Executive brief
The mobile-mcp library is a Model Context Protocol server that enables AI agents to automate and interact with mobile devices (iOS and Android). A vulnerability in the mobile_open_url tool allows an attacker to execute arbitrary Android intents (such as USSD codes, phone calls, and SMS messages) by injecting malicious URLs through prompt injection attacks. An attacker could trigger factory reset codes, call premium numbers, send unauthorized SMS messages, or access sensitive device data like contacts and call logs.
Technical details
The vulnerability is an improper authorization weakness (CWE-939) in the mobile_open_url handler. The tool passes URLs directly to the Android intent system via `adb shell am start -a android.intent.action.VIEW -d <url>` without validating the URL scheme. This allows malicious schemes such as tel:, sms:, mailto:, content://, and market:// to be executed. Since MCP servers are designed to be operated by AI agents, which are vulnerable to prompt injection attacks, a malicious document or website can inject instructions causing the AI to execute dangerous intents on a connected Android device. An attacker can execute USSD codes (e.g., tel:*#06# for IMEI display or device factory reset codes), initiate premium-rate phone calls, draft attacker-controlled SMS messages, and access content providers containing contacts, SMS, and call logs. The vulnerability requires user interaction (AI agent processing the malicious prompt) and network access. Patch version 0.0.50 restricts mobile_open_url to http:// and https:// schemes by default, with an opt-in environment variable MOBILEMCP_ALLOW_UNSAFE_URLS=1 for users requiring other schemes.
Affected products
- mobile-next mobile-mcp < 0.0.50
Timeline
- 2026-04-02: disclosed: Vulnerability published via GitHub advisory GHSA-5qhv-x9j4-c3vm
- 2026-03-27: patched: Version 0.0.50 released with fix restricting URL schemes to http/https by default