Cross-Surface Prompt Injection against Safety-Aligned Mobile GUI Agents

Mobile GUI agents increasingly act on behalf of users in real app workflows. This autonomy makes the agent's interpretation of on-screen content a direct security concern. Existing indirect prompt injection attacks mostly place the decisive malicious objective on the same surface the agent is already reading. In mobile workflows, this same-surface assumption creates two obstacles: (1) attacker-controllable fields are often short and cannot host structured interaction, and (2) direct requests for credentials, private data, authorization, or other high-risk actions expose malicious intent early. To overcome these limitations, we propose CrossSurf, a cross-surface prompt injection attack that decouples navigation from the downstream attack objective. The design of our attack is inspired by the observation that the same constrained field can still carry a short navigation request and link that opens an external continuation page from the source surface. CrossSurf optimizes two artifacts: a Stage I jump instruction that makes the cross-surface transition appear consistent with the benign workflow, and a Stage II attacker-controlled page that presents the guidance, structured fields, and action target needed for the downstream objective. We construct a benchmark with 117 mobile test cases from 39 source apps across eight domains and 6 risk categories. Across five representative victim GUI agents, CrossSurf raises ASR from 5.0% for a direct single-stage baseline to 30.9%, showing that cross-surface injection exposes vulnerabilities missed by same-surface attacks. Prompt-only defenses help modestly, while task-alignment and multimodal action-guard wrappers are more effective after the jump but do not eliminate the risk. Our code and data are available at https://anonymous.4open.science/r/CrossSurf/.