A critical vulnerability in the Mobile Next mobile-mcp server allows unauthenticated attackers to execute arbitrary Android intents, posing a significant risk to device integrity and user data.

The vulnerability is an improper authorization flaw where the mobile_open_url tool passes user-supplied URLs to the Android intent system without scheme validation. This allows an unauthenticated attacker to remotely trigger sensitive actions, such as USSD codes, phone calls, or SMS messages.

Successful exploitation allows an attacker to manipulate device functionality, potentially leading to unauthorized communication, financial charges via USSD, or unauthorized access to content providers. With a CVSS score of 8.3, this high-severity flaw represents a substantial risk to mobile application security and user privacy, warranting immediate remediation.

Immediate Action: Update the @mobilenext/mobile-mcp package to version 0.0.50 or later immediately to incorporate the necessary URL scheme validation.

Proactive Monitoring: Review application access logs for unusual URLs or patterns associated with the mobile_open_url tool that may indicate probing for intent-based attacks.

Compensating Controls: Implement strict input validation at the application layer to sanitize all URLs before they reach the mobile-mcp processing functions, effectively blocking malicious intent triggers.

Public Exploit Available: No

Given the potential for unauthorized device control and the existence of a proof-of-concept, organizations using mobile-mcp must prioritize this update. Ensure that all development environments and production instances are patched to version 0.0.50 to prevent potential remote exploitation of Android system functions.