Disclosure summary
Capacitor is a cross-platform native runtime for web applications. From 6.0.0 until 6.2.2, 7.6.9, 8.3.5, 8.4.3, and 8.5.1, the Android and iOS WebView navigation guard validates a target URL's host and scheme but not its path, allowing a victim who activates an untrusted link to navigate a frame to /_capacitor_http_interceptor_. The native proxy can fetch an attacker-selected URL and return the response as a document at the application's own origin, allowing script in that response to access same-origin storage, cookies, and registered Capacitor plugin capabilities. Applications remain affected when CapacitorHttp is disabled because affected releases serve the proxy path regardless of that setting. This issue is fixed in versions 6.2.2, 7.6.9, 8.3.5, 8.4.3, and 8.5.1.
Source-reported weakness categories
CWE-346, CWE-441
Source-specific records & product guidance
Sources retain their own attribution and scoring. Follow the original record to confirm affected versions, fixed releases, and configuration conditions.
GitHub Reviewed Security Advisories · GHSA-rvm3-566m-v7fv
Open original source · Updated Oct 05, 2026
Capacitor Android and iOS: remote content can be loaded at the app origin via the internal HTTP proxy path
Source severity: CRITICAL / 0
| Ecosystem | Package | Affected range | First patched |
|---|---|---|---|
| npm | @capacitor/android | >= 6.0.0, < 6.2.2 | 6.2.2 |
| npm | @capacitor/android | >= 7.0.0, < 7.6.9 | 7.6.9 |
| npm | @capacitor/ios | >= 6.0.0, < 6.2.2 | 6.2.2 |
| npm | @capacitor/ios | >= 7.0.0, < 7.6.9 | 7.6.9 |
| swift | github.com/ionic-team/capacitor-swift-pm | >= 6.0.0, < 6.2.2 | 6.2.2 |
| swift | github.com/ionic-team/capacitor-swift-pm | >= 7.0.0, < 7.6.9 | 7.6.9 |
| maven | com.capacitorjs:core | >= 6.0.0, < 6.2.2 | 6.2.2 |
| maven | com.capacitorjs:core | >= 7.0.0, < 7.6.9 | 7.6.9 |
| npm | @capacitor/android | >= 8.5.0, < 8.5.1 | 8.5.1 |
| npm | @capacitor/ios | >= 8.5.0, < 8.5.1 | 8.5.1 |
| swift | github.com/ionic-team/capacitor-swift-pm | >= 8.5.0, < 8.5.1 | 8.5.1 |
| maven | com.capacitorjs:core | >= 8.5.0, < 8.5.1 | 8.5.1 |
| maven | com.capacitorjs:core | >= 8.3.5, < 8.4.3 | 8.4.3 |
| npm | @capacitor/android | >= 8.3.5, < 8.4.3 | 8.4.3 |
| npm | @capacitor/ios | >= 8.3.5, < 8.4.3 | 8.4.3 |
| swift | github.com/ionic-team/capacitor-swift-pm | >= 8.3.5, < 8.4.3 | 8.4.3 |
| swift | github.com/ionic-team/capacitor-swift-pm | >= 8.0.0, | Not supplied |
| maven | com.capacitorjs:core | >= 8.0.0, | Not supplied |
| npm | @capacitor/android | >= 8.0.0, | Not supplied |
| npm | @capacitor/ios | >= 8.0.0, | Not supplied |
NIST National Vulnerability Database · NVD-CVE-2026-103922
Open original source · Updated Oct 02, 2026
Only CPE matches marked vulnerable=true are indexed. AND/OR platform conditions must be checked in the original NVD record.
Original records & references
- NIST NVD record
- CVE Program record
- github.com
- github.com
- github.com
- github.com
- github.com
- github.com
- github.com
- github.com
PUBLISHED 2026-10-01T14:17:12-04:00
MODIFIED 2026-10-02T14:44:11-04:00
INGESTED 2026-10-06T11:45:14-04:00