CVE-2026-24490: MobSF Stored XSS Vulnerability via Manifest Analysis
Summary
CVE-2026-24490: MobSF has Stored XSS via Manifest Analysis - Dialer Code Host Field. Affects mobsf versions < 4.4.5. Fixed in 4.4.5. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
MobSF (Mobile Security Framework) is an open-source tool designed for automated security analysis of mobile applications. It provides static and dynamic analysis capabilities, allowing developers and security professionals to identify vulnerabilities in Android and iOS apps. The framework is widely used for its comprehensive analysis reports, which include insights into potential security issues. However, a critical vulnerability has been identified in its Android manifest analysis feature, which can lead to stored cross-site scripting (XSS) attacks.
Vulnerability Detail
The vulnerability arises from the improper handling of the android:host attribute in the <data android:scheme="android_secret_code"> elements of an Android APK's manifest file. When MobSF analyzes such an APK, it extracts the android:host value and inserts it directly into the HTML report without sanitization or escaping. This allows an attacker to craft a malicious APK that, when uploaded to MobSF, can execute arbitrary JavaScript in the context of a victim's browser session, leading to session hijacking and account takeover. The vulnerability is classified as Stored XSS (CWE-79) and has a CVSS score of 8.1, indicating a high severity level.
How To Fix
Latest published version: 4.5.3 as of 23 Oct 2026
pip install --upgrade "mobsf==4.5.3"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
4.4.5
This is the first release that contains the fix.
pip install --upgrade "mobsf==4.4.5"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users should avoid uploading APKs that contain the android:scheme="android_secret_code" with untrusted or unknown android:host values until the package is updated to the patched version. Additionally, users can manually sanitize any input that may be rendered in HTML reports.
Conclusion
CVE-2026-24490 is a critical stored XSS vulnerability in MobSF that can lead to severe security implications for users analyzing malicious APKs. It is essential to update to the latest version of MobSF to mitigate this risk and ensure the security of your applications.
See every vulnerability recorded for mobsf →
FAQ
The vulnerability allows attackers to execute arbitrary JavaScript in the context of a victim's browser, potentially leading to session hijacking and account takeover.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
If you cannot update MobSF, avoid uploading APKs with potentially malicious android:host values and sanitize any user input that may be rendered in reports.
The CVSS score of the CVE-2026-24490 vulnerability is 8.1, indicating a high severity level.
You can find more information about MobSF and its features on its official GitHub repository and documentation.
References
Related vulnerabilities
Recent vulnerabilities recorded for mobsf.
