FKIE_CVE-2026-103922

Vulnerability from fkie_nvd - Published: 2026-10-01 18:17 - Updated: 2026-10-01 19:17
Severity
9.3 (Critical) - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N
Summary
Capacitor is a cross-platform native runtime for web applications. From 6.0.0 until 6.2.2, 7.6.9, 8.3.5, 8.4.3, and 8.5.1, the Android and iOS WebView navigation guard validates a target URL's host and scheme but not its path, allowing a victim who activates an untrusted link to navigate a frame to /_capacitor_http_interceptor_. The native proxy can fetch an attacker-selected URL and return the response as a document at the application's own origin, allowing script in that response to access same-origin storage, cookies, and registered Capacitor plugin capabilities. Applications remain affected when CapacitorHttp is disabled because affected releases serve the proxy path regardless of that setting. This issue is fixed in versions 6.2.2, 7.6.9, 8.3.5, 8.4.3, and 8.5.1.
References
security-advisories@github.comhttps://github.com/ionic-team/capacitor/commit/430356a91e1419fc66862dc09835081aa501677e
security-advisories@github.comhttps://github.com/ionic-team/capacitor/commit/80b6c5e81d062e1e158914040f49e044d95b7ccb
security-advisories@github.comhttps://github.com/ionic-team/capacitor/commit/85ccc44151fdd5ae5e0d806d875766ef4b84ad5d
security-advisories@github.comhttps://github.com/ionic-team/capacitor/commit/af9a287fef45f0ac68ce640cb42fed2d06b0f1b4
security-advisories@github.comhttps://github.com/ionic-team/capacitor/commit/d5e3170ba0ff155fc542b7e6d16cff5201406540
security-advisories@github.comhttps://github.com/ionic-team/capacitor/commit/ee586ae680887ba99d066616f976db149542d922
security-advisories@github.comhttps://github.com/ionic-team/capacitor/releases/tag/8.5.1
security-advisories@github.comhttps://github.com/ionic-team/capacitor/security/advisories/GHSA-rvm3-566m-v7fv
Impacted products
Vendor Product Version
To clipboard 

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "capacitor",
          "vendor": "ionic-team",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 6.0.0, \u003c 6.2.2"
            },
            {
              "status": "affected",
              "version": "\u003e= 7.0.0, \u003c 7.6.9"
            },
            {
              "status": "affected",
              "version": "\u003e= 8.0.0, \u003c 8.3.5"
            },
            {
              "status": "affected",
              "version": "\u003e= 8.3.5, \u003c 8.4.3"
            },
            {
              "status": "affected",
              "version": "\u003e= 8.5.0, \u003c 8.5.1"
            }
          ]
        },
        {
          "product": "android",
          "vendor": "@capacitor",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 8.5.0, \u003c 8.5.1"
            },
            {
              "status": "affected",
              "version": "\u003e= 8.3.5, \u003c 8.4.3"
            },
            {
              "status": "affected",
              "version": "\u003e= 8.0.0, \u003c 8.3.5"
            },
            {
              "status": "affected",
              "version": "\u003e= 7.0.0, \u003c 7.6.9"
            },
            {
              "status": "affected",
              "version": "\u003e= 6.0.0, \u003c 6.2.2"
            }
          ]
        },
        {
          "product": "ios",
          "vendor": "@capacitor",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 8.5.0, \u003c 8.5.1"
            },
            {
              "status": "affected",
              "version": "\u003e= 8.3.5, \u003c 8.4.3"
            },
            {
              "status": "affected",
              "version": "\u003e= 8.0.0, \u003c 8.3.5"
            },
            {
              "status": "affected",
              "version": "\u003e= 7.0.0, \u003c 7.6.9"
            },
            {
              "status": "affected",
              "version": "\u003e= 6.0.0, \u003c 6.2.2"
            }
          ]
        },
        {
          "product": "core",
          "vendor": "com.capacitorjs",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 8.5.0, \u003c 8.5.1"
            },
            {
              "status": "affected",
              "version": "\u003e= 8.3.5, \u003c 8.4.3"
            },
            {
              "status": "affected",
              "version": "\u003e= 8.0.0, \u003c 8.3.5"
            },
            {
              "status": "affected",
              "version": "\u003e= 7.0.0, \u003c 7.6.9"
            },
            {
              "status": "affected",
              "version": "\u003e= 6.0.0, \u003c 6.2.2"
            }
          ]
        },
        {
          "product": "github.com/ionic-team/capacitor-swift-pm",
          "vendor": "swift",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 8.5.0, \u003c 8.5.1"
            },
            {
              "status": "affected",
              "version": "\u003e= 8.3.5, \u003c 8.4.3"
            },
            {
              "status": "affected",
              "version": "\u003e= 8.0.0, \u003c 8.3.5"
            },
            {
              "status": "affected",
              "version": "\u003e= 7.0.0, \u003c 7.6.9"
            },
            {
              "status": "affected",
              "version": "\u003e= 6.0.0, \u003c 6.2.2"
            }
          ]
        }
      ],
      "source": "security-advisories@github.com"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Capacitor is a cross-platform native runtime for web applications. From 6.0.0 until 6.2.2, 7.6.9, 8.3.5, 8.4.3, and 8.5.1, the Android and iOS WebView navigation guard validates a target URL\u0027s host and scheme but not its path, allowing a victim who activates an untrusted link to navigate a frame to /_capacitor_http_interceptor_. The native proxy can fetch an attacker-selected URL and return the response as a document at the application\u0027s own origin, allowing script in that response to access same-origin storage, cookies, and registered Capacitor plugin capabilities. Applications remain affected when CapacitorHttp is disabled because affected releases serve the proxy path regardless of that setting. This issue is fixed in versions 6.2.2, 7.6.9, 8.3.5, 8.4.3, and 8.5.1."
    }
  ],
  "id": "CVE-2026-103922",
  "lastModified": "2026-10-01T19:17:18.760",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 9.3,
          "baseSeverity": "CRITICAL",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "scope": "CHANGED",
          "userInteraction": "REQUIRED",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 5.8,
        "source": "security-advisories@github.com",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-103922",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2026-10-01T18:01:35.925716Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2026-10-01T18:17:12.840",
  "references": [
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/ionic-team/capacitor/commit/430356a91e1419fc66862dc09835081aa501677e"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/ionic-team/capacitor/commit/80b6c5e81d062e1e158914040f49e044d95b7ccb"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/ionic-team/capacitor/commit/85ccc44151fdd5ae5e0d806d875766ef4b84ad5d"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/ionic-team/capacitor/commit/af9a287fef45f0ac68ce640cb42fed2d06b0f1b4"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/ionic-team/capacitor/commit/d5e3170ba0ff155fc542b7e6d16cff5201406540"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/ionic-team/capacitor/commit/ee586ae680887ba99d066616f976db149542d922"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/ionic-team/capacitor/releases/tag/8.5.1"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/ionic-team/capacitor/security/advisories/GHSA-rvm3-566m-v7fv"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Received",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-346"
        },
        {
          "lang": "en",
          "value": "CWE-441"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Secondary"
    }
  ]
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.