affected by CVE-2026-35394?

The mobile-mcp npm package contains a critical vulnerability allowing remote attackers to execute arbitrary Android intents (USSD codes, calls, SMS, and data access) through prompt injection attacks…. A patch is available.

How to fix or mitigate CVE-2026-35394?

Within 24 hours: Identify all deployments using mobile-mcp versions below 0.0.50 and isolate affected AI systems from Android device connections. Within 7 days: Upgrade mobile-mcp to version 0.0.50 or later across all environments and validate no malicious intents were executed during the window of exposure. Within 30 days: Implement input validation and sandboxing for all AI agent prompt inputs, conduct forensic review of connected Android device logs for suspicious intent executions, and establish monitoring for anomalous URL scheme patterns in agent-to-device communication.

Google CVE-2026-35394

HIGH

Improper Authorization in Handler for Custom URL Scheme (CWE-939)

2026-04-04 https://github.com/mobile-next/mobile-mcp

GHSA-5qhv-x9j4-c3vm

RCE Google

8.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.8 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Re-analysis Queued

Jul 24, 2026 - 21:22 vuln.today

cvss_changed

CVSS changed

Jul 24, 2026 - 21:22 NVD

8.3 (HIGH) 8.8 (HIGH)

Analysis Generated

Apr 04, 2026 - 05:45 vuln.today

Patch released

Apr 04, 2026 - 05:45 nvd

Patch available

CVE Published

Apr 04, 2026 - 05:37 nvd

HIGH 8.3

DescriptionNVD

Summary

The mobile_open_url tool in mobile-mcp passes user-supplied URLs directly to Android's intent system without any scheme validation, allowing execution of arbitrary Android intents, including USSD codes, phone calls, SMS messages, and content provider access.

Details

The vulnerable code passes URLs directly to adb shell am start -a android.intent.action.VIEW -d <url> without checking the URL scheme. This can enable malicious schemes such as tel:, sms:, mailto:, content://, and market:// to be executed.

Since MCP servers are designed to be operated by AI agents, which are vulnerable to prompt injection attacks, a malicious document or website could inject instructions that cause the AI to execute dangerous intents on a connected mobile device.

Impact

An attacker via prompt injection can:

Execute USSD codes (e.g., tel:*#06# to display IMEI - confirmed on Pixel 7a, behavior varies by device; or device-specific factory reset codes)
Initiate phone calls to premium rate numbers
Draft SMS messages with attacker-controlled content
Access content providers (contacts, SMS, call logs)
Open app installation prompts

Proof of Concept

json

{"jsonrpc":"2.0","id":1,"method":"tools/call","params":{"name":"mobile_open_url","arguments":{"device":"<id>","url":"tel:*#06#"}}}

Result: IMEI displayed on device.

json

{"jsonrpc":"2.0","id":1,"method":"tools/call","params":{"name":"mobile_open_url","arguments":{"device":"<id>","url":"sms:1234567890?body=HACKED"}}}

Result: SMS app opens with a pre-filled message.

Remediation

Upgrade to version 0.0.50 or later, which restricts mobile_open_url to http:// and https:// schemes by default. Users who require other URL schemes can opt in by setting MOBILEMCP_ALLOW_UNSAFE_URLS=1.

Articles & Coverage 1

medium.com CVE-2026-35394: AI Prompt Injection Enables Arbitrary Android Intent Execution

AnalysisAI

Arbitrary Android intent execution in mobile-mcp npm package (versions <0.0.50) allows remote attackers to trigger USSD codes, phone calls, SMS drafting, and content provider access through unvalidated URL schemes passed to adb shell commands. Attack vector exploits AI agent prompt injection: malicious documents can instruct connected AI systems to execute dangerous intents on paired Android devices. CVSS 8.3 (Network/Low complexity/No privileges/User interaction required). Publicly available exploit code exists. Vendor-released patch available (version 0.0.50+).

Technical ContextAI

The vulnerability affects mobile-mcp, an NPM package implementing Model Context Protocol (MCP) server functionality for Android device automation. The mobile_open_url tool constructs Android Debug Bridge (adb) shell commands using user-supplied URLs without scheme validation, passing them directly to 'adb shell am start -a android.intent.action.VIEW -d <url>'. Android's intent system honors various URI schemes beyond http/https, including tel: (dialer/USSD), sms: (messaging), content:// (content providers), and market:// (Play Store). The root cause maps to CWE-939 (Improper Authorization in Handler for Custom URL Scheme), where the application fails to restrict which URL schemes can invoke system-level actions. MCP servers operate as AI agent tools, making them susceptible to indirect prompt injection attacks where attacker-controlled content (websites, documents) can manipulate the AI into invoking dangerous tool calls without user awareness.

RemediationAI

Upgrade immediately to mobile-mcp version 0.0.50 or later, which implements URL scheme validation restricting mobile_open_url to http:// and https:// by default (release notes: https://github.com/mobile-next/mobile-mcp/releases/tag/0.0.50). Patch implementation available via pull request https://github.com/mobile-next/mobile-mcp/pull/299. For environments requiring non-standard URL schemes (tel:, sms:, etc.), version 0.0.50 introduces an opt-in mechanism via environment variable MOBILEMCP_ALLOW_UNSAFE_URLS=1, though enabling this restores vulnerability. Organizations should assess whether non-http/https schemes are operationally necessary before enabling unsafe URLs. No effective workaround exists for pre-0.0.50 versions short of disabling the mobile_open_url tool entirely or implementing external input validation before MCP tool invocation.