Capacitor: Navigation guard bypass allows content injection at app origin
Summary
Capacitor, a runtime for packaging web apps as native Android and iOS apps, does not check the path of a URL in its WebView navigation guard. A victim who clicks an untrusted link can be sent to the internal HTTP proxy path of the app, which returns attacker-selected content under the app's own origin. Script in that content can then access the app's storage, cookies and registered Capacitor plugin functions. Disabling CapacitorHttp does not prevent the issue.
Affected
- 6.0.0 up to before 6.2.2
- 7.0.0 up to before 7.6.9
- 8.0.0 up to before 8.3.5
- 8.3.5 up to before 8.4.3
- 8.5.0 up to before 8.5.1
Affected packages: @capacitor/android, @capacitor/ios, @capacitor/core (com.capacitorjs core), capacitor-swift-pm
Fixed in
- 6.2.2
- 7.6.9
- 8.3.5 (for 8.0.x up to 8.3.4)
- 8.4.3 (for 8.3.5 up to 8.4.2)
- 8.5.1 (for 8.5.0)
Workaround
Unknown. The vendor has not published a workaround. Third-party stopgaps (not verified by the vendor):
- Reject navigation to the path /_capacitor_http_interceptor_ in a custom plugin before the navigation guard runs.
- Block frame navigations to that path and sanitize user-controlled link targets before rendering them.
These are temporary measures only; apply the update.
Exploitation
- CISA SSVC: exploitation none, automatable no, technical impact total.
- No confirmed exploitation in the wild found.
- No public proof of concept found.
- Victim interaction (clicking a link in the app) is required.
Our recommendation
- Inventory all Capacitor apps and their versions, including lockfiles and native builds.
- Update to the fixed version for your release branch, then rebuild and publish the Android and iOS apps; web updates alone do not fix native builds.
- Until the update is deployed, review apps that open untrusted links (chat, email, user content, in-app browsing) and apply the temporary measures above.
- Check which plugins and stored data the apps expose to WebView content, and review them after the update.
Public exploits
Links to third-party sites, not checked by us – exploit code can contain malware. Only use it in isolated test environments.
- Proof of concept on GitHub (1 repositories)
techupdate24/capacitor-flaw-cve-2026-103922
Research sources
- GitHub Security Advisory GHSA-rvm3-566m-v7fv github.com
- Capacitor release 8.5.1 github.com
- Fix commit 430356a: block navigation to the internal HTTP proxy path github.com
- Fix commit 80b6c5e: block the HTTP proxy path in subframes github.com
- OSV entry CVE-2026-103922 osv.dev
- CVE record (CVE Program JSON) raw.githubusercontent.com
- GitLab advisory for @capacitor/ios advisories.gitlab.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 03:38.
Original description (NVD)
Capacitor is a cross-platform native runtime for web applications. From 6.0.0 until 6.2.2, 7.6.9, 8.3.5, 8.4.3, and 8.5.1, the Android and iOS WebView navigation guard validates a target URL's host and scheme but not its path, allowing a victim who activates an untrusted link to navigate a frame to /_capacitor_http_interceptor_. The native proxy can fetch an attacker-selected URL and return the response as a document at the application's own origin, allowing script in that response to access same-origin storage, cookies, and registered Capacitor plugin capabilities. Applications remain affected when CapacitorHttp is disabled because affected releases serve the proxy path regardless of that setting. This issue is fixed in versions 6.2.2, 7.6.9, 8.3.5, 8.4.3, and 8.5.1.
NVD references (8)
- https://github.com/ionic-team/capacitor/commit/430356a91e1419fc66862dc09835081aa501677e
- https://github.com/ionic-team/capacitor/commit/80b6c5e81d062e1e158914040f49e044d95b7ccb
- https://github.com/ionic-team/capacitor/commit/85ccc44151fdd5ae5e0d806d875766ef4b84ad5d
- https://github.com/ionic-team/capacitor/commit/af9a287fef45f0ac68ce640cb42fed2d06b0f1b4
- https://github.com/ionic-team/capacitor/commit/d5e3170ba0ff155fc542b7e6d16cff5201406540
- https://github.com/ionic-team/capacitor/commit/ee586ae680887ba99d066616f976db149542d922
- https://github.com/ionic-team/capacitor/releases/tag/8.5.1
- https://github.com/ionic-team/capacitor/security/advisories/GHSA-rvm3-566m-v7fv
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.