Stocks

UFO Flaw Lets Attackers Control Android Devices Remotely

Guavy AI Editorial Team Published August 31, 2026

Instruments

MSFT

A critical vulnerability in Microsoft's UFO agentic automation framework has been discovered, allowing unauthenticated attackers to remotely control Android devices. The flaw, tracked as CVE-2026-73296 with a CVSS score of 9.4, affects UFO versions up to and including v3.0.7, with no patched version currently available.

The vulnerability resides in the Mobile MCP (Model Context Protocol) implementation at ufo/client/mcp/http_servers/mobile_mcp_server.py, where two Streamable HTTP servers are constructed without any authentication provider or authorization check. When deployed per Microsoft's own documented remote configuration, any network client capable of reaching the ports can initiate an MCP session and invoke ADB-backed tools without an API key, session token, or user approval.

Once a request reaches the server, it flows directly into privileged ADB subprocess calls with no gatekeeping. On the data side, attackers can call capture_screenshot, get_ui_tree, get_device_info, and related functions to exfiltrate screen contents, UI hierarchy, installed apps, and device metadata.

UFO Flaw Lets Attackers Control Android Devices Remotely

Benjamin Edwards Inc. Buys into Honeywell Aerospace

Honeywell Aerospace Draws New Institutional Investor Interest

Honeywell Aerospace Attracts Major Investor Interest in Q2