Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-103922— Capacitor Android and iOS: remote content can be loaded at the app origin via the internal HTTP proxy path

Quick assessment

Affected
ionic-team capacitor
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Capacitor 是一个用于 Web 应用的跨平台原生运行时。在 6.0.0 至 6.2.2、7.6.9、8.3.5、8.4.3 和 8.5.1 版本中，Android 和 iOS 的 WebView 导航守卫机制仅验证目标 URL 的主机名（host）和协议（scheme），而未对其路径（path）进行校验。这使得攻击者能够诱导受害者点击一个不可信的链接，从而将某个框架（frame）导航至 路径。 该原生代理（native proxy）随后可以获取由攻击者指定的 URL，并将响应作为文档返回到应用自身的源（or

CVSS 9.3 · Critical EPSS 0.21% · P11

Possible ATT&CK Techniques 1 AI

T1059.007 · JavaScript

Affected Version Matrix 25

VendorProduct Version RangeStatus
@capacitor android >= 8.5.0, < 8.5.1 affected
>= 8.3.5, < 8.4.3 affected
>= 8.0.0, < 8.3.5 affected
>= 7.0.0, < 7.6.9 affected
>= 6.0.0, < 6.2.2 affected
@capacitor ios >= 8.5.0, < 8.5.1 affected
>= 8.3.5, < 8.4.3 affected
>= 8.0.0, < 8.3.5 affected
>= 7.0.0, < 7.6.9 affected
>= 6.0.0, < 6.2.2 affected
com.capacitorjs core >= 8.5.0, < 8.5.1 affected
>= 8.3.5, < 8.4.3 affected
>= 8.0.0, < 8.3.5 affected
>= 7.0.0, < 7.6.9 affected
>= 6.0.0, < 6.2.2 affected
ionic-team capacitor >= 6.0.0, < 6.2.2 affected
>= 7.0.0, < 7.6.9 affected
>= 8.0.0, < 8.3.5 affected
>= 8.3.5, < 8.4.3 affected
>= 8.5.0, < 8.5.1 affected
swift github.com/ionic-team/capacitor-swift-pm >= 8.5.0, < 8.5.1 affected
>= 8.3.5, < 8.4.3 affected
>= 8.0.0, < 8.3.5 affected
>= 7.0.0, < 7.6.9 affected
>= 6.0.0, < 6.2.2 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-103922

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Capacitor Android and iOS: remote content can be loaded at the app origin via the internal HTTP proxy path
Source: CVE Program / CVE List V5
Vulnerability Description
Capacitor is a cross-platform native runtime for web applications. From 6.0.0 until 6.2.2, 7.6.9, 8.3.5, 8.4.3, and 8.5.1, the Android and iOS WebView navigation guard validates a target URL's host and scheme but not its path, allowing a victim who activates an untrusted link to navigate a frame to /_capacitor_http_interceptor_. The native proxy can fetch an attacker-selected URL and return the response as a document at the application's own origin, allowing script in that response to access same-origin storage, cookies, and registered Capacitor plugin capabilities. Applications remain affected when CapacitorHttp is disabled because affected releases serve the proxy path regardless of that setting. This issue is fixed in versions 6.2.2, 7.6.9, 8.3.5, 8.4.3, and 8.5.1.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
源验证错误
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
ionic-team capacitor >= 6.0.0, < 6.2.2 -
@capacitor android >= 8.5.0, < 8.5.1 -
@capacitor ios >= 8.5.0, < 8.5.1 -
com.capacitorjs core >= 8.5.0, < 8.5.1 -
swift github.com/ionic-team/capacitor-swift-pm >= 8.5.0, < 8.5.1 -

II. Public POCs for CVE-2026-103922

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-103922

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-103922 (6)

Vendor Advisories for CVE-2026-103922 (1)

Vendor Pages for CVE-2026-103922 (1)

IV. Related Vulnerabilities

Same weakness: CWE-346

V. Comments for CVE-2026-103922

No comments yet

Leave a comment