MobSF has Stored XSS via Manifest Analysis - Dialer Code Host Field
Date: 2026-01
Affected: pip/mobsf
Attack vector: xss
Category: vulnerability-disclosure
Severity: High
CVE: CVE-2026-24490
CWE: CWE-79
CVSS: 8.1 (CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:N)

### Summary A Stored Cross-site Scripting (XSS) vulnerability in MobSF's Android manifest analysis allows an attacker to execute arbitrary JavaScript in the context of a victim's browser session by uploading a malicious APK. The `android:host` attribute from `<data android:scheme="android_secret_code">` elements is rendered in HTML reports without sanitization, enabling session hijacking and account takeover. ### Details When MobSF analyzes an Android APK containing a `<data>` element with `android:scheme="android_secret_code"`, it extracts the `android:host` attribute and inserts it directly into the analysis report without HTML escaping. ### Vulnerable Code Path **1. Data Extraction** - `mobsf/StaticAnalyzer/views/android/manifest_analysis.py` (line 776): ```python xmlhost = data.getAttribute(f'{ns}:host') ret_list.append(('dialer_code_found', (xmlhost,), ())) ``` **2. Template String Formatting** - `mobsf/StaticAnalyzer/views/android/manifest_analysis.py` (line 806): ```python 'title': a_template['title'] % t_name, # XSS payload inserted here unescaped ``` **3. Template Definition** - `mobsf/StaticAnalyzer/views/android/kb/android_manifest_desc.py` (line 200): ```python 'dialer_code_found': { 'title': 'Dailer Code: %s Found <br>[android:scheme=\"android_secret_code\"]', ... } ``` **4. Unsafe Rendering** - `mobsf/templates/static_analysis/android_binary_analysis.html` (line 1143): ```html {{item|key:"title" | safe}} ``` The `|safe` Django template filter byp


Mitigations:

Architectural layers (MAESTRO):