CVE-2026-103922 in Capacitor
Summary
by MITRE • 10/01/2026
Capacitor is a cross-platform native runtime for web applications. From 6.0.0 until 6.2.2, 7.6.9, 8.3.5, 8.4.3, and 8.5.1, the Android and iOS WebView navigation guard validates a target URL's host and scheme but not its path, allowing a victim who activates an untrusted link to navigate a frame to /_capacitor_http_interceptor_. The native proxy can fetch an attacker-selected URL and return the response as a document at the application's own origin, allowing script in that response to access same-origin storage, cookies, and registered Capacitor plugin capabilities. Applications remain affected when CapacitorHttp is disabled because affected releases serve the proxy path regardless of that setting. This issue is fixed in versions 6.2.2, 7.6.9, 8.3.5, 8.4.3, and 8.5.1.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 10/01/2026
Capacitor serves as a widely adopted cross-platform native runtime that enables web applications to access device features through JavaScript APIs while running within native WebView containers on Android and iOS platforms. A critical security flaw was identified in the navigation guard mechanism of Capacitor versions ranging from 6.0.0 up to specific patched releases, including 6.2.2 for version 6.x, 7.6.9 for version 7.x, and 8.3.5, 8.4.3, and 8.5.1 for the 8.x branch. This vulnerability stems from an incomplete validation logic within the WebView navigation guard, which is designed to prevent unauthorized or malicious navigations that could compromise application integrity. The flaw specifically lies in the fact that while the system correctly validates the target URL's host and scheme components, it fails to inspect the path component of the Uniform Resource Identifier. This oversight creates a significant security gap that attackers can exploit through social engineering techniques involving untrusted links.
The technical nature of this vulnerability allows an attacker who successfully tricks a victim into activating a malicious link to manipulate the navigation behavior of the application's WebView frames. By directing the frame to a specific internal path, namely /capacitor_http_interceptor, the attacker leverages a native proxy endpoint that is intended for legitimate HTTP request interception and processing purposes. Because the validation logic does not restrict access based on the URL path, any attempt to navigate to this interceptor path succeeds regardless of whether the CapacitorHttp plugin functionality is explicitly enabled or disabled in the application configuration. This means that even applications attempting to mitigate risks by disabling certain network capabilities remain vulnerable because the proxy endpoint remains accessible and functional at the specified path across all affected releases.
The operational impact of this vulnerability is severe due to its ability to facilitate a same-origin attack vector against the web application's context. When an attacker successfully navigates a frame to the interceptor, they can instruct the native proxy to fetch content from any URL selected by the attacker. The critical consequence arises when the response from this fetched URL is returned as a document at the application’s own origin. In modern browser security models and WebView implementations, resources loaded under the same origin inherit the trust level of that origin. Consequently, scripts embedded within the attacker-controlled response execute with full access to the application's same-origin storage mechanisms, including local storage, session cookies, IndexedDB, and other persistent data stores. Furthermore, these scripts gain the ability to invoke registered Capacitor plugin capabilities, effectively bypassing security boundaries intended to isolate web content from native device features such as file system access, camera usage, or sensitive API calls.
This vulnerability aligns with CWE-20 Improper Input Validation, specifically regarding the failure to validate all components of a URI path during navigation events. It also maps closely to MITRE ATT&CK techniques related to Client-side Phishing and Web Session Hijacking, as it involves tricking users into initiating actions that lead to unauthorized data access or privilege escalation within the application environment. The exploitation chain typically begins with social engineering where an unsuspecting user clicks a link hosted on a malicious domain. This action triggers the navigation guard's flawed logic, leading to the injection of attacker-controlled content into the trusted context of the Capacitor application. Once executed, this content can exfiltrate sensitive user data or perform actions on behalf of the authenticated user without their knowledge or consent.
Mitigation strategies must prioritize immediate upgrading to patched versions that address these specific version ranges. Developers using Capacitor 6.x should upgrade to at least version 6.2.2, those on version 7.x should move to 7.6.9, and users of the 8.x branch must update to one of the fixed releases: 8.3.5, 8.4.3, or 8.5.1. These updates include corrections to the navigation guard logic ensuring that path validation is performed alongside host and scheme checks, thereby preventing unauthorized access to internal proxy endpoints like /capacitor_http_interceptor. For applications unable to upgrade immediately due to dependency constraints, implementing additional client-side safeguards such as strict Content Security Policy headers can help mitigate some risks by restricting script execution sources. However, relying solely on CSP is insufficient given the native nature of this flaw; therefore, upgrading remains the only definitive remediation path. Organizations should also audit their applications for any custom implementations that might replicate similar validation gaps in other navigation or proxy handling logic to ensure comprehensive protection against input-based attacks.