In the evolving landscape of mobile application security, a significant vulnerability identified as CVE-2026-103922 has emerged within Capacitor, an essential framework for building cross-platform applications. This flaw has the potential to allow adversaries to execute malicious remote content within vulnerable Android and iOS applications, masquerading as the trust of the app’s own origin. As such, the implications of this vulnerability could pose serious risks to users and developers alike.
Assigned a high Common Vulnerability Scoring System (CVSS) rating of 9.3, this vulnerability affects the WebView navigation handling component of Capacitor. The flaw is particularly serious as it may expose same-origin data, including sensitive cookies and local storage, alongside native functionalities offered through registered Capacitor plugins. The root of the issue stems from inadequate validation processes within Capacitor’s WebView navigation guard, which conducts checks on the target URL’s scheme and host but neglects to scrutinize its path.
This oversight enables a significant security lapse, allowing navigation to Capacitor’s internal endpoint, known as /_capacitor_httpinterceptor, which is erroneously treated as a legitimate target for navigation within applications. When an attacker successfully convinces a victim to click on a malevolent link embedded within an application’s WebView, this internal proxy endpoint can be exploited to retrieve a remote URL stipulated by the attacker.
What amplifies the severity of this flaw is the nature of the response to requests made through this internal proxy. The information obtained from the remote URL is returned to the WebView as if it originated from the trusted application rather than from an external source. As a result, any JavaScript included in the attacker’s response can inherit the same-origin privileges, granting the malicious code access to critical functionalities within the Capacitor application. This includes the ability to manipulate localStorage and cookies, as well as utilizing any sensitive native capabilities allowed through configured Capacitor plugins.
The magnitude of the threat varies, contingent on the app’s specific plugin configuration and the data being stored. Applications that handle authentication tokens, sensitive user information, or device features and backend API interactions face particularly pronounced risks due to this vulnerability. The weakness is classified under common weakness enumeration (CWE) categories, namely CWE-346, which pertains to origin-validation errors, and CWE-441, which refers to unintended proxy or “confused deputy” conditions.
This vulnerability is not limited to one platform; it affects both @capacitor/android and @capacitor/ios, in addition to the Maven com.capacitorjs:core package and the Swift Package Manager distribution. All versions from Capacitor releases 6.0.0 to 6.2.1, 7.0.0 to 7.6.8, and various 8.x releases prior to the patched versions are susceptible to this flaw. The secure versions to update to include 6.2.2, 7.6.9, 8.3.5, 8.4.3, and 8.5.1.
It is critical to note that merely disabling the CapacitorHttp plugin does not safeguard vulnerable applications. In the affected versions, the internal proxy handler remains accessible, even if the plugin has not been enabled, thus broadening the exposure of applications that do not utilize the Capacitor HTTP proxy feature intentionally.
To address this alarming issue, the maintainers of Capacitor have implemented patches that prevent frame navigations to the internal proxy path. They have also revised the access to the proxy handler so that it remains available only when the CapacitorHttp plugin is actively enabled. The updated implementation additionally restricts the proxy endpoint from processing main-document requests while allowing legitimate subresource requests such as fetch and XMLHttpRequest to operate normally.
For developers, the imperative action to take is to upgrade to a patched version of Capacitor and to rebuild and redistribute the affected Android and iOS applications without delay. Organizations finding themselves unable to patch immediately can implement plugin overrides in Android or iOS to cancel navigation attempts that begin with /_capacitor_httpinterceptor. Moreover, it is recommended that developers sanitize and restrict user-controlled links rendered within WebViews, particularly in applications that permit chat messages, comments, or the inclusion of external content, to mitigate security risks moving forward.
In summation, the discovery of this vulnerability necessitates prompt action not only from developers but also from organizations reliant on Capacitor for their mobile applications to ensure the continued safety and security of their user data.