CVE-2026-35394

CVE-2026-35394 is a high-severity vulnerability in Mobile Next, an MCP server for mobile development and automation, affecting versions prior to 0.0.50. The mobile_open_url tool fails to validate URL schemes before passing them to Android's intent system, enabling attackers to execute arbitrary Android intents such as USSD codes, phone calls, SMS messages, and unauthorized content provider access. The vulnerability requires user interaction but presents no authentication barriers and can be exploited over the network. The vulnerability carries a CVSS score of 8.8 (HIGH) with a network attack vector and low attack complexity, meaning it is relatively easy to exploit remotely. Successful exploitation results in high impact across confidentiality, integrity, and availability, as attackers could make unauthorized calls or messages, access sensitive data through content providers, or disrupt device functionality. The FAUCET risk score of 52.0/100 reflects moderate concern within the security community. The vulnerability is not currently listed in the CISA Known Exploited Vulnerabilities catalog, and there are no confirmed reports of active exploitation in the wild. The extremely low EPSS score of 0.00018 indicates minimal probability of exploitation by threat actors as of the latest assessment. No public exploit code has been widely circulated, and community attention remains limited, though affected organizations should prioritize patching to version 0.0.50 or later as a precautionary measure.