fkie_cve-2026-103922

Capacitor is a cross-platform native runtime for web applications. From 6.0.0 until 6.2.2, 7.6.9, 8.3.5, 8.4.3, and 8.5.1, the Android and iOS WebView navigation guard validates a target URL's host and scheme but not its path, allowing a victim who activates an untrusted link to navigate a frame to /_capacitor_http_interceptor_. The native proxy can fetch an attacker-selected URL and return the response as a document at the application's own origin, allowing script in that response to access same-origin storage, cookies, and registered Capacitor plugin capabilities. Applications remain affected when CapacitorHttp is disabled because affected releases serve the proxy path regardless of that setting. This issue is fixed in versions 6.2.2, 7.6.9, 8.3.5, 8.4.3, and 8.5.1.

GHSA-rvm3-566m-v7fv — Capacitor Android and iOS: remote content can be loaded at the app origin via the internal HTTP proxy path

Affected: npm: @capacitor/android, npm: @capacitor/ios, SwiftURL: github.com/ionic-team/capacitor-swift-pm, Maven: com.capacitorjs:core

### Impact

Capacitor's WebView navigation guard validated only the **host and scheme** of a target URL, not its **path**. Because the internal HTTP proxy path (`/_capacitor_http_interceptor_`) is served at the application's own origin, a frame navigation to it was always treated as in-app navigation and allowed.

Loading that path as a document caused the native layer to fetch an arbitrary, caller-specified URL and return the response body to the WebView **at the app's own origin**. Script in that response then ran with full same-origin trust: access to `localStorage`, cookies, and every native capability the application exposes through its registered Capacitor plugins.

The proxy handler was additionally served **regardless of whether the `CapacitorHttp` plugin was enabled**, so applications that never enabled `CapacitorHttp` were also affected.

Exploitation requires a victim to activate a link inside the application's WebView. Any Capacitor application that renders user-controlled or unsanitized links (chat messages, comments, rich-text content) is a viable delivery surface.

Both **Android and iOS** are affected.

### Patches

Two changes on each platform:

1. The navigation guard now blocks frame navigations whose path is the internal proxy path. 2. The proxy handler is served only when `CapacitorHttp` is enabled, and never for a document (main frame) request.

Legitimate `CapacitorHttp` usage is unaffected. `fetch` and `XMLHttpRequest` are subresource requests a…

Most recent entries from all

fkie_cve-2026-103922

GHSA-rvm3-566m-v7fv — Capacitor Android and iOS: remote content can be loaded at the app origin via the internal HTTP proxy path