Stored XSS Vulnerability in MobSF Mobile Application Security Testing Tool
CVE-2026-24490

8.1HIGH

Key Information:

Vendor: Mobsf
Status: Mobile-security-framework-mobsf
Vendor: CVE Published:; 27 January 2026

What is CVE-2026-24490?

The Mobile Security Framework (MobSF) suffered from a stored Cross-site Scripting vulnerability in its Android manifest analysis feature prior to version 4.4.5. This flaw allows attackers to upload malicious APK files that can execute arbitrary JavaScript within the context of a victim's browser session. Specifically, the android:host attribute from <data android:scheme="android_secret_code"> elements is rendered in HTML reports without adequate sanitization. Exploiting this vulnerability could lead to session hijacking and potential account takeovers. Users are strongly advised to update to version 4.4.5 or later to mitigate this risk.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch