A critical security vulnerability in Capacitor could allow attacker-controlled web content to run under a mobile application’s trusted origin, potentially exposing stored application data and native device capabilities.
Tracked as CVE-2026-103922, the flaw carries a CVSS v3.1 score of 9.3 out of 10 and affects vulnerable Capacitor applications on both Android and iOS.
The issue is related to how Capacitor handled WebView navigation. If a user opens a specially crafted link inside an affected application, remote content could potentially execute with privileges associated with the app’s trusted origin.
This could expose data stored in localStorage, application cookies, and native functionality made available through registered Capacitor plugins.
Key takeaway: Developers using affected Capacitor versions should upgrade to a patched release, rebuild their Android and iOS applications, and distribute the updated versions to users.
What Is CVE-2026-103922?
CVE-2026-103922 is a critical security vulnerability affecting Capacitor, an open-source runtime used to build cross-platform Android and iOS applications using web technologies.
According to the official Capacitor security advisory, the affected WebView navigation logic checked a destination URL’s scheme and host but did not properly validate its path.
This created a way for navigation to reach Capacitor’s internal HTTP proxy endpoint:
/_capacitor_http_interceptor_Because this endpoint operates under the application’s own origin, an attacker could potentially abuse it to retrieve remote content and load that content within the trusted application context.
For broader coverage of newly disclosed security flaws, patch information, and enterprise vulnerability risks, see our CVE and vulnerability exploits security hub.
Why Is the Capacitor Vulnerability Critical?
The main security concern is the boundary between untrusted remote web content and the trusted origin of the mobile application.
Normally, browser and WebView security controls prevent scripts from one origin from freely accessing data belonging to another origin.
In this case, attacker-controlled content could potentially be returned through Capacitor’s internal proxy and execute under the application’s trusted origin.
Depending on the application’s configuration, this could expose:
- Application
localStoragedata - Cookies associated with the application origin
- Information available through registered Capacitor plugins
- Native capabilities exposed to the WebView
The actual impact depends on the affected application’s design, permissions, plugins, and the native features exposed to web content.
How Could CVE-2026-103922 Be Exploited?
Exploitation requires user interaction.
A victim must activate a malicious or untrusted link from within the affected application’s WebView.
Applications that display user-controlled content may therefore present a potential delivery path for an attack.
Possible examples include:
- Chat messages
- User comments
- Community feeds
- Support conversations
- Rich-text content
- User-generated posts
An attacker could place a specially crafted link inside such content. If the victim opens the link within the vulnerable application, the navigation could reach Capacitor’s internal HTTP proxy endpoint.
The proxy could then retrieve attacker-controlled remote content and return it under the application’s own trusted origin.
Malicious JavaScript contained in that response could potentially access same-origin application resources and native functionality exposed through Capacitor plugins.
Important: The published attack scenario requires the victim to interact with a malicious link inside the affected application. It is not described as a zero-click attack.
Disabling CapacitorHttp Is Not Enough
Developers should not assume their application is protected simply because the CapacitorHttp plugin is disabled.
The official advisory states that affected Capacitor versions exposed the internal HTTP proxy handler even when CapacitorHttp was disabled.
This means disabling the plugin alone is not considered a complete mitigation for vulnerable releases.
Affected and Patched Capacitor Versions
The Capacitor team released security fixes across multiple supported release branches.
| Capacitor Branch | Patched Version |
|---|---|
| 6.x | 6.2.2 |
| 7.x | 7.6.9 |
| 8.3.x | 8.3.5 |
| 8.4.x | 8.4.3 |
| 8.5.x | 8.5.1 |
The advisory covers affected Capacitor packages and distributions for both Android and iOS.
After upgrading, developers should rebuild their mobile applications so the patched native code is included in the version distributed to users.
How Capacitor Fixed CVE-2026-103922
The security update introduces additional restrictions around Capacitor’s internal HTTP proxy mechanism.
The patched implementation blocks frame navigation to the internal proxy path and limits when the proxy handler can be used.
This prevents the internal proxy from being abused to load attacker-controlled content as a trusted application document.
Legitimate application networking through normal fetch and XMLHttpRequest operations can continue to work as intended.
What Should Developers Do Now?
Developers maintaining Capacitor-based applications should first identify which Capacitor version is currently deployed in their Android and iOS projects.
If an affected version is installed, upgrading to the appropriate patched release should be treated as the primary remediation.
Recommended actions include:
- Check the Capacitor version used by the application.
- Upgrade to the appropriate patched release.
- Rebuild Android and iOS application packages.
- Test critical application functionality and registered plugins.
- Publish the updated builds through the appropriate distribution channels.
- Encourage users to install the latest application version.
- Review locations where user-controlled links are displayed.
- Validate and sanitize external URLs before allowing WebView navigation.
Temporary Mitigation
The recommended response is to install an official patched Capacitor release.
For teams that cannot immediately upgrade, application-level navigation controls can be used to block requests targeting the internal HTTP proxy path:
/_capacitor_http_interceptor_This should be treated as a temporary mitigation rather than a replacement for the official security update.
CVE-2026-103922 Technical Details
| CVE ID | CVE-2026-103922 |
|---|---|
| Severity | Critical |
| CVSS v3.1 | 9.3 / 10 |
| Attack Vector | Network |
| Attack Complexity | Low |
| Privileges Required | None |
| User Interaction | Required |
| Affected Platforms | Android and iOS |
| Weaknesses | CWE-346, CWE-441 |
| Patch Available | Yes |
The published CVSS vector is:
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:NThe vulnerability is associated with CWE-346: Origin Validation Error and CWE-441: Unintended Proxy or Intermediary.
Why WebView Security Matters
Hybrid mobile applications combine web technologies with native device capabilities, making the trust boundary between remote content and local application code especially important.
If attacker-controlled content gains access to a trusted WebView origin, the risk can extend beyond ordinary browser data because the application may expose native functionality through registered plugins.
This is why developers should carefully control external navigation, validate untrusted URLs, and keep mobile application frameworks updated when security fixes become available.
Frequently Asked Questions
What is CVE-2026-103922?
CVE-2026-103922 is a critical Capacitor vulnerability that can allow attacker-controlled remote content to be loaded under a mobile application’s trusted WebView origin through the internal HTTP proxy mechanism.
What is the CVSS score for CVE-2026-103922?
The official Capacitor security advisory assigns the vulnerability a CVSS v3.1 score of 9.3 out of 10, placing it in the Critical severity category.
Does CVE-2026-103922 affect Android and iOS?
Yes. The issue affects vulnerable Capacitor applications on both Android and iOS.
Does exploitation require user interaction?
Yes. A victim must activate a malicious or untrusted link from inside the affected application’s WebView.
Is disabling CapacitorHttp enough?
No. On vulnerable releases, the internal proxy handler could remain available even when CapacitorHttp was disabled.
What information could be exposed?
Successful exploitation could potentially expose application localStorage, cookies, and native functionality made accessible through registered Capacitor plugins.
How can developers fix CVE-2026-103922?
Developers should upgrade to the appropriate patched Capacitor version, rebuild their Android and iOS applications, test the updated builds, and distribute the new versions to users.
Final Takeaway
CVE-2026-103922 is a serious security issue because it can weaken the boundary between attacker-controlled web content and the trusted origin of a Capacitor-based mobile application.
Applications that display user-controlled or insufficiently validated links inside a WebView deserve particular attention.
Developers should not rely on disabling CapacitorHttp as a security measure. The recommended response is to upgrade to a patched Capacitor release, rebuild affected applications, and review how external URLs are handled throughout the app.
Stay Updated on Critical Vulnerabilities
Security flaws in widely used frameworks can quickly affect large numbers of applications and development environments.
Follow CyberUpdates365 for verified CVE alerts, vulnerability analysis, patch information, threat intelligence, and practical cybersecurity guidance.
Using Capacitor? Check your deployed version today and upgrade to the appropriate patched release if your application is affected.
Official Sources
Ionic / Capacitor Security Advisory:
Official security advisory for CVE-2026-103922
Official Capacitor Project:
Ionic Capacitor GitHub repository
