CVE-2026-103922Critical· 9.3▾ AbyssalPoC availableCapacitor is a cross-platform native runtime for web applications. From 6.0.0 until 6.2.2, 7.6.9, 8.3.5, 8.4.3, and 8.5.1, the Android and iOS WebView navigation guard validates a target URL's host and scheme but not its path, allowing a…
▾ Abyssal zone — Critical with a public exploit or in-the-wild use
impact 51.2 · likelihood 0.1 · exploitation 12
A public proof-of-concept already exists for this vulnerability — see Exploit availability below.
Public exploit / PoC code seen in 1 source. Availability, not in-the-wild use.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake.
Exploit-prediction probability, daily snapshots since Oct 2.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
Last analysed / modified upstream
0.2%
1 GitHub repo
0.2% → 0.3%
Capacitor is a cross-platform native runtime for web applications. From 6.0.0 until 6.2.2, 7.6.9, 8.3.5, 8.4.3, and 8.5.1, the Android and iOS WebView navigation guard validates a target URL's host and scheme but not its path, allowing a victim who activates an untrusted link to navigate a frame to /capacitor_http_interceptor. The native proxy can fetch an attacker-selected URL and return the response as a document at the application's own origin, allowing script in that response to access same-origin storage, cookies, and registered Capacitor plugin capabilities. Applications remain affected when CapacitorHttp is disabled because affected releases serve the proxy path regardless of that setting. This issue is fixed in versions 6.2.2, 7.6.9, 8.3.5, 8.4.3, and 8.5.1.
Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Affected packages:
@capacitor/android >= 6.0.0, < 6.2.2@capacitor/android >= 7.0.0, < 7.6.9@capacitor/ios >= 6.0.0, < 6.2.2@capacitor/ios >= 7.0.0, < 7.6.9github.com/ionic-team/capacitor-swift-pm >= 6.0.0, < 6.2.2github.com/ionic-team/capacitor-swift-pm >= 7.0.0, < 7.6.9com.capacitorjs:core >= 6.0.0, < 6.2.2com.capacitorjs:core >= 7.0.0, < 7.6.9@capacitor/android >= 8.5.0, < 8.5.1@capacitor/ios >= 8.5.0, < 8.5.1github.com/ionic-team/capacitor-swift-pm >= 8.5.0, < 8.5.1com.capacitorjs:core >= 8.5.0, < 8.5.1com.capacitorjs:core >= 8.3.5, < 8.4.3@capacitor/android >= 8.3.5, < 8.4.3@capacitor/ios >= 8.3.5, < 8.4.3github.com/ionic-team/capacitor-swift-pm >= 8.3.5, < 8.4.3github.com/ionic-team/capacitor-swift-pm >= 8.0.0, <= 8.3.4com.capacitorjs:core >= 8.0.0, <= 8.3.4@capacitor/android >= 8.0.0, <= 8.3.4@capacitor/ios >= 8.0.0, <= 8.3.4Patched in:
@capacitor/android 6.2.2@capacitor/android 7.6.9@capacitor/ios 6.2.2@capacitor/ios 7.6.9github.com/ionic-team/capacitor-swift-pm 6.2.2github.com/ionic-team/capacitor-swift-pm 7.6.9com.capacitorjs:core 6.2.2com.capacitorjs:core 7.6.9@capacitor/android 8.5.1@capacitor/ios 8.5.1github.com/ionic-team/capacitor-swift-pm 8.5.1com.capacitorjs:core 8.5.1com.capacitorjs:core 8.4.3@capacitor/android 8.4.3@capacitor/ios 8.4.3github.com/ionic-team/capacitor-swift-pm 8.4.3Field changes observed since this record was first indexed.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-108261Critical· 9.3Tina is a headless content management system
CVE-2026-114125High· 8.8storybook: Storybook: Arbitrary code execution via insufficient message-origin restrictions (CVE-2026-114125)
CVE-2026-101897Medium· 5.1Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages
CVE-2026-61742Critical· 9.3DBHub is a database MCP server for Postgres, MySQL, SQL Server, Oracle, MariaDB, SQLite
CVE-2026-113798Medium· 5.4Electron: Pointer lock permission requests can be attributed to the wrong frame
CVE-2026-113800Medium· 5.4Electron: HID and USB permission checks can be attributed to the wrong origin