CVE-2026-103922

Published: Ott 01, 2026 Last Modified: Ott 01, 2026
ExploitDB:
Other exploit source:
Google Dorks:
CRITICAL 9,3
Source: [email protected]
Attack Vector: network
Attack Complexity: low
Privileges Required: none
User Interaction: required
Scope: changed
Confidentiality: high
Integrity: high
Availability: none

Description

AI Translation Available

Capacitor is a cross-platform native runtime for web applications. From 6.0.0 until 6.2.2, 7.6.9, 8.3.5, 8.4.3, and 8.5.1, the Android and iOS WebView navigation guard validates a target URL's host and scheme but not its path, allowing a victim who activates an untrusted link to navigate a frame to /_capacitor_http_interceptor_. The native proxy can fetch an attacker-selected URL and return the response as a document at the application's own origin, allowing script in that response to access same-origin storage, cookies, and registered Capacitor plugin capabilities. Applications remain affected when CapacitorHttp is disabled because affected releases serve the proxy path regardless of that setting. This issue is fixed in versions 6.2.2, 7.6.9, 8.3.5, 8.4.3, and 8.5.1.

346

Origin Validation Error

Draft
Abstraction: Class Structure: Simple
Common Consequences
Security Scopes Affected:
Access Control Other
Potential Impacts:
Gain Privileges Or Assume Identity Varies By Context
Applicable Platforms
Technologies: Not Technology-Specific, Web Based
View CWE Details
441

Unintended Proxy or Intermediary ('Confused Deputy')

Draft
Abstraction: Class Structure: Simple
Common Consequences
Security Scopes Affected:
Non-Repudiation Access Control
Potential Impacts:
Gain Privileges Or Assume Identity Hide Activities Execute Unauthorized Code Or Commands
Applicable Platforms
All platforms may be affected
View CWE Details
https://github.com/ionic-team/capacitor/commit/430356a91e14…
https://github.com/ionic-team/capacitor/commit/430356a91e1419fc66862dc09835081a…
https://github.com/ionic-team/capacitor/commit/80b6c5e81d06…
https://github.com/ionic-team/capacitor/commit/80b6c5e81d062e1e158914040f49e044…
https://github.com/ionic-team/capacitor/commit/85ccc44151fd…
https://github.com/ionic-team/capacitor/commit/85ccc44151fdd5ae5e0d806d875766ef…
https://github.com/ionic-team/capacitor/commit/af9a287fef45…
https://github.com/ionic-team/capacitor/commit/af9a287fef45f0ac68ce640cb42fed2d…
https://github.com/ionic-team/capacitor/commit/d5e3170ba0ff…
https://github.com/ionic-team/capacitor/commit/d5e3170ba0ff155fc542b7e6d16cff52…
https://github.com/ionic-team/capacitor/commit/ee586ae68088…
https://github.com/ionic-team/capacitor/commit/ee586ae680887ba99d066616f976db14…
https://github.com/ionic-team/capacitor/releases/tag/8.5.1
https://github.com/ionic-team/capacitor/releases/tag/8.5.1
https://github.com/ionic-team/capacitor/security/advisories…
https://github.com/ionic-team/capacitor/security/advisories/GHSA-rvm3-566m-v7fv