Critical Zero-Day Threats Found in Popular Mobile Security Framework
Security researchers have uncovered two severe, previously unknown vulnerabilities in the Mobile Security Framework (MobSF), an industry-standard tool relied upon by developers and security professionals worldwide.
Cataloged as CVE-2025-46335 and CVE-2025-46730, these flaws affect all releases up to and including MobSF 4.3.2. If left unpatched, attackers could leverage them to gain unauthorized access or disrupt critical operations within affected environments.
Following the discovery, the MobSF maintainers acted swiftly, issuing a fix in version 4.3.3 and publishing detailed advisories outlining the nature of both issues. According to the researcher behind the discovery, Shah, “The risk is amplified due to MobSF’s deployment patterns — it often resides on central infrastructure shared with other key security tools.”
Flaw #1: Persistent XSS via Embedded SVG
The first issue (CVE-2025-46335) stems from insufficient input validation during the analysis of Android application packages. Specifically, attackers can embed malicious SVG files within zipped Android Studio projects. Upon upload, MobSF extracts these files and serves them through its web interface — without sanitization.
The result? The injected SVG payload is hosted at a predictable path (e.g., http://127.0.0.1:8081/download/filename.svg), allowing for stored cross-site scripting (XSS) attacks that could compromise user sessions or manipulate the UI within the browser context.
Two Dangerous Flaws in MobSF Threaten Critical Infrastructure
Researchers have identified a pair of dangerous flaws in the Mobile Security Framework (MobSF) — a tool trusted by organizations worldwide for mobile app analysis and security testing.
The vulnerabilities, tracked as CVE-2025-46335 and CVE-2025-46730, enable two vastly different but equally damaging attack methods: one compromises session integrity through malicious SVG files, while the other can cripple servers with a highly compressed ZIP bomb.
Exploiting Trust: XSS via SVG Injection
Attackers can embed JavaScript into an SVG image file and disguise it as part of a normal mobile app archive. When MobSF processes the archive, it extracts the SVG and hosts it via its web UI. If a user with an active session views the hosted file, the script runs automatically — inheriting that user’s permissions.
The implications are serious: cross-site scripting (XSS) attacks of this nature can silently hijack sessions, exfiltrate data, or alter system behavior without any user interaction.
Crushing Servers with a “ZIP Bomb”
The second bug lies in MobSF’s handling of ZIP files. Because the system doesn’t limit how much data a compressed archive can unpack into, it becomes an easy target for so-called “ZIP of Death” attacks.
For example, a tiny ZIP file may contain a deceptively simple payload — such as a 5 GB plain text file made entirely of zeroes. MobSF will extract it in full, potentially filling up server storage in seconds.
“All it takes is one upload to overwhelm the server,” said Shah, the security researcher who uncovered both vulnerabilities. “And because MobSF often runs on shared systems, the damage can spread to other critical services hosted on the same machine.”
Why This Matters
MobSF’s wide usage in enterprises, governments, and research institutions — often hosted on centralized internal or cloud environments — magnifies the risks. Shared access among security teams, auditors, and third-party contractors creates a broad attack surface, and any disruption can ripple through core operational workflows.
Remediation Steps
The MobSF maintainers issued version 4.3.3 on May 5, 2025, which includes the following fixes:
- SVG uploads are now properly sanitized to prevent embedded script execution.
- ZIP file handling has been hardened with limits on decompression size to prevent resource exhaustion.
Organizations are strongly urged to apply this update immediately and monitor access logs for suspicious activity related to SVG or ZIP file uploads.
“Even tools designed to secure your stack can become attack vectors if not regularly assessed,” Shah emphasized.
Full advisory details, proof-of-concept examples, and remediation guidance can be found on the official MobSF GitHub security page.
