Critical, CVSS 9.3npmAmendedPublished
Capacitor Android and iOS: remote content can be loaded at the app origin via the internal HTTP proxy path
CVE-2026-103922 · GHSA-rvm3-566m-v7fv
- Affected
- npm @capacitor/android >= 6.0.0, < 6.2.2; >= 7.0.0, < 7.6.9; >= 8.5.0, < 8.5.1; >= 8.3.5, < 8.4.3; >= 8.0.0, <= 8.3.4
- Fixed in
- 8.4.38.5.16.2.27.6.9· Partial vendor fix
- Issue
- Impact Capacitor's WebView navigation guard validated only the host and scheme of a target URL, not its path. Because the internal HTTP proxy path (/capacitorhttpinterceptor) is served at the application's own origin, a frame navigation to it was always treated as in-app navigation and allowed. Loading that path as a document caused the native layer to fetch an arbitrary, caller-specified URL and return the response body to the WebView at the app's own origin. Script in that response then ran with full same-origin trust: access to localStorage, cookies, and every native capability the application exposes through its registered Capacitor plugins. The proxy handler was additionally served regardless of whether the CapacitorHttp plugin was enabled, so applications that never enabled CapacitorHttp were also affected. Exploitation requires a victim to activate a link inside the application's WebView. Any Capacitor application that renders user-controlled or unsanitized links (chat…
Recommended action: Upgrade to 8.5.1, 8.4.3, 7.6.9 or 6.2.2 by release line; some affected versions have no fix yet, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.