Critical Capacitor Vulnerability (CVE-2026-103922) Exposes Mobile Apps to Remote Code Execution A high-severity vulnerability (CVE-2026-103922, CVSS 9.3) in Capacitor, a cross-platform framework for building Android and iOS applications, allows attackers to execute malicious code within vulnerable apps under the guise of a trusted origin. The flaw stems from insufficient validation in Capacitor’s WebView navigation guard, which fails to properly verify URL paths, enabling exploitation of an internal proxy endpoint (`/_capacitor_http_interceptor_`). ### How the Exploit Works By tricking a user into clicking a malicious link within an app’s WebView, attackers can force the app to fetch attacker-controlled content via the proxy endpoint. The response is then rendered as a document under the app’s same-origin policy, granting malicious JavaScript access to: - Same-origin data (cookies, `localStorage`) - Native device functionality (via Capacitor plugins) - Sensitive app operations (authentication tokens, API interactions) The vulnerability affects apps regardless of whether the CapacitorHttp plugin is enabled, as the proxy endpoint remains accessible in vulnerable versions. ### Affected Versions & Fixes The flaw impacts: - Capacitor 6.x (6.0.0–6.2.1) - Capacitor 7.x (7.0.0–7.6.8) - Capacitor 8.x (multiple pre-patch releases) Patched versions are available: - 6.2.2, 7.6.9, 8.3.5, 8.4.3, 8.5.1 The fix blocks navigation to the proxy endpoint and restricts its availability to when CapacitorHttp is explicitly enabled, while preserving legitimate subresource requests (e.g., `fetch`, `XMLHttpRequest`). ### Mitigation & Impact Developers must upgrade Capacitor, rebuild affected apps, and redistribute updates. Temporary workarounds include: - Plugin overrides to block navigation to `/_capacitor_http_interceptor_` - Sanitizing user-controlled links in WebViews (e.g., chat messages, embedded content) The vulnerability (tracked as CWE-346 and CWE-441) poses significant risks to apps handling sensitive data or native device features, with potential for data theft, unauthorized API access, or device compromise.