CVE-2026-35394

A vulnerability associated with CVE-2026-35394 is described in GHSA-5QHV-X9J4-C3VM for mobile-mcp’s mobile_open_url tool. It passes user-supplied URLs directly to Android’s intent system without URL scheme validation, enabling arbitrary intents (e.g., USSD, calls, SMS, content providers) and prom...