Vulnerability-Lookup

GHSA-RVM3-566M-V7FV

Vulnerability from github – Published: 2026-10-05 22:53 – Updated: 2026-10-05 22:53

Summary

Capacitor Android and iOS: remote content can be loaded at the app origin via the internal HTTP proxy path

Details

Impact

Capacitor's WebView navigation guard validated only the host and scheme of a target URL, not its path. Because the internal HTTP proxy path (/_capacitor_http_interceptor_) is served at the application's own origin, a frame navigation to it was always treated as in-app navigation and allowed.

Loading that path as a document caused the native layer to fetch an arbitrary, caller-specified URL and return the response body to the WebView at the app's own origin. Script in that response then ran with full same-origin trust: access to localStorage, cookies, and every native capability the application exposes through its registered Capacitor plugins.

The proxy handler was additionally served regardless of whether the CapacitorHttp plugin was enabled, so applications that never enabled CapacitorHttp were also affected.

Exploitation requires a victim to activate a link inside the application's WebView. Any Capacitor application that renders user-controlled or unsanitized links (chat messages, comments, rich-text content) is a viable delivery surface.

Both Android and iOS are affected.

Patches

Two changes on each platform:

The navigation guard now blocks frame navigations whose path is the internal proxy path.
The proxy handler is served only when CapacitorHttp is enabled, and never for a document (main frame) request.

Legitimate CapacitorHttp usage is unaffected. fetch and XMLHttpRequest are subresource requests and do not pass through the navigation guard.

Upgrade to a patched version, then rebuild and redistribute your application.

Workarounds

If you cannot upgrade immediately, note first that disabling CapacitorHttp is not sufficient on affected versions, because the proxy path is served regardless of that setting.

Registered plugins are consulted before the navigation guard runs, so a small plugin can block the path. On Android, override shouldOverrideLoad(Uri url) and return true when url.getPath() starts with /_capacitor_http_interceptor_. On iOS, implement shouldOverrideLoad(_:) and return true for the same path. Returning true cancels the navigation; return null/nil for all other URLs so normal navigation is unchanged.

Independently, sanitize user-controlled link targets before rendering them in the WebView.

Severity

9.3 (Critical)


                  
                    CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "npm",
        "name": "@capacitor/android"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "6.0.0"
            },
            {
              "fixed": "6.2.2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "npm",
        "name": "@capacitor/android"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "7.0.0"
            },
            {
              "fixed": "7.6.9"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "npm",
        "name": "@capacitor/ios"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "6.0.0"
            },
            {
              "fixed": "6.2.2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "npm",
        "name": "@capacitor/ios"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "7.0.0"
            },
            {
              "fixed": "7.6.9"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "SwiftURL",
        "name": "github.com/ionic-team/capacitor-swift-pm"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "6.0.0"
            },
            {
              "fixed": "6.2.2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "SwiftURL",
        "name": "github.com/ionic-team/capacitor-swift-pm"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "7.0.0"
            },
            {
              "fixed": "7.6.9"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Maven",
        "name": "com.capacitorjs:core"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "6.0.0"
            },
            {
              "fixed": "6.2.2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Maven",
        "name": "com.capacitorjs:core"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "7.0.0"
            },
            {
              "fixed": "7.6.9"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "npm",
        "name": "@capacitor/android"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "8.5.0"
            },
            {
              "fixed": "8.5.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "npm",
        "name": "@capacitor/ios"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "8.5.0"
            },
            {
              "fixed": "8.5.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "SwiftURL",
        "name": "github.com/ionic-team/capacitor-swift-pm"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "8.5.0"
            },
            {
              "fixed": "8.5.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Maven",
        "name": "com.capacitorjs:core"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "8.5.0"
            },
            {
              "fixed": "8.5.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Maven",
        "name": "com.capacitorjs:core"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "8.3.5"
            },
            {
              "fixed": "8.4.3"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "npm",
        "name": "@capacitor/android"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "8.3.5"
            },
            {
              "fixed": "8.4.3"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "npm",
        "name": "@capacitor/ios"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "8.3.5"
            },
            {
              "fixed": "8.4.3"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "SwiftURL",
        "name": "github.com/ionic-team/capacitor-swift-pm"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "8.3.5"
            },
            {
              "fixed": "8.4.3"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "SwiftURL",
        "name": "github.com/ionic-team/capacitor-swift-pm"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "8.0.0"
            },
            {
              "last_affected": "8.3.4"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Maven",
        "name": "com.capacitorjs:core"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "8.0.0"
            },
            {
              "last_affected": "8.3.4"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "npm",
        "name": "@capacitor/android"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "8.0.0"
            },
            {
              "last_affected": "8.3.4"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "npm",
        "name": "@capacitor/ios"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "8.0.0"
            },
            {
              "last_affected": "8.3.4"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-103922"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-346",
      "CWE-441"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-10-05T22:53:10Z",
    "nvd_published_at": "2026-10-01T18:17:12Z",
    "severity": "CRITICAL"
  },
  "details": "### Impact\n\nCapacitor\u0027s WebView navigation guard validated only the **host and scheme** of a\ntarget URL, not its **path**. Because the internal HTTP proxy path\n(`/_capacitor_http_interceptor_`) is served at the application\u0027s own origin, a\nframe navigation to it was always treated as in-app navigation and allowed.\n\nLoading that path as a document caused the native layer to fetch an arbitrary,\ncaller-specified URL and return the response body to the WebView **at the app\u0027s\nown origin**. Script in that response then ran with full same-origin trust:\naccess to `localStorage`, cookies, and every native capability the application\nexposes through its registered Capacitor plugins.\n\nThe proxy handler was additionally served **regardless of whether the\n`CapacitorHttp` plugin was enabled**, so applications that never enabled\n`CapacitorHttp` were also affected.\n\nExploitation requires a victim to activate a link inside the application\u0027s\nWebView. Any Capacitor application that renders user-controlled or unsanitized\nlinks (chat messages, comments, rich-text content) is a viable delivery surface.\n\nBoth **Android and iOS** are affected.\n\n### Patches\n\nTwo changes on each platform:\n\n1. The navigation guard now blocks frame navigations whose path is the internal\n   proxy path.\n2. The proxy handler is served only when `CapacitorHttp` is enabled, and never\n   for a document (main frame) request.\n\nLegitimate `CapacitorHttp` usage is unaffected. `fetch` and `XMLHttpRequest` are\nsubresource requests and do not pass through the navigation guard.\n\nUpgrade to a patched version, then rebuild and redistribute your application.\n\n### Workarounds\n\nIf you cannot upgrade immediately, note first that **disabling `CapacitorHttp`\nis not sufficient** on affected versions, because the proxy path is served\nregardless of that setting.\n\nRegistered plugins are consulted before the navigation guard runs, so a small\nplugin can block the path. On Android, override `shouldOverrideLoad(Uri url)` and\nreturn `true` when `url.getPath()` starts with `/_capacitor_http_interceptor_`.\nOn iOS, implement `shouldOverrideLoad(_:)` and return `true` for the same path.\nReturning `true` cancels the navigation; return `null`/`nil` for all other URLs\nso normal navigation is unchanged.\n\nIndependently, sanitize user-controlled link targets before rendering them in the\nWebView.",
  "id": "GHSA-rvm3-566m-v7fv",
  "modified": "2026-10-05T22:53:10Z",
  "published": "2026-10-05T22:53:10Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/ionic-team/capacitor/security/advisories/GHSA-rvm3-566m-v7fv"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-103922"
    },
    {
      "type": "WEB",
      "url": "https://github.com/ionic-team/capacitor/commit/430356a91e1419fc66862dc09835081aa501677e"
    },
    {
      "type": "WEB",
      "url": "https://github.com/ionic-team/capacitor/commit/745b5f805bf77bc6463977cc7d718cd9de44ccbc"
    },
    {
      "type": "WEB",
      "url": "https://github.com/ionic-team/capacitor/commit/80b6c5e81d062e1e158914040f49e044d95b7ccb"
    },
    {
      "type": "WEB",
      "url": "https://github.com/ionic-team/capacitor/commit/85ccc44151fdd5ae5e0d806d875766ef4b84ad5d"
    },
    {
      "type": "WEB",
      "url": "https://github.com/ionic-team/capacitor/commit/af9a287fef45f0ac68ce640cb42fed2d06b0f1b4"
    },
    {
      "type": "WEB",
      "url": "https://github.com/ionic-team/capacitor/commit/d5e3170ba0ff155fc542b7e6d16cff5201406540"
    },
    {
      "type": "WEB",
      "url": "https://github.com/ionic-team/capacitor/commit/ee586ae680887ba99d066616f976db149542d922"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/ionic-team/capacitor"
    },
    {
      "type": "WEB",
      "url": "https://github.com/ionic-team/capacitor/releases/tag/8.5.1"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Capacitor Android and iOS: remote content can be loaded at the app origin via the internal HTTP proxy path"
}

CVE-2026-103922 (GCVE-0-2026-103922)

Vulnerability from cvelistv5 – Published: 2026-10-01 17:27 – Updated: 2026-10-01 18:01

Title

Capacitor Android and iOS: remote content can be loaded at the app origin via the internal HTTP proxy path

Summary

Capacitor is a cross-platform native runtime for web applications. From 6.0.0 until 6.2.2, 7.6.9, 8.3.5, 8.4.3, and 8.5.1, the Android and iOS WebView navigation guard validates a target URL's host and scheme but not its path, allowing a victim who activates an untrusted link to navigate a frame to /_capacitor_http_interceptor_. The native proxy can fetch an attacker-selected URL and return the response as a document at the application's own origin, allowing script in that response to access same-origin storage, cookies, and registered Capacitor plugin capabilities. Applications remain affected when CapacitorHttp is disabled because affected releases serve the proxy path regardless of that setting. This issue is fixed in versions 6.2.2, 7.6.9, 8.3.5, 8.4.3, and 8.5.1.

Severity

9.3 (Critical)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-10-01 18:01 UTC

CWE

CWE-346 - Origin Validation Error
CWE-441 - Unintended Proxy or Intermediary ('Confused Deputy')

Assigner

GitHub_M mitre root Scorecard

References

8 references

URL	Tags
https://github.com/ionic-team/capacitor/security/…	x_refsource_CONFIRM
https://github.com/ionic-team/capacitor/commit/43…	x_refsource_MISC
https://github.com/ionic-team/capacitor/commit/80…	x_refsource_MISC
https://github.com/ionic-team/capacitor/commit/85…	x_refsource_MISC
https://github.com/ionic-team/capacitor/commit/af…	x_refsource_MISC
https://github.com/ionic-team/capacitor/commit/d5…	x_refsource_MISC
https://github.com/ionic-team/capacitor/commit/ee…	x_refsource_MISC
https://github.com/ionic-team/capacitor/releases/…	x_refsource_MISC

Impacted products

5 products

Vendor	Product	Version
ionic-team	capacitor	Affected: >= 6.0.0, < 6.2.2 Affected: >= 7.0.0, < 7.6.9 Affected: >= 8.0.0, < 8.3.5 Affected: >= 8.3.5, < 8.4.3 Affected: >= 8.5.0, < 8.5.1
@capacitor	android	Affected: >= 8.5.0, < 8.5.1 Affected: >= 8.3.5, < 8.4.3 Affected: >= 8.0.0, < 8.3.5 Affected: >= 7.0.0, < 7.6.9 Affected: >= 6.0.0, < 6.2.2
@capacitor	ios	Affected: >= 8.5.0, < 8.5.1 Affected: >= 8.3.5, < 8.4.3 Affected: >= 8.0.0, < 8.3.5 Affected: >= 7.0.0, < 7.6.9 Affected: >= 6.0.0, < 6.2.2
com.capacitorjs	core	Affected: >= 8.5.0, < 8.5.1 Affected: >= 8.3.5, < 8.4.3 Affected: >= 8.0.0, < 8.3.5 Affected: >= 7.0.0, < 7.6.9 Affected: >= 6.0.0, < 6.2.2
swift	github.com/ionic-team/capacitor-swift-pm	Affected: >= 8.5.0, < 8.5.1 Affected: >= 8.3.5, < 8.4.3 Affected: >= 8.0.0, < 8.3.5 Affected: >= 7.0.0, < 7.6.9 Affected: >= 6.0.0, < 6.2.2

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-103922",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-01T18:01:35.925716Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-01T18:01:54.381Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "capacitor",
          "vendor": "ionic-team",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 6.0.0, \u003c 6.2.2"
            },
            {
              "status": "affected",
              "version": "\u003e= 7.0.0, \u003c 7.6.9"
            },
            {
              "status": "affected",
              "version": "\u003e= 8.0.0, \u003c 8.3.5"
            },
            {
              "status": "affected",
              "version": "\u003e= 8.3.5, \u003c 8.4.3"
            },
            {
              "status": "affected",
              "version": "\u003e= 8.5.0, \u003c 8.5.1"
            }
          ]
        },
        {
          "product": "android",
          "vendor": "@capacitor",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 8.5.0, \u003c 8.5.1"
            },
            {
              "status": "affected",
              "version": "\u003e= 8.3.5, \u003c 8.4.3"
            },
            {
              "status": "affected",
              "version": "\u003e= 8.0.0, \u003c 8.3.5"
            },
            {
              "status": "affected",
              "version": "\u003e= 7.0.0, \u003c 7.6.9"
            },
            {
              "status": "affected",
              "version": "\u003e= 6.0.0, \u003c 6.2.2"
            }
          ]
        },
        {
          "product": "ios",
          "vendor": "@capacitor",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 8.5.0, \u003c 8.5.1"
            },
            {
              "status": "affected",
              "version": "\u003e= 8.3.5, \u003c 8.4.3"
            },
            {
              "status": "affected",
              "version": "\u003e= 8.0.0, \u003c 8.3.5"
            },
            {
              "status": "affected",
              "version": "\u003e= 7.0.0, \u003c 7.6.9"
            },
            {
              "status": "affected",
              "version": "\u003e= 6.0.0, \u003c 6.2.2"
            }
          ]
        },
        {
          "product": "core",
          "vendor": "com.capacitorjs",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 8.5.0, \u003c 8.5.1"
            },
            {
              "status": "affected",
              "version": "\u003e= 8.3.5, \u003c 8.4.3"
            },
            {
              "status": "affected",
              "version": "\u003e= 8.0.0, \u003c 8.3.5"
            },
            {
              "status": "affected",
              "version": "\u003e= 7.0.0, \u003c 7.6.9"
            },
            {
              "status": "affected",
              "version": "\u003e= 6.0.0, \u003c 6.2.2"
            }
          ]
        },
        {
          "product": "github.com/ionic-team/capacitor-swift-pm",
          "vendor": "swift",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 8.5.0, \u003c 8.5.1"
            },
            {
              "status": "affected",
              "version": "\u003e= 8.3.5, \u003c 8.4.3"
            },
            {
              "status": "affected",
              "version": "\u003e= 8.0.0, \u003c 8.3.5"
            },
            {
              "status": "affected",
              "version": "\u003e= 7.0.0, \u003c 7.6.9"
            },
            {
              "status": "affected",
              "version": "\u003e= 6.0.0, \u003c 6.2.2"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Capacitor is a cross-platform native runtime for web applications. From 6.0.0 until 6.2.2, 7.6.9, 8.3.5, 8.4.3, and 8.5.1, the Android and iOS WebView navigation guard validates a target URL\u0027s host and scheme but not its path, allowing a victim who activates an untrusted link to navigate a frame to /_capacitor_http_interceptor_. The native proxy can fetch an attacker-selected URL and return the response as a document at the application\u0027s own origin, allowing script in that response to access same-origin storage, cookies, and registered Capacitor plugin capabilities. Applications remain affected when CapacitorHttp is disabled because affected releases serve the proxy path regardless of that setting. This issue is fixed in versions 6.2.2, 7.6.9, 8.3.5, 8.4.3, and 8.5.1."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 9.3,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-346",
              "description": "CWE-346: Origin Validation Error",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-441",
              "description": "CWE-441: Unintended Proxy or Intermediary (\u0027Confused Deputy\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-01T17:27:05.758Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/ionic-team/capacitor/security/advisories/GHSA-rvm3-566m-v7fv",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/ionic-team/capacitor/security/advisories/GHSA-rvm3-566m-v7fv"
        },
        {
          "name": "https://github.com/ionic-team/capacitor/commit/430356a91e1419fc66862dc09835081aa501677e",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/ionic-team/capacitor/commit/430356a91e1419fc66862dc09835081aa501677e"
        },
        {
          "name": "https://github.com/ionic-team/capacitor/commit/80b6c5e81d062e1e158914040f49e044d95b7ccb",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/ionic-team/capacitor/commit/80b6c5e81d062e1e158914040f49e044d95b7ccb"
        },
        {
          "name": "https://github.com/ionic-team/capacitor/commit/85ccc44151fdd5ae5e0d806d875766ef4b84ad5d",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/ionic-team/capacitor/commit/85ccc44151fdd5ae5e0d806d875766ef4b84ad5d"
        },
        {
          "name": "https://github.com/ionic-team/capacitor/commit/af9a287fef45f0ac68ce640cb42fed2d06b0f1b4",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/ionic-team/capacitor/commit/af9a287fef45f0ac68ce640cb42fed2d06b0f1b4"
        },
        {
          "name": "https://github.com/ionic-team/capacitor/commit/d5e3170ba0ff155fc542b7e6d16cff5201406540",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/ionic-team/capacitor/commit/d5e3170ba0ff155fc542b7e6d16cff5201406540"
        },
        {
          "name": "https://github.com/ionic-team/capacitor/commit/ee586ae680887ba99d066616f976db149542d922",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/ionic-team/capacitor/commit/ee586ae680887ba99d066616f976db149542d922"
        },
        {
          "name": "https://github.com/ionic-team/capacitor/releases/tag/8.5.1",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/ionic-team/capacitor/releases/tag/8.5.1"
        }
      ],
      "source": {
        "advisory": "GHSA-rvm3-566m-v7fv",
        "discovery": "UNKNOWN"
      },
      "title": "Capacitor Android and iOS: remote content can be loaded at the app origin via the internal HTTP proxy path"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-103922",
    "datePublished": "2026-10-01T17:27:05.758Z",
    "dateReserved": "2026-10-01T14:20:19.154Z",
    "dateUpdated": "2026-10-01T18:01:54.381Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted