All vulnerabilities
CVE-2026-103922GHSA-rvm3-566m-v7fv

@capacitor/android: Capacitor Android and iOS: remote content can be loaded at the app origin via the internal HTTP proxy path

ionic-team @capacitor/androidnpmLibraries & packages
Open in ThreatlineRecord JSON
CVSS
9.3Critical
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.21%Chance of exploitation activity in the next 30 days, higher than 11% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in6.2.2Also 7.6.9, 8.5.1 and 1 moreGitHub
Published1 Oct 2026Updated 5 Oct 2026CVE List

What fixes it

  • 6.2.2@capacitor/android, npmGitHubnpm install @capacitor/android@6.2.2
  • 7.6.9@capacitor/android, npmGitHubnpm install @capacitor/android@7.6.9
  • 6.2.2@capacitor/ios, npmGitHubnpm install @capacitor/ios@6.2.2
  • 7.6.9@capacitor/ios, npmGitHubnpm install @capacitor/ios@7.6.9
  • 6.2.2github.com/ionic-team/capacitor-swift-pm, swiftGitHub
  • 7.6.9github.com/ionic-team/capacitor-swift-pm, swiftGitHub
Show all 24 fixed versions
  • 6.2.2com.capacitorjs:core, mavenGitHub<dependency><groupId>com.capacitorjs</groupId><artifactId>core</artifactId><version>6.2.2</version></dependency>
  • 7.6.9com.capacitorjs:core, mavenGitHub<dependency><groupId>com.capacitorjs</groupId><artifactId>core</artifactId><version>7.6.9</version></dependency>
  • 8.5.1@capacitor/android, npmGitHubnpm install @capacitor/android@8.5.1
  • 8.5.1@capacitor/ios, npmGitHubnpm install @capacitor/ios@8.5.1
  • 8.5.1github.com/ionic-team/capacitor-swift-pm, swiftGitHub
  • 8.5.1com.capacitorjs:core, mavenGitHub<dependency><groupId>com.capacitorjs</groupId><artifactId>core</artifactId><version>8.5.1</version></dependency>
  • 8.4.3com.capacitorjs:core, mavenGitHub<dependency><groupId>com.capacitorjs</groupId><artifactId>core</artifactId><version>8.4.3</version></dependency>
  • 8.4.3@capacitor/android, npmGitHubnpm install @capacitor/android@8.4.3
  • 8.4.3@capacitor/ios, npmGitHubnpm install @capacitor/ios@8.4.3
  • 8.4.3github.com/ionic-team/capacitor-swift-pm, swiftGitHub
  • 6.2.2github.com/ionic-team/capacitor-swift-pm, SwiftURLOSV
  • 7.6.9github.com/ionic-team/capacitor-swift-pm, SwiftURLOSV
  • 6.2.2com.capacitorjs:core, MavenOSV<dependency><groupId>com.capacitorjs</groupId><artifactId>core</artifactId><version>6.2.2</version></dependency>
  • 7.6.9com.capacitorjs:core, MavenOSV<dependency><groupId>com.capacitorjs</groupId><artifactId>core</artifactId><version>7.6.9</version></dependency>
  • 8.5.1github.com/ionic-team/capacitor-swift-pm, SwiftURLOSV
  • 8.5.1com.capacitorjs:core, MavenOSV<dependency><groupId>com.capacitorjs</groupId><artifactId>core</artifactId><version>8.5.1</version></dependency>
  • 8.4.3com.capacitorjs:core, MavenOSV<dependency><groupId>com.capacitorjs</groupId><artifactId>core</artifactId><version>8.4.3</version></dependency>
  • 8.4.3github.com/ionic-team/capacitor-swift-pm, SwiftURLOSV

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

Impact

Capacitor's WebView navigation guard validated only the host and scheme of a target URL, not its path. Because the internal HTTP proxy path (/_capacitor_http_interceptor_) is served at the application's own origin, a frame navigation to it was always treated as in-app navigation and allowed.

Loading that path as a document caused the native layer to fetch an arbitrary, caller-specified URL and return the response body to the WebView at the app's own origin. Script in that response then ran with full same-origin trust: access to localStorage, cookies, and every native capability the application exposes through its registered Capacitor plugins.

The proxy handler was additionally served **regardless of whether the CapacitorHttp plugin was enabled**, so applications that never enabled CapacitorHttp were also affected.

Exploitation requires a victim to activate a link inside the application's WebView. Any Capacitor application that renders user-controlled or unsanitized links (chat messages, comments, rich-text content) is a viable delivery surface.

Both Android and iOS are affected.

Patches

Two changes on each platform:

  1. The navigation guard now blocks frame navigations whose path is the internal

proxy path.

  1. The proxy handler is served only when CapacitorHttp is enabled, and never

for a document (main frame) request.

Legitimate CapacitorHttp usage is unaffected. fetch and XMLHttpRequest are subresource requests and do not pass through the navigation guard.

Upgrade to a patched version, then rebuild and redistribute your application.

Workarounds

If you cannot upgrade immediately, note first that **disabling CapacitorHttp is not sufficient** on affected versions, because the proxy path is served regardless of that setting.

Registered plugins are consulted before the navigation guard runs, so a small plugin can block the path. On Android, override shouldOverrideLoad(Uri url) and return true when url.getPath() starts with /_capacitor_http_interceptor_. On iOS, implement shouldOverrideLoad(_:) and return true for the same path. Returning true cancels the navigation; return null/nil for all other URLs so normal navigation is unchanged.

Independently, sanitize user-controlled link targets before rendering them in the WebView.

Text from GitHub Advisory Database

Affected versions 105

  • @capacitor/android, npm>= 6.0.0, < 6.2.2GitHub
  • @capacitor/android, npm>= 7.0.0, < 7.6.9GitHub
  • @capacitor/ios, npm>= 6.0.0, < 6.2.2GitHub
  • @capacitor/ios, npm>= 7.0.0, < 7.6.9GitHub
  • github.com/ionic-team/capacitor-swift-pm, swift>= 6.0.0, < 6.2.2GitHub
  • github.com/ionic-team/capacitor-swift-pm, swift>= 7.0.0, < 7.6.9GitHub
  • com.capacitorjs:core, maven>= 6.0.0, < 6.2.2GitHub
  • com.capacitorjs:core, maven>= 7.0.0, < 7.6.9GitHub
  • @capacitor/android, npm>= 8.5.0, < 8.5.1GitHub
  • @capacitor/ios, npm>= 8.5.0, < 8.5.1GitHub
  • github.com/ionic-team/capacitor-swift-pm, swift>= 8.5.0, < 8.5.1GitHub
  • com.capacitorjs:core, maven>= 8.5.0, < 8.5.1GitHub
  • com.capacitorjs:core, maven>= 8.3.5, < 8.4.3GitHub
  • @capacitor/android, npm>= 8.3.5, < 8.4.3GitHub
  • @capacitor/ios, npm>= 8.3.5, < 8.4.3GitHub
  • github.com/ionic-team/capacitor-swift-pm, swift>= 8.3.5, < 8.4.3GitHub
  • github.com/ionic-team/capacitor-swift-pm, swift>= 8.0.0, <= 8.3.4GitHub
  • com.capacitorjs:core, maven>= 8.0.0, <= 8.3.4GitHub
  • @capacitor/android, npm>= 8.0.0, <= 8.3.4GitHub
  • @capacitor/ios, npm>= 8.0.0, <= 8.3.4GitHub
  • capacitoraffected: >= 6.0.0, < 6.2.2CVE List
  • capacitoraffected: >= 7.0.0, < 7.6.9CVE List
  • capacitoraffected: >= 8.0.0, < 8.3.5CVE List
  • capacitoraffected: >= 8.3.5, < 8.4.3CVE List
  • capacitoraffected: >= 8.5.0, < 8.5.1CVE List
  • androidaffected: >= 8.5.0, < 8.5.1CVE List
  • androidaffected: >= 8.3.5, < 8.4.3CVE List
  • androidaffected: >= 8.0.0, < 8.3.5CVE List
  • androidaffected: >= 7.0.0, < 7.6.9CVE List
  • androidaffected: >= 6.0.0, < 6.2.2CVE List
  • iosaffected: >= 8.5.0, < 8.5.1CVE List
  • iosaffected: >= 8.3.5, < 8.4.3CVE List
  • iosaffected: >= 8.0.0, < 8.3.5CVE List
  • iosaffected: >= 7.0.0, < 7.6.9CVE List
  • iosaffected: >= 6.0.0, < 6.2.2CVE List
  • coreaffected: >= 8.5.0, < 8.5.1CVE List
  • coreaffected: >= 8.3.5, < 8.4.3CVE List
  • coreaffected: >= 8.0.0, < 8.3.5CVE List
  • coreaffected: >= 7.0.0, < 7.6.9CVE List
  • coreaffected: >= 6.0.0, < 6.2.2CVE List
  • github.com/ionic-team/capacitor-swift-pmaffected: >= 8.5.0, < 8.5.1CVE List
  • github.com/ionic-team/capacitor-swift-pmaffected: >= 8.3.5, < 8.4.3CVE List
  • github.com/ionic-team/capacitor-swift-pmaffected: >= 8.0.0, < 8.3.5CVE List
  • github.com/ionic-team/capacitor-swift-pmaffected: >= 7.0.0, < 7.6.9CVE List
  • github.com/ionic-team/capacitor-swift-pmaffected: >= 6.0.0, < 6.2.2CVE List
  • @capacitor/android, npmfrom 6.0.0, fixed in 6.2.2OSV
  • @capacitor/android, npmfrom 7.0.0, fixed in 7.6.9OSV
  • @capacitor/ios, npmfrom 6.0.0, fixed in 6.2.2OSV
  • @capacitor/ios, npmfrom 7.0.0, fixed in 7.6.9OSV
  • github.com/ionic-team/capacitor-swift-pm, SwiftURLfrom 6.0.0, fixed in 6.2.2OSV
  • github.com/ionic-team/capacitor-swift-pm, SwiftURLfrom 7.0.0, fixed in 7.6.9OSV
  • com.capacitorjs:core, Mavenfrom 6.0.0, fixed in 6.2.2OSV
  • com.capacitorjs:core, Maven6.0.0OSV
  • com.capacitorjs:core, Maven6.1.0OSV
  • com.capacitorjs:core, Maven6.1.1OSV
  • com.capacitorjs:core, Maven6.1.2OSV
  • com.capacitorjs:core, Maven6.2.0OSV
  • com.capacitorjs:core, Maven6.2.1OSV
  • com.capacitorjs:core, Mavenfrom 7.0.0, fixed in 7.6.9OSV
  • com.capacitorjs:core, Maven7.0.0OSV
  • com.capacitorjs:core, Maven7.0.1OSV
  • com.capacitorjs:core, Maven7.1.0OSV
  • com.capacitorjs:core, Maven7.2.0OSV
  • com.capacitorjs:core, Maven7.3.0OSV
  • com.capacitorjs:core, Maven7.4.0OSV
  • com.capacitorjs:core, Maven7.4.2OSV
  • com.capacitorjs:core, Maven7.4.3OSV
  • com.capacitorjs:core, Maven7.4.4OSV
  • com.capacitorjs:core, Maven7.4.5OSV
  • com.capacitorjs:core, Maven7.5.0OSV
  • com.capacitorjs:core, Maven7.6.0OSV
  • com.capacitorjs:core, Maven7.6.1OSV
  • com.capacitorjs:core, Maven7.6.2OSV
  • com.capacitorjs:core, Maven7.6.3OSV
  • com.capacitorjs:core, Maven7.6.4OSV
  • com.capacitorjs:core, Maven7.6.5OSV
  • com.capacitorjs:core, Maven7.6.6OSV
  • com.capacitorjs:core, Maven7.6.7OSV
  • com.capacitorjs:core, Maven7.6.8OSV
  • @capacitor/android, npmfrom 8.5.0, fixed in 8.5.1OSV
  • @capacitor/ios, npmfrom 8.5.0, fixed in 8.5.1OSV
  • github.com/ionic-team/capacitor-swift-pm, SwiftURLfrom 8.5.0, fixed in 8.5.1OSV
  • com.capacitorjs:core, Mavenfrom 8.5.0, fixed in 8.5.1OSV
  • com.capacitorjs:core, Maven8.5.0OSV
  • com.capacitorjs:core, Mavenfrom 8.3.5, fixed in 8.4.3OSV
  • com.capacitorjs:core, Maven8.4.0OSV
  • com.capacitorjs:core, Maven8.4.1OSV
  • com.capacitorjs:core, Maven8.4.2OSV
  • @capacitor/android, npmfrom 8.3.5, fixed in 8.4.3OSV
  • @capacitor/ios, npmfrom 8.3.5, fixed in 8.4.3OSV
  • github.com/ionic-team/capacitor-swift-pm, SwiftURLfrom 8.3.5, fixed in 8.4.3OSV
  • github.com/ionic-team/capacitor-swift-pm, SwiftURLfrom 8.0.0, through 8.3.4OSV
  • com.capacitorjs:core, Mavenfrom 8.0.0, through 8.3.4OSV
  • com.capacitorjs:core, Maven8.0.0OSV
  • com.capacitorjs:core, Maven8.0.1OSV
  • com.capacitorjs:core, Maven8.0.2OSV
  • com.capacitorjs:core, Maven8.1.0OSV
  • com.capacitorjs:core, Maven8.2.0OSV
  • com.capacitorjs:core, Maven8.3.0OSV
  • com.capacitorjs:core, Maven8.3.1OSV
  • com.capacitorjs:core, Maven8.3.2OSV
  • com.capacitorjs:core, Maven8.3.3OSV
  • com.capacitorjs:core, Maven8.3.4OSV
  • @capacitor/android, npmfrom 8.0.0, through 8.3.4OSV
  • @capacitor/ios, npmfrom 8.0.0, through 8.3.4OSV

References 11