CVE-2026-103922: Capacitor Android and iOS Remote Content Loading Vulnerability
Summary
CVE-2026-103922: Impact Capacitor's WebView navigation guard validated only the host and scheme of a target URL, not its path. Affects @capacitor/android across 5 version ranges.
>= 6.0.0, < 6.2.2
>= 7.0.0, < 7.6.9
>= 8.0.0, <= 8.3.4
>= 8.3.5, < 8.4.3
>= 8.5.0, < 8.5.1
Fixed in 4 releases; the minimum fixed version depends on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Capacitor is an open-source framework that enables developers to build cross-platform mobile applications using web technologies. It provides a bridge between web applications and native mobile functionalities, allowing developers to access device features through plugins. The framework is widely used for creating hybrid applications that run on both Android and iOS platforms. However, a critical vulnerability has been identified that allows remote content to be loaded at the app's origin, posing significant security risks.
Vulnerability Detail
The vulnerability arises from Capacitor's WebView navigation guard, which only validates the host and scheme of a target URL, neglecting the path. This oversight allows navigation to the internal HTTP proxy path ('/capacitor_http_interceptor') at the application's origin. When a document is loaded from this path, it enables the native layer to fetch arbitrary URLs specified by the caller, returning the response body to the WebView with full same-origin trust. This means that any script in the response can access sensitive data such as localStorage and cookies, as well as any native capabilities exposed through Capacitor plugins. The vulnerability affects both Android and iOS platforms and requires user interaction to exploit, specifically by clicking on a link within the WebView.
How To Fix
Latest published version: 8.5.3 as of 22 Oct 2026
npm install @capacitor/android@8.5.3Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
>= 6.0.0, < 6.2.26.2.2npm install @capacitor/android@6.2.2 -
>= 7.0.0, < 7.6.97.6.9npm install @capacitor/android@7.6.9 -
>= 8.3.5, < 8.4.38.4.3npm install @capacitor/android@8.4.3 -
>= 8.5.0, < 8.5.18.5.1npm install @capacitor/android@8.5.1
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
If immediate upgrading is not possible, you can implement a workaround by creating a small plugin to block the internal proxy path. On Android, override the 'shouldOverrideLoad(Uri url)' method and return true when 'url.getPath()' starts with '/capacitor_http_interceptor'. On iOS, implement 'shouldOverrideLoad(_:) method' and return true for the same path. This will cancel the navigation for that specific path while allowing normal navigation for all other URLs.
Conclusion
The identified vulnerability in Capacitor allows for remote content to be loaded at the app's origin, posing significant security risks. It is crucial for developers to upgrade to the patched versions of the affected packages or implement the provided workarounds to mitigate the risks associated with this vulnerability.
See every vulnerability recorded for @capacitor/android →
FAQ
The CVSS score of this vulnerability is 9.3, indicating a critical severity level.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. You can check your application using the Vulert playground without requiring any signup.
Both Android and iOS platforms are affected by this vulnerability.
You can implement a workaround by blocking the internal proxy path using a small plugin as described in the workaround section.
No, disabling the CapacitorHttp plugin is not sufficient, as the proxy path is served regardless of that setting.
