Exploit discussion active in current signal (1 latest mentions)
Recommended action window: High priority (within 72h)
NVD description
MobSF is a mobile application security testing tool used. Prior to version 4.4.5, a Stored Cross-site Scripting (XSS) vulnerability in MobSF's Android manifest analysis allows an attacker to execute arbitrary JavaScript in the context of a victim's browser session by uploading a malicious APK. The `android:host` attribute from `<data android:scheme="android_secret_code">` elements is rendered in HTML reports without sanitization, enabling session hijacking and account takeover. Version 4.4.5 fixes the issue.
Priority
LOW
Exploitation
NONE
PoC
YES
Patch
AVAILABLE
Momentum
NONE
If you run products in this scope, you should treat this CVE as relevant to your environment.
MobSF has Stored XSS via Manifest Analysis of uploaded APK (CVE-2026-24490 ) https://github.com/advisories/GHSA-8hf7-h89p-3pqj https://t.co/H85VJl3Y6v
Post summary
The tweet announces a stored XSS vulnerability (CVE-2026-24490) in MobSF’s APK manifest analysis feature and links to a GitHub advisory for further details.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | opensecurity | mobile_security_framework | - | - | - |