highresolved
Mobile MCP remote code execution via Android intents (CVE-2026-35394)
Remote code execution in Mobile MCP through arbitrary Android intent execution from unvalidated URLs.
Mobile MCP builds and launches Android intents from URLs supplied to the server. Because the URLs were not validated before selecting an intent, a crafted URL could trigger arbitrary intent execution and run code on the device (CVE-2026-35394).
Takeaway
An intent built from unvalidated input is an execution primitive exposed to the network. Validate a URL before it selects an action, and authorize the invocation rather than trusting the caller to have done so.
Sources
mcpmobile-mcprceandroidCVE-2026-35394