CVE-2026-24490

HighPublic PoC

Published: 27 January 2026

Published

27 January 2026

Modified

17 February 2026

KEV Added

—

Patch

—

CVSS Score 8.1 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:N

EPSS Score 0.0002 5.8th percentile

Risk Priority 16 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2026-24490 is a high-severity Cross-site Scripting (CWE-79) vulnerability in Opensecurity Mobile Security Framework. Its CVSS base score is 8.1 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Browser Session Hijacking (T1185); ranked at the 5.8th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

The strongest mitigations our analysis identified are NIST 800-53 SI-15 (Information Output Filtering) and SI-2 (Flaw Remediation).

Threat & Defense at a Glance

What attackers do: exploitation maps to Browser Session Hijacking (T1185) and 1 other technique. What defenders deploy: see the NIST 800-53 controls recommended below.

Threat & Defense Details

Mitigating Controls (NIST 800-53 r5)AI

SI-15 Information Output Filtering good match

prevent

Directly prevents stored XSS by requiring filtering of user-controlled android:host data from APK manifests prior to rendering in HTML reports.

SI-2 Flaw Remediation good match

prevent

Ensures timely remediation of the known flaw through patching to MobSF version 4.4.5 or later, which implements proper sanitization.

SI-10 Information Input Validation partial match

prevent

Validates inputs from uploaded APK manifests, such as restricting android:host to valid hostnames to block malicious payloads before storage and report generation.

MITRE ATT&CK Enterprise TechniquesAI

T1185 Browser Session Hijacking Collection

Adversaries may take advantage of security vulnerabilities and inherent functionality in browser software to change content, modify user-behaviors, and intercept information as part of various browser session hijacking techniques.

attack.mitre.org →

T1539 Steal Web Session Cookie Credential Access

An adversary may steal web application or service session cookies and use them to gain access to web applications or Internet services as an authenticated user without needing credentials.

attack.mitre.org →

Why these techniques?

Stored XSS in generated reports directly enables browser session hijacking (T1185) and theft of web session cookies (T1539), leading to account takeover as described.

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1

NVD Description

MobSF is a mobile application security testing tool used. Prior to version 4.4.5, a Stored Cross-site Scripting (XSS) vulnerability in MobSF's Android manifest analysis allows an attacker to execute arbitrary JavaScript in the context of a victim's browser session by…

uploading a malicious APK. The `android:host` attribute from `<data android:scheme="android_secret_code">` elements is rendered in HTML reports without sanitization, enabling session hijacking and account takeover. Version 4.4.5 fixes the issue.

Deeper analysisAI

CVE-2026-24490 is a Stored Cross-site Scripting (XSS) vulnerability in the Mobile Security Framework (MobSF), an open-source mobile application security testing tool. Versions prior to 4.4.5 are affected, specifically in the Android manifest analysis component. The flaw occurs because the `android:host` attribute from `<data android:scheme="android_secret_code">` elements in uploaded APK files is rendered in generated HTML reports without sanitization, allowing injected JavaScript to execute. The vulnerability is classified under CWE-79 and carries a CVSS v3.1 base score of 8.1 (AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:N).

An attacker requires high privileges (PR:H) within a MobSF instance to upload a malicious APK containing a crafted `android:host` value. Exploitation occurs when a victim with access to the platform views the resulting HTML report, triggering user interaction (UI:R) that executes arbitrary JavaScript in the victim's browser session context over the network (AV:N). Successful exploitation enables session hijacking and account takeover, with high impacts on confidentiality and integrity due to the changed scope (S:C).

MobSF version 4.4.5 resolves the issue through proper sanitization. Administrators and practitioners should upgrade to this version or later to mitigate the vulnerability. Official resources include the fixing commit at https://github.com/MobSF/Mobile-Security-Framework-MobSF/commit/2b08dd050e7685ee2a14fdbb454affab94129eae, the release announcement at https://github.com/MobSF/Mobile-Security-Framework-MobSF/releases/tag/v4.4.5, and the GitHub security advisory at https://github.com/MobSF/Mobile-Security-Framework-MobSF/security/advisories/GHSA-8hf7-h89p-3pqj.