MobSF, a mobile application security testing framework, contains a stored XSS vulnerability (CWE‑79) in its Android manifest analysis. The flaw arises when the android:host field of <data android:scheme="android_secret_code"> elements is rendered directly into HTML reports without sanitization. An attacker who uploads a crafted APK can cause arbitrary JavaScript to run in the context of a victim’s browser session, allowing session hijacking and account takeover.

The issue affects the MobSF Mobile‑Security‑Framework‑MobSF product prior to version 4.4.5. All earlier releases are vulnerable until the 4.4.5 release, which applies the necessary sanitization to the host attribute. Users running any deprecated MobSF build must upgrade to a patched version.

The CVSS score of 8.1 indicates a high severity. EPSS is less than 1 %, suggesting a low exploitation probability in the current threat landscape, and the vulnerability is not listed in the CISA KEV catalog. The likely attack path involves an attacker first uploading a malicious APK to the MobSF portal, which triggers the manifest analysis and generates an unsafe report. Successful exploitation then requires the victim to view the generated report in a browser where the injected script can execute.