CVE-2026-105788: Microsoft UFO: Authenticated Android shell command injection in Mobile MCP type_text and launch_app
Microsoft UFO is an open-source framework for intelligent automation across devices and platforms. Prior to 3.0.10, the typetext and launchapp tools in ufo/client/mcp/httpservers/mobilemcpserver.py pass the authenticated caller-controlled text and packagename parameters into adb shell command argument positions without comprehensive validation. The adb client joins those arguments into a remote command string that the Android shell reparses, allowing shell metacharacters to execute additional commands on an authorized connected device as the Android shell user. Exploitation requires a valid Mobile MCP API key and a reachable device authorized for ADB, and it does not establish host operating-system execution, Android root execution, or access beyond the Android shell-user privileges. This issue is fixed in version 3.0.10.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Microsoft UFOto a version that resolves this vulnerability.Fixed in 3.0.10
Event History
Frequently Asked Questions
Which deployments are exposed?
Microsoft UFO versions prior to 3.0.10 are exposed when the Mobile MCP server is available to an authenticated caller and has a reachable Android device that is authorized for ADB.
What does an attacker need to exploit this issue?
An attacker needs a valid Mobile MCP API key and access to invoke the affected type_text or launch_app tools against an authorized, connected Android device. Exploitation does not require user interaction.
What level of access can successful exploitation provide?
Injected commands execute on the connected Android device as the Android shell user. The issue does not provide host operating-system execution, Android root execution, or privileges beyond those available to the Android shell user.
What should be done if an immediate upgrade is not possible?
Restrict access to the Mobile MCP API and protect its API keys, and avoid exposing reachable ADB-authorized devices to untrusted authenticated callers. Limit or disable use of the affected type_text and launch_app tools where possible.
What version fixes the issue?
Upgrade Microsoft UFO to version 3.0.10 or later.