cveboard RSS feed

CVE-2026-103922

GitHubCritical, npm, swift

Capacitor Android and iOS: remote content can be loaded at the app origin via the internal HTTP proxy path

Capacitor's WebView navigation guard validated only the host and scheme of a target URL, not its path. Because the internal HTTP proxy path (/_capacitor_http_interceptor_) is served at the application's own origin, a frame navigation to it was always treated as in-app navigation and allowed.

No known exploitation
Severity
Critical, CVSS 9.3 (v3.1)
EPSS
0.21% chance of exploitation in 30 days (EPSS, as of Oct 23, 2026)
Affected packages