{"id":"CVE-2026-103922","summary":"Capacitor Android and iOS: remote content can be loaded at the app origin via the internal HTTP proxy path","details":"Capacitor is a cross-platform native runtime for web applications. From 6.0.0 until 6.2.2, 7.6.9, 8.3.5, 8.4.3, and 8.5.1, the Android and iOS WebView navigation guard validates a target URL's host and scheme but not its path, allowing a victim who activates an untrusted link to navigate a frame to /_capacitor_http_interceptor_. The native proxy can fetch an attacker-selected URL and return the response as a document at the application's own origin, allowing script in that response to access same-origin storage, cookies, and registered Capacitor plugin capabilities. Applications remain affected when CapacitorHttp is disabled because affected releases serve the proxy path regardless of that setting. This issue is fixed in versions 6.2.2, 7.6.9, 8.3.5, 8.4.3, and 8.5.1.","aliases":["GHSA-rvm3-566m-v7fv"],"modified":"2026-10-06T08:09:58.997389394Z","published":"2026-10-01T17:27:05.758Z","database_specific":{"unresolved_ranges":[{"extracted_events":[{"introduced":"8.0.0"},{"fixed":"8.3.5"},{"introduced":"8.0.0"},{"fixed":"8.3.5"},{"introduced":"8.0.0"},{"fixed":"8.3.5"},{"introduced":"8.0.0"},{"fixed":"8.3.5"},{"introduced":"8.0.0"},{"fixed":"8.3.5"}],"source":"AFFECTED_FIELD"}],"cna_assigner":"GitHub_M","cwe_ids":["CWE-346","CWE-441"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/103xxx/CVE-2026-103922.json"},"references":[{"type":"WEB","url":"https://github.com/ionic-team/capacitor/releases/tag/8.5.1"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/103xxx/CVE-2026-103922.json"},{"type":"ADVISORY","url":"https://github.com/ionic-team/capacitor/security/advisories/GHSA-rvm3-566m-v7fv"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-103922"},{"type":"FIX","url":"https://github.com/ionic-team/capacitor/commit/430356a91e1419fc66862dc09835081aa501677e"},{"type":"FIX","url":"https://github.com/ionic-team/capacitor/commit/80b6c5e81d062e1e158914040f49e044d95b7ccb"},{"type":"FIX","url":"https://github.com/ionic-team/capacitor/commit/85ccc44151fdd5ae5e0d806d875766ef4b84ad5d"},{"type":"FIX","url":"https://github.com/ionic-team/capacitor/commit/af9a287fef45f0ac68ce640cb42fed2d06b0f1b4"},{"type":"FIX","url":"https://github.com/ionic-team/capacitor/commit/d5e3170ba0ff155fc542b7e6d16cff5201406540"},{"type":"FIX","url":"https://github.com/ionic-team/capacitor/commit/ee586ae680887ba99d066616f976db149542d922"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/ionic-team/capacitor","events":[{"introduced":"5b2ab7c68db4e77b8b2961e927acc5a708ee260f"},{"introduced":"cdc5b51384293edc69236c9f2d2f9c5b63aa7259"},{"introduced":"0"},{"introduced":"3ab4139bd0b8863cadcb175180ea941f4c244f08"},{"fixed":"4d377eb2d3eabf83f9e6d1c07cb50d92c06db523"},{"fixed":"60a677eae8bb27667e8c5c518b38e855c7228968"},{"fixed":"82428936581035795b1640e60dc92b2a8d5eeed3"},{"fixed":"0c9e35dec13a99ec4a582a2edc536cbec96bf27d"},{"fixed":"430356a91e1419fc66862dc09835081aa501677e"},{"fixed":"80b6c5e81d062e1e158914040f49e044d95b7ccb"},{"fixed":"85ccc44151fdd5ae5e0d806d875766ef4b84ad5d"},{"fixed":"af9a287fef45f0ac68ce640cb42fed2d06b0f1b4"},{"fixed":"d5e3170ba0ff155fc542b7e6d16cff5201406540"},{"fixed":"ee586ae680887ba99d066616f976db149542d922"}],"database_specific":{"extracted_events":[{"introduced":"6.0.0"},{"fixed":"6.2.2"},{"introduced":"7.0.0"},{"fixed":"7.6.9"},{"introduced":"8.3.5"},{"fixed":"8.4.3"},{"introduced":"8.5.0"},{"fixed":"8.5.1"}],"source":["AFFECTED_FIELD","REFERENCES"]}}],"versions":["7.6.8","8.4.2","8.5.0","7.6.7","8.4.1","7.6.6","8.4.0","7.6.5","8.3.4","7.6.4","8.3.3","7.6.3","8.3.2","7.6.2","8.3.1","7.6.1","8.3.0","8.2.0","7.6.0","7.5.0","8.1.0","8.0.2","7.4.5","8.0.1","8.0.0","7.4.4","8.0.0-beta.0","8.0.0-alpha.3","7.4.3","8.0.0-alpha.2","8.0.0-alpha.1","7.4.2","7.4.1","7.4.0","7.3.0","6.2.1","7.2.0","7.1.0","6.2.0","7.0.1","7.0.0","6.1.2","6.1.1","6.1.0","6.0.0"],"database_specific":{"source":"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-103922.json","vanir_signatures":[{"signature_type":"Function","signature_version":"v1","source":"https://github.com/ionic-team/capacitor/commit/af9a287fef45f0ac68ce640cb42fed2d06b0f1b4","target":{"file":"android/capacitor/src/main/java/com/getcapacitor/WebViewLocalServer.java","function":"handleCapacitorHttpRequest"},"deprecated":false,"digest":{"function_hash":"171382153859297353466617878727411563350","length":1687},"id":"CVE-2026-103922-268df4bf"},{"signature_version":"v1","source":"https://github.com/ionic-team/capacitor/commit/af9a287fef45f0ac68ce640cb42fed2d06b0f1b4","target":{"file":"android/capacitor/src/main/java/com/getcapacitor/Bridge.java","function":"launchIntent"},"deprecated":false,"digest":{"length":893,"function_hash":"115853094401719260754001394132774726504"},"id":"CVE-2026-103922-3793373e","signature_type":"Function"},{"target":{"file":"android/capacitor/src/main/java/com/getcapacitor/WebViewLocalServer.java"},"deprecated":false,"digest":{"line_hashes":["134014231847330963516582485855441532566","88960931346956901407101489129078203561","167510283046042335006515051896915858974","195226542229779938430484921431760734888","332400382935714122237058191566329673909","322845940698478602944906622665740214836","281068364010713562853747008714745933409","20907282799114134810245284059458377352","148526878812497661874847423347241779845","274601576194528887130834996516934831210","7838075361510642240763898344177195272"],"threshold":0.9},"id":"CVE-2026-103922-50c80c55","signature_type":"Line","signature_version":"v1","source":"https://github.com/ionic-team/capacitor/commit/80b6c5e81d062e1e158914040f49e044d95b7ccb"},{"target":{"file":"android/capacitor/src/main/java/com/getcapacitor/Bridge.java","function":"launchIntent"},"deprecated":false,"digest":{"length":766,"function_hash":"13969294137361991718846065570786908017"},"id":"CVE-2026-103922-53fe2ccb","signature_type":"Function","signature_version":"v1","source":"https://github.com/ionic-team/capacitor/commit/430356a91e1419fc66862dc09835081aa501677e"},{"deprecated":false,"digest":{"length":893,"function_hash":"115853094401719260754001394132774726504"},"id":"CVE-2026-103922-5597103e","signature_type":"Function","signature_version":"v1","source":"https://github.com/ionic-team/capacitor/commit/85ccc44151fdd5ae5e0d806d875766ef4b84ad5d","target":{"function":"launchIntent","file":"android/capacitor/src/main/java/com/getcapacitor/Bridge.java"}},{"digest":{"threshold":0.9,"line_hashes":["233162027802195561594629535589407472339"]},"id":"CVE-2026-103922-599cc9b3","signature_type":"Line","signature_version":"v1","source":"https://github.com/ionic-team/capacitor/commit/85ccc44151fdd5ae5e0d806d875766ef4b84ad5d","target":{"file":"android/capacitor/src/androidTest/java/com/getcapacitor/android/TestHostActivity.java"},"deprecated":false},{"id":"CVE-2026-103922-5dc77e01","signature_type":"Function","signature_version":"v1","source":"https://github.com/ionic-team/capacitor/commit/80b6c5e81d062e1e158914040f49e044d95b7ccb","target":{"file":"android/capacitor/src/main/java/com/getcapacitor/WebViewLocalServer.java","function":"shouldInterceptRequest"},"deprecated":false,"digest":{"length":925,"function_hash":"78942644889407228993967801614984786961"}},{"deprecated":false,"digest":{"line_hashes":["58749332894649303155193442551096977234","194199499918886371056384079808077257456","239954587957768670209366556884069027485","255775303458885674495933212795147183697","21452057199806784850030719466080460526","291550127024035076237408143862309422711","131082834095369738873336927365693297381","59995141739937262749447218236506945579","61529678213875558852914553278789535559","178655276101959191390167592863127773872","96342991058064395649890728874631942380","311639800528938608434694815340202049912","267920799569733010830181025708677897504","278585262020515284867320487033888117998","181886102654718532692349469015666392117"],"threshold":0.9},"id":"CVE-2026-103922-6185f1a0","signature_type":"Line","signature_version":"v1","source":"https://github.com/ionic-team/capacitor/commit/85ccc44151fdd5ae5e0d806d875766ef4b84ad5d","target":{"file":"android/capacitor/src/androidTest/java/com/getcapacitor/android/HttpInterceptorNavigationTest.java"}},{"source":"https://github.com/ionic-team/capacitor/commit/af9a287fef45f0ac68ce640cb42fed2d06b0f1b4","target":{"file":"android/capacitor/src/androidTest/java/com/getcapacitor/android/TestHostActivity.java"},"deprecated":false,"digest":{"line_hashes":["233162027802195561594629535589407472339"],"threshold":0.9},"id":"CVE-2026-103922-63083fc9","signature_type":"Line","signature_version":"v1"},{"signature_version":"v1","source":"https://github.com/ionic-team/capacitor/commit/af9a287fef45f0ac68ce640cb42fed2d06b0f1b4","target":{"file":"android/capacitor/src/androidTest/java/com/getcapacitor/android/HttpInterceptorNavigationTest.java"},"deprecated":false,"digest":{"line_hashes":["58749332894649303155193442551096977234","194199499918886371056384079808077257456","239954587957768670209366556884069027485","255775303458885674495933212795147183697","21452057199806784850030719466080460526","291550127024035076237408143862309422711","131082834095369738873336927365693297381","59995141739937262749447218236506945579","61529678213875558852914553278789535559","178655276101959191390167592863127773872","96342991058064395649890728874631942380","311639800528938608434694815340202049912","267920799569733010830181025708677897504","278585262020515284867320487033888117998","181886102654718532692349469015666392117"],"threshold":0.9},"id":"CVE-2026-103922-65464917","signature_type":"Line"},{"id":"CVE-2026-103922-6693793a","signature_type":"Line","signature_version":"v1","source":"https://github.com/ionic-team/capacitor/commit/d5e3170ba0ff155fc542b7e6d16cff5201406540","target":{"file":"android/capacitor/src/main/java/com/getcapacitor/WebViewLocalServer.java"},"deprecated":false,"digest":{"line_hashes":["57130334173193072639761225872491888273","162443853658436814774229739354020890108","265956963906236325051317752333338244452","81651033221881509965002655696401807944"],"threshold":0.9}},{"deprecated":false,"digest":{"length":893,"function_hash":"115853094401719260754001394132774726504"},"id":"CVE-2026-103922-76c9ab4a","signature_type":"Function","signature_version":"v1","source":"https://github.com/ionic-team/capacitor/commit/80b6c5e81d062e1e158914040f49e044d95b7ccb","target":{"file":"android/capacitor/src/main/java/com/getcapacitor/Bridge.java","function":"launchIntent"}},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/ionic-team/capacitor/commit/af9a287fef45f0ac68ce640cb42fed2d06b0f1b4","target":{"file":"android/capacitor/src/main/java/com/getcapacitor/WebViewLocalServer.java","function":"shouldInterceptRequest"},"deprecated":false,"digest":{"function_hash":"78942644889407228993967801614984786961","length":925},"id":"CVE-2026-103922-79c4fc63"},{"source":"https://github.com/ionic-team/capacitor/commit/430356a91e1419fc66862dc09835081aa501677e","target":{"file":"android/capacitor/src/main/java/com/getcapacitor/WebViewLocalServer.java"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["57130334173193072639761225872491888273","162443853658436814774229739354020890108","265956963906236325051317752333338244452","81651033221881509965002655696401807944"]},"id":"CVE-2026-103922-7ceaabad","signature_type":"Line","signature_version":"v1"},{"target":{"file":"android/capacitor/src/main/java/com/getcapacitor/WebViewLocalServer.java"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["134014231847330963516582485855441532566","88960931346956901407101489129078203561","167510283046042335006515051896915858974","195226542229779938430484921431760734888","332400382935714122237058191566329673909","322845940698478602944906622665740214836","281068364010713562853747008714745933409","20907282799114134810245284059458377352","148526878812497661874847423347241779845","274601576194528887130834996516934831210","7838075361510642240763898344177195272"]},"id":"CVE-2026-103922-823fee29","signature_type":"Line","signature_version":"v1","source":"https://github.com/ionic-team/capacitor/commit/85ccc44151fdd5ae5e0d806d875766ef4b84ad5d"},{"id":"CVE-2026-103922-8ff1a17b","signature_type":"Line","signature_version":"v1","source":"https://github.com/ionic-team/capacitor/commit/80b6c5e81d062e1e158914040f49e044d95b7ccb","target":{"file":"android/capacitor/src/main/java/com/getcapacitor/Bridge.java"},"deprecated":false,"digest":{"line_hashes":["215098530059189433080533745376757389103","270660555277970085571699784044008616455","167018240271960944707787823191172919124","197272507016449041461069014340303359858","97993011416855728743327179431055344297","110592829371688486813370192239585465469","227769898019589205997087593492517537559","142370236736603983732796015600406928245","159416601984648231636082077605232975263","234792788569928031096861394135316675373","275310930151804066090419677788316817554"],"threshold":0.9}},{"deprecated":false,"digest":{"length":770,"function_hash":"244466196373466234962196117062398192665"},"id":"CVE-2026-103922-95c42850","signature_type":"Function","signature_version":"v1","source":"https://github.com/ionic-team/capacitor/commit/430356a91e1419fc66862dc09835081aa501677e","target":{"file":"android/capacitor/src/main/java/com/getcapacitor/WebViewLocalServer.java","function":"shouldInterceptRequest"}},{"digest":{"threshold":0.9,"line_hashes":["58749332894649303155193442551096977234","194199499918886371056384079808077257456","239954587957768670209366556884069027485","255775303458885674495933212795147183697","21452057199806784850030719466080460526","291550127024035076237408143862309422711","131082834095369738873336927365693297381","59995141739937262749447218236506945579","61529678213875558852914553278789535559","178655276101959191390167592863127773872","96342991058064395649890728874631942380","311639800528938608434694815340202049912","267920799569733010830181025708677897504","278585262020515284867320487033888117998","181886102654718532692349469015666392117"]},"id":"CVE-2026-103922-9f4babcf","signature_type":"Line","signature_version":"v1","source":"https://github.com/ionic-team/capacitor/commit/80b6c5e81d062e1e158914040f49e044d95b7ccb","target":{"file":"android/capacitor/src/androidTest/java/com/getcapacitor/android/HttpInterceptorNavigationTest.java"},"deprecated":false},{"source":"https://github.com/ionic-team/capacitor/commit/d5e3170ba0ff155fc542b7e6d16cff5201406540","target":{"file":"android/capacitor/src/main/java/com/getcapacitor/Bridge.java","function":"launchIntent"},"deprecated":false,"digest":{"function_hash":"13969294137361991718846065570786908017","length":766},"id":"CVE-2026-103922-9fee1535","signature_type":"Function","signature_version":"v1"},{"source":"https://github.com/ionic-team/capacitor/commit/85ccc44151fdd5ae5e0d806d875766ef4b84ad5d","target":{"file":"android/capacitor/src/main/java/com/getcapacitor/WebViewLocalServer.java","function":"handleCapacitorHttpRequest"},"deprecated":false,"digest":{"length":1532,"function_hash":"315796163362667889470692050881515985220"},"id":"CVE-2026-103922-a49eb195","signature_type":"Function","signature_version":"v1"},{"deprecated":false,"digest":{"line_hashes":["215098530059189433080533745376757389103","270660555277970085571699784044008616455","167018240271960944707787823191172919124","197272507016449041461069014340303359858","97993011416855728743327179431055344297","110592829371688486813370192239585465469","227769898019589205997087593492517537559","142370236736603983732796015600406928245","159416601984648231636082077605232975263","234792788569928031096861394135316675373","275310930151804066090419677788316817554"],"threshold":0.9},"id":"CVE-2026-103922-bb4e2ac6","signature_type":"Line","signature_version":"v1","source":"https://github.com/ionic-team/capacitor/commit/af9a287fef45f0ac68ce640cb42fed2d06b0f1b4","target":{"file":"android/capacitor/src/main/java/com/getcapacitor/Bridge.java"}},{"deprecated":false,"digest":{"function_hash":"13969294137361991718846065570786908017","length":766},"id":"CVE-2026-103922-c8f494ea","signature_type":"Function","signature_version":"v1","source":"https://github.com/ionic-team/capacitor/commit/ee586ae680887ba99d066616f976db149542d922","target":{"file":"android/capacitor/src/main/java/com/getcapacitor/Bridge.java","function":"launchIntent"}},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/ionic-team/capacitor/commit/d5e3170ba0ff155fc542b7e6d16cff5201406540","target":{"function":"shouldInterceptRequest","file":"android/capacitor/src/main/java/com/getcapacitor/WebViewLocalServer.java"},"deprecated":false,"digest":{"function_hash":"244466196373466234962196117062398192665","length":770},"id":"CVE-2026-103922-d42d20f1"},{"deprecated":false,"digest":{"line_hashes":["134014231847330963516582485855441532566","88960931346956901407101489129078203561","167510283046042335006515051896915858974","195226542229779938430484921431760734888","332400382935714122237058191566329673909","322845940698478602944906622665740214836","281068364010713562853747008714745933409","20907282799114134810245284059458377352","148526878812497661874847423347241779845","274601576194528887130834996516934831210","7838075361510642240763898344177195272"],"threshold":0.9},"id":"CVE-2026-103922-d5f35746","signature_type":"Line","signature_version":"v1","source":"https://github.com/ionic-team/capacitor/commit/af9a287fef45f0ac68ce640cb42fed2d06b0f1b4","target":{"file":"android/capacitor/src/main/java/com/getcapacitor/WebViewLocalServer.java"}},{"id":"CVE-2026-103922-dd9b8382","signature_type":"Function","signature_version":"v1","source":"https://github.com/ionic-team/capacitor/commit/ee586ae680887ba99d066616f976db149542d922","target":{"file":"android/capacitor/src/main/java/com/getcapacitor/WebViewLocalServer.java","function":"shouldInterceptRequest"},"deprecated":false,"digest":{"function_hash":"244466196373466234962196117062398192665","length":770}},{"source":"https://github.com/ionic-team/capacitor/commit/85ccc44151fdd5ae5e0d806d875766ef4b84ad5d","target":{"file":"android/capacitor/src/main/java/com/getcapacitor/Bridge.java"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["215098530059189433080533745376757389103","270660555277970085571699784044008616455","167018240271960944707787823191172919124","197272507016449041461069014340303359858","97993011416855728743327179431055344297","110592829371688486813370192239585465469","227769898019589205997087593492517537559","142370236736603983732796015600406928245","159416601984648231636082077605232975263","234792788569928031096861394135316675373","275310930151804066090419677788316817554"]},"id":"CVE-2026-103922-df0729da","signature_type":"Line","signature_version":"v1"},{"digest":{"line_hashes":["57130334173193072639761225872491888273","162443853658436814774229739354020890108","265956963906236325051317752333338244452","81651033221881509965002655696401807944","322845940698478602944906622665740214836","281068364010713562853747008714745933409","20907282799114134810245284059458377352","148526878812497661874847423347241779845","274601576194528887130834996516934831210","7838075361510642240763898344177195272"],"threshold":0.9},"id":"CVE-2026-103922-e0707c74","signature_type":"Line","signature_version":"v1","source":"https://github.com/ionic-team/capacitor/commit/ee586ae680887ba99d066616f976db149542d922","target":{"file":"android/capacitor/src/main/java/com/getcapacitor/WebViewLocalServer.java"},"deprecated":false},{"signature_version":"v1","source":"https://github.com/ionic-team/capacitor/commit/ee586ae680887ba99d066616f976db149542d922","target":{"file":"android/capacitor/src/main/java/com/getcapacitor/Bridge.java"},"deprecated":false,"digest":{"line_hashes":["215098530059189433080533745376757389103","270660555277970085571699784044008616455","167018240271960944707787823191172919124","197272507016449041461069014340303359858"],"threshold":0.9},"id":"CVE-2026-103922-ea55b339","signature_type":"Line"},{"deprecated":false,"digest":{"length":1687,"function_hash":"171382153859297353466617878727411563350"},"id":"CVE-2026-103922-ef92a2de","signature_type":"Function","signature_version":"v1","source":"https://github.com/ionic-team/capacitor/commit/80b6c5e81d062e1e158914040f49e044d95b7ccb","target":{"function":"handleCapacitorHttpRequest","file":"android/capacitor/src/main/java/com/getcapacitor/WebViewLocalServer.java"}},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/ionic-team/capacitor/commit/85ccc44151fdd5ae5e0d806d875766ef4b84ad5d","target":{"file":"android/capacitor/src/main/java/com/getcapacitor/WebViewLocalServer.java","function":"shouldInterceptRequest"},"deprecated":false,"digest":{"function_hash":"78942644889407228993967801614984786961","length":925},"id":"CVE-2026-103922-f2089020"},{"signature_version":"v1","source":"https://github.com/ionic-team/capacitor/commit/80b6c5e81d062e1e158914040f49e044d95b7ccb","target":{"file":"android/capacitor/src/androidTest/java/com/getcapacitor/android/TestHostActivity.java"},"deprecated":false,"digest":{"line_hashes":["233162027802195561594629535589407472339"],"threshold":0.9},"id":"CVE-2026-103922-f8626dcb","signature_type":"Line"},{"signature_version":"v1","source":"https://github.com/ionic-team/capacitor/commit/ee586ae680887ba99d066616f976db149542d922","target":{"file":"android/capacitor/src/main/java/com/getcapacitor/WebViewLocalServer.java","function":"handleCapacitorHttpRequest"},"deprecated":false,"digest":{"length":1687,"function_hash":"171382153859297353466617878727411563350"},"id":"CVE-2026-103922-fc29bdf2","signature_type":"Function"}],"vanir_signatures_modified":"2026-10-06T08:09:58Z"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N"}]}