CVE-2026-103922

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-103922
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-103922.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-103922
Aliases
  • GHSA-rvm3-566m-v7fv
Published
2026-10-01T17:27:05Z
Modified
2026-10-02T03:47:57Z
Severity
  • 9.3 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N CVSS Calculator
Summary
Capacitor Android and iOS: remote content can be loaded at the app origin via the internal HTTP proxy path
Details

Capacitor is a cross-platform native runtime for web applications. From 6.0.0 until 6.2.2, 7.6.9, 8.3.5, 8.4.3, and 8.5.1, the Android and iOS WebView navigation guard validates a target URL's host and scheme but not its path, allowing a victim who activates an untrusted link to navigate a frame to /capacitor_http_interceptor. The native proxy can fetch an attacker-selected URL and return the response as a document at the application's own origin, allowing script in that response to access same-origin storage, cookies, and registered Capacitor plugin capabilities. Applications remain affected when CapacitorHttp is disabled because affected releases serve the proxy path regardless of that setting. This issue is fixed in versions 6.2.2, 7.6.9, 8.3.5, 8.4.3, and 8.5.1.

Database specific 
{
    "cna_assigner":  "GitHub_M",
    "cwe_ids":  [
        "CWE-346",
        "CWE-441"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/103xxx/CVE-2026-103922.json",
    "unresolved_ranges":  [
        {
            "extracted_events":  [
                {
                    "introduced":  "8.0.0"
                },
                {
                    "fixed":  "8.3.5"
                },
                {
                    "introduced":  "8.0.0"
                },
                {
                    "fixed":  "8.3.5"
                },
                {
                    "introduced":  "8.0.0"
                },
                {
                    "fixed":  "8.3.5"
                },
                {
                    "introduced":  "8.0.0"
                },
                {
                    "fixed":  "8.3.5"
                },
                {
                    "introduced":  "8.0.0"
                },
                {
                    "fixed":  "8.3.5"
                }
            ],
            "source":  "AFFECTED_FIELD"
        }
    ]
}
References

Affected packages

Git / github.com/ionic-team/capacitor

Affected ranges

Type
GIT
Repo
https://github.com/ionic-team/capacitor
Events
Introduced
5b2ab7c68db4e77b8b2961e927acc5a708ee260f
Fixed
4d377eb2d3eabf83f9e6d1c07cb50d92c06db523
Introduced
cdc5b51384293edc69236c9f2d2f9c5b63aa7259
Fixed
60a677eae8bb27667e8c5c518b38e855c7228968
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
82428936581035795b1640e60dc92b2a8d5eeed3
Introduced
3ab4139bd0b8863cadcb175180ea941f4c244f08
Fixed
0c9e35dec13a99ec4a582a2edc536cbec96bf27d
Database specific
Show details 
{
    "extracted_events":  [
        {
            "introduced":  "6.0.0"
        },
        {
            "fixed":  "6.2.2"
        },
        {
            "introduced":  "7.0.0"
        },
        {
            "fixed":  "7.6.9"
        },
        {
            "introduced":  "8.3.5"
        },
        {
            "fixed":  "8.4.3"
        },
        {
            "introduced":  "8.5.0"
        },
        {
            "fixed":  "8.5.1"
        }
    ],
    "source":  "AFFECTED_FIELD"
}

Affected versions

6.*
6.0.0
6.1.0
6.1.1
6.1.2
6.2.0
6.2.1
7.*
7.0.0
7.0.1
7.1.0
7.2.0
7.3.0
7.4.0
7.4.1
7.4.2
7.4.3
7.4.4
7.4.5
7.5.0
7.6.0
7.6.1
7.6.2
7.6.3
7.6.4
7.6.5
7.6.6
7.6.7
7.6.8
8.*
8.0.0
8.0.0-alpha.1
8.0.0-alpha.2
8.0.0-alpha.3
8.0.0-beta.0
8.0.1
8.0.2
8.1.0
8.2.0
8.3.0
8.3.1
8.3.2
8.3.3
8.3.4
8.4.0
8.4.1
8.4.2
8.5.0

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-103922.json"