CVE-2026-103922: CWE-346: Origin Validation Error in ionic-team capacitor
Capacitor is a cross-platform native runtime for web applications. From 6.0.0 until 6.2.2, 7.6.9, 8.3.5, 8.4.3, and 8.5.1, the Android and iOS WebView navigation guard validates a target URL's host and scheme but not its path, allowing a victim who activates an untrusted link to navigate a frame to /_capacitor_http_interceptor_. The native proxy can fetch an attacker-selected URL and return the response as a document at the application's own origin, allowing script in that response to access same-origin storage, cookies, and registered Capacitor plugin capabilities. Applications remain affected when CapacitorHttp is disabled because affected releases serve the proxy path regardless of that setting. This issue is fixed in versions 6.2.2, 7.6.9, 8.3.5, 8.4.3, and 8.5.1.
AI Analysis
Technical Summary
The vulnerability in Capacitor's Android and iOS WebView navigation guard arises because it validates the host and scheme of target URLs but not the path. An attacker can exploit this by causing a victim to activate a crafted link that navigates a frame to /_capacitor_http_interceptor_, which acts as a native proxy fetching attacker-selected URLs. The response is served as a document at the application's origin, allowing malicious scripts to access same-origin storage, cookies, and Capacitor plugin capabilities. This affects multiple Capacitor versions as specified and remains exploitable even if CapacitorHttp is disabled. The issue is resolved in the specified fixed versions.
Potential Impact
Successful exploitation allows an attacker to execute scripts in the context of the vulnerable application’s origin, leading to unauthorized access to sensitive data such as storage and cookies, and potentially misuse of Capacitor plugin capabilities. This can result in significant confidentiality and integrity breaches within affected applications.
Mitigation Recommendations
A fix is available in Capacitor versions 6.2.2, 7.6.9, 8.3.5, 8.4.3, and 8.5.1. Users should upgrade to these versions to remediate the vulnerability. Since the issue persists even when CapacitorHttp is disabled, disabling this feature is not an effective mitigation. No other vendor advisory or temporary workaround is provided.
CVE-2026-103922: CWE-346: Origin Validation Error in ionic-team capacitor
Description
Capacitor is a cross-platform native runtime for web applications. From 6.0.0 until 6.2.2, 7.6.9, 8.3.5, 8.4.3, and 8.5.1, the Android and iOS WebView navigation guard validates a target URL's host and scheme but not its path, allowing a victim who activates an untrusted link to navigate a frame to /_capacitor_http_interceptor_. The native proxy can fetch an attacker-selected URL and return the response as a document at the application's own origin, allowing script in that response to access same-origin storage, cookies, and registered Capacitor plugin capabilities. Applications remain affected when CapacitorHttp is disabled because affected releases serve the proxy path regardless of that setting. This issue is fixed in versions 6.2.2, 7.6.9, 8.3.5, 8.4.3, and 8.5.1.
CVSS v3.1
Score 9.3critical
Affected software
ionic-team
capacitor
@capacitor
android
@capacitor
ios
com.capacitorjs
core
swift
github.com/ionic-team/capacitor-swift-pm
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The vulnerability in Capacitor's Android and iOS WebView navigation guard arises because it validates the host and scheme of target URLs but not the path. An attacker can exploit this by causing a victim to activate a crafted link that navigates a frame to /_capacitor_http_interceptor_, which acts as a native proxy fetching attacker-selected URLs. The response is served as a document at the application's origin, allowing malicious scripts to access same-origin storage, cookies, and Capacitor plugin capabilities. This affects multiple Capacitor versions as specified and remains exploitable even if CapacitorHttp is disabled. The issue is resolved in the specified fixed versions.
Potential Impact
Successful exploitation allows an attacker to execute scripts in the context of the vulnerable application’s origin, leading to unauthorized access to sensitive data such as storage and cookies, and potentially misuse of Capacitor plugin capabilities. This can result in significant confidentiality and integrity breaches within affected applications.
Mitigation Recommendations
A fix is available in Capacitor versions 6.2.2, 7.6.9, 8.3.5, 8.4.3, and 8.5.1. Users should upgrade to these versions to remediate the vulnerability. Since the issue persists even when CapacitorHttp is disabled, disabling this feature is not an effective mitigation. No other vendor advisory or temporary workaround is provided.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- GitHub_M
- Date Reserved
- 2026-10-01T14:20:19.154Z
- Cvss Version
- 3.1
- State
- PUBLISHED
Threat ID: 6abea718a43b0b3b89e13cef
Added to database: 10/01/2026, 18:31:52 UTC
Last enriched: 10/01/2026, 18:46:26 UTC
Last updated: 10/01/2026, 19:41:31 UTC
Views: 4
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.