CriticalFix available

Capacitor Android and iOS: remote content can be loaded at the app origin via the internal HTTP proxy path

Type: advisorySource: OSV1 source record

### Impact Capacitor's WebView navigation guard validated only the **host and scheme** of a target URL, not its **path**. Because the internal HTTP proxy path (`/_capacitor_http_interceptor_`) is served at the application's own origin, a frame navigation to it was always treated as in-app navigation and allowed. Loading that path as a document caused the native layer to fetch an arbitrary, caller-specified URL and return the response body to the WebView **at the app's own origin**. Script in that response then ran with full same-origin trust: access to `localStorage`, cookies, and every native capability the application exposes through its registered Capacitor plugins. The proxy handler was additionally served **regardless of whether the `CapacitorHttp` plugin was enabled**, so applications that never enabled `CapacitorHttp` were also affected. Exploitation requires a victim to activate a link inside the application's WebView. Any Capacitor application that renders user-controlled or unsanitized links (chat messages, comments, rich-text content) is a viable delivery surface. Both **Android and iOS** are affected. ### Patches Two changes on each platform: 1. The navigation guard now blocks frame navigations whose path is the internal proxy path. 2. The proxy handler is served only when `CapacitorHttp` is enabled, and never for a document (main frame) request. Legitimate `CapacitorHttp` usage is unaffected. `fetch` and `XMLHttpRequest` are subresource requests and do not pass t

Announced 5 Oct 2026Group revision 1

Original source ↗

GHSA-rvm3-566m-v7fv

Primary source · Revision 1

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: osv:GHSA-rvm3-566m-v7fv

@capacitor/android

Source reference: /affected/0/package/name

Affected versions: Not stated in this record
Fixed versions: 6.2.2
Source reference: /affected/0/ranges
Prerequisites: Not stated in this record

@capacitor/android

Source reference: /affected/1/package/name

Affected versions: Not stated in this record
Fixed versions: 7.6.9
Source reference: /affected/1/ranges
Prerequisites: Not stated in this record

@capacitor/ios

Source reference: /affected/2/package/name

Affected versions: Not stated in this record
Fixed versions: 6.2.2
Source reference: /affected/2/ranges
Prerequisites: Not stated in this record

@capacitor/ios

Source reference: /affected/3/package/name

Affected versions: Not stated in this record
Fixed versions: 7.6.9
Source reference: /affected/3/ranges
Prerequisites: Not stated in this record

github.com/ionic-team/capacitor-swift-pm

Source reference: /affected/4/package/name

Affected versions: Not stated in this record
Fixed versions: 6.2.2
Source reference: /affected/4/ranges
Prerequisites: Not stated in this record

github.com/ionic-team/capacitor-swift-pm

Source reference: /affected/5/package/name

Affected versions: Not stated in this record
Fixed versions: 7.6.9
Source reference: /affected/5/ranges
Prerequisites: Not stated in this record

com.capacitorjs:core

Source reference: /affected/6/package/name

Affected versions: 6.0.0
Source reference: /affected/6/versions
6.1.0
Source reference: /affected/6/versions
6.1.1
Source reference: /affected/6/versions
6.1.2
Source reference: /affected/6/versions
6.2.0
Source reference: /affected/6/versions
6.2.1
Source reference: /affected/6/versions
Fixed versions: 6.2.2
Source reference: /affected/6/ranges
Prerequisites: Not stated in this record

com.capacitorjs:core

Source reference: /affected/7/package/name

Affected versions: 7.0.0
Source reference: /affected/7/versions
7.0.1
Source reference: /affected/7/versions
7.1.0
Source reference: /affected/7/versions
7.2.0
Source reference: /affected/7/versions
7.3.0
Source reference: /affected/7/versions
7.4.0
Source reference: /affected/7/versions
7.4.2
Source reference: /affected/7/versions
7.4.3
Source reference: /affected/7/versions
7.4.4
Source reference: /affected/7/versions
7.4.5
Source reference: /affected/7/versions
7.5.0
Source reference: /affected/7/versions
7.6.0
Source reference: /affected/7/versions
7.6.1
Source reference: /affected/7/versions
7.6.2
Source reference: /affected/7/versions
7.6.3
Source reference: /affected/7/versions
7.6.4
Source reference: /affected/7/versions
7.6.5
Source reference: /affected/7/versions
7.6.6
Source reference: /affected/7/versions
7.6.7
Source reference: /affected/7/versions
7.6.8
Source reference: /affected/7/versions
Fixed versions: 7.6.9
Source reference: /affected/7/ranges
Prerequisites: Not stated in this record

@capacitor/android

Source reference: /affected/8/package/name

Affected versions: Not stated in this record
Fixed versions: 8.5.1
Source reference: /affected/8/ranges
Prerequisites: Not stated in this record

@capacitor/ios

Source reference: /affected/9/package/name

Affected versions: Not stated in this record
Fixed versions: 8.5.1
Source reference: /affected/9/ranges
Prerequisites: Not stated in this record

github.com/ionic-team/capacitor-swift-pm

Source reference: /affected/10/package/name

Affected versions: Not stated in this record
Fixed versions: 8.5.1
Source reference: /affected/10/ranges
Prerequisites: Not stated in this record

com.capacitorjs:core

Source reference: /affected/11/package/name

Affected versions: 8.5.0
Source reference: /affected/11/versions
Fixed versions: 8.5.1
Source reference: /affected/11/ranges
Prerequisites: Not stated in this record

com.capacitorjs:core

Source reference: /affected/12/package/name

Affected versions: 8.4.0
Source reference: /affected/12/versions
8.4.1
Source reference: /affected/12/versions
8.4.2
Source reference: /affected/12/versions
Fixed versions: 8.4.3
Source reference: /affected/12/ranges
Prerequisites: Not stated in this record

@capacitor/android

Source reference: /affected/13/package/name

Affected versions: Not stated in this record
Fixed versions: 8.4.3
Source reference: /affected/13/ranges
Prerequisites: Not stated in this record

@capacitor/ios

Source reference: /affected/14/package/name

Affected versions: Not stated in this record
Fixed versions: 8.4.3
Source reference: /affected/14/ranges
Prerequisites: Not stated in this record

github.com/ionic-team/capacitor-swift-pm

Source reference: /affected/15/package/name

Affected versions: Not stated in this record
Fixed versions: 8.4.3
Source reference: /affected/15/ranges
Prerequisites: Not stated in this record

github.com/ionic-team/capacitor-swift-pm

Source reference: /affected/16/package/name

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

com.capacitorjs:core

Source reference: /affected/17/package/name

Affected versions: 8.0.0
Source reference: /affected/17/versions
8.0.1
Source reference: /affected/17/versions
8.0.2
Source reference: /affected/17/versions
8.1.0
Source reference: /affected/17/versions
8.2.0
Source reference: /affected/17/versions
8.3.0
Source reference: /affected/17/versions
8.3.1
Source reference: /affected/17/versions
8.3.2
Source reference: /affected/17/versions
8.3.3
Source reference: /affected/17/versions
8.3.4
Source reference: /affected/17/versions
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

@capacitor/android

Source reference: /affected/18/package/name

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

@capacitor/ios

Source reference: /affected/19/package/name

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Structured affected-version data

Original package identities and version rules from this source.

[
  {
    "ranges": [
      {
        "type": "SEMVER",
        "events": [
          {
            "introduced": "6.0.0"
          },
          {
            "fixed": "6.2.2"
          }
        ]
      }
    ],
    "package": {
      "name": "@capacitor/android",
      "purl": "pkg:npm/%40capacitor/android",
      "ecosystem": "npm"
    },
    "database_specific": {
      "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/10/GHSA-rvm3-566m-v7fv/GHSA-rvm3-566m-v7fv.json"
    }
  },
  {
    "ranges": [
      {
        "type": "SEMVER",
        "events": [
          {
            "introduced": "7.0.0"
          },
          {
            "fixed": "7.6.9"
          }
        ]
      }
    ],
    "package": {
      "name": "@capacitor/android",
      "purl": "pkg:npm/%40capacitor/android",
      "ecosystem": "npm"
    },
    "database_specific": {
      "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/10/GHSA-rvm3-566m-v7fv/GHSA-rvm3-566m-v7fv.json"
    }
  },
  {
    "ranges": [
      {
        "type": "SEMVER",
        "events": [
          {
            "introduced": "6.0.0"
          },
          {
            "fixed": "6.2.2"
          }
        ]
      }
    ],
    "package": {
      "name": "@capacitor/ios",
      "purl": "pkg:npm/%40capacitor/ios",
      "ecosystem": "npm"
    },
    "database_specific": {
      "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/10/GHSA-rvm3-566m-v7fv/GHSA-rvm3-566m-v7fv.json"
    }
  },
  {
    "ranges": [
      {
        "type": "SEMVER",
        "events": [
          {
            "introduced": "7.0.0"
          },
          {
            "fixed": "7.6.9"
          }
        ]
      }
    ],
    "package": {
      "name": "@capacitor/ios",
      "purl": "pkg:npm/%40capacitor/ios",
      "ecosystem": "npm"
    },
    "database_specific": {
      "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/10/GHSA-rvm3-566m-v7fv/GHSA-rvm3-566m-v7fv.json"
    }
  },
  {
    "ranges": [
      {
        "type": "SEMVER",
        "events": [
          {
            "introduced": "6.0.0"
          },
          {
            "fixed": "6.2.2"
          }
        ]
      }
    ],
    "package": {
      "name": "github.com/ionic-team/capacitor-swift-pm",
      "purl": "pkg:swift/github.com/ionic-team/capacitor-swift-pm",
      "ecosystem": "SwiftURL"
    },
    "database_specific": {
      "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/10/GHSA-rvm3-566m-v7fv/GHSA-rvm3-566m-v7fv.json"
    }
  },
  {
    "ranges": [
      {
        "type": "SEMVER",
        "events": [
          {
            "introduced": "7.0.0"
          },
          {
            "fixed": "7.6.9"
          }
        ]
      }
    ],
    "package": {
      "name": "github.com/ionic-team/capacitor-swift-pm",
      "purl": "pkg:swift/github.com/ionic-team/capacitor-swift-pm",
      "ecosystem": "SwiftURL"
    },
    "database_specific": {
      "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/10/GHSA-rvm3-566m-v7fv/GHSA-rvm3-566m-v7fv.json"
    }
  },
  {
    "ranges": [
      {
        "type": "ECOSYSTEM",
        "events": [
          {
            "introduced": "6.0.0"
          },
          {
            "fixed": "6.2.2"
          }
        ]
      }
    ],
    "package": {
      "name": "com.capacitorjs:core",
      "purl": "pkg:maven/com.capacitorjs/core",
      "ecosystem": "Maven"
    },
    "versions": [
      "6.0.0",
      "6.1.0",
      "6.1.1",
      "6.1.2",
      "6.2.0",
      "6.2.1"
    ],
    "database_specific": {
      "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/10/GHSA-rvm3-566m-v7fv/GHSA-rvm3-566m-v7fv.json"
    }
  },
  {
    "ranges": [
      {
        "type": "ECOSYSTEM",
        "events": [
          {
            "introduced": "7.0.0"
          },
          {
            "fixed": "7.6.9"
          }
        ]
      }
    ],
    "package": {
      "name": "com.capacitorjs:core",
      "purl": "pkg:maven/com.capacitorjs/core",
      "ecosystem": "Maven"
    },
    "versions": [
      "7.0.0",
      "7.0.1",
      "7.1.0",
      "7.2.0",
      "7.3.0",
      "7.4.0",
      "7.4.2",
      "7.4.3",
      "7.4.4",
      "7.4.5",
      "7.5.0",
      "7.6.0",
      "7.6.1",
      "7.6.2",
      "7.6.3",
      "7.6.4",
      "7.6.5",
      "7.6.6",
      "7.6.7",
      "7.6.8"
    ],
    "database_specific": {
      "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/10/GHSA-rvm3-566m-v7fv/GHSA-rvm3-566m-v7fv.json"
    }
  },
  {
    "ranges": [
      {
        "type": "SEMVER",
        "events": [
          {
            "introduced": "8.5.0"
          },
          {
            "fixed": "8.5.1"
          }
        ]
      }
    ],
    "package": {
      "name": "@capacitor/android",
      "purl": "pkg:npm/%40capacitor/android",
      "ecosystem": "npm"
    },
    "database_specific": {
      "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/10/GHSA-rvm3-566m-v7fv/GHSA-rvm3-566m-v7fv.json"
    }
  },
  {
    "ranges": [
      {
        "type": "SEMVER",
        "events": [
          {
            "introduced": "8.5.0"
          },
          {
            "fixed": "8.5.1"
          }
        ]
      }
    ],
    "package": {
      "name": "@capacitor/ios",
      "purl": "pkg:npm/%40capacitor/ios",
      "ecosystem": "npm"
    },
    "database_specific": {
      "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/10/GHSA-rvm3-566m-v7fv/GHSA-rvm3-566m-v7fv.json"
    }
  },
  {
    "ranges": [
      {
        "type": "SEMVER",
        "events": [
          {
            "introduced": "8.5.0"
          },
          {
            "fixed": "8.5.1"
          }
        ]
      }
    ],
    "package": {
      "name": "github.com/ionic-team/capacitor-swift-pm",
      "purl": "pkg:swift/github.com/ionic-team/capacitor-swift-pm",
      "ecosystem": "SwiftURL"
    },
    "database_specific": {
      "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/10/GHSA-rvm3-566m-v7fv/GHSA-rvm3-566m-v7fv.json"
    }
  },
  {
    "ranges": [
      {
        "type": "ECOSYSTEM",
        "events": [
          {
            "introduced": "8.5.0"
          },
          {
            "fixed": "8.5.1"
          }
        ]
      }
    ],
    "package": {
      "name": "com.capacitorjs:core",
      "purl": "pkg:maven/com.capacitorjs/core",
      "ecosystem": "Maven"
    },
    "versions": [
      "8.5.0"
    ],
    "database_specific": {
      "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/10/GHSA-rvm3-566m-v7fv/GHSA-rvm3-566m-v7fv.json"
    }
  },
  {
    "ranges": [
      {
        "type": "ECOSYSTEM",
        "events": [
          {
            "introduced": "8.3.5"
          },
          {
            "fixed": "8.4.3"
          }
        ]
      }
    ],
    "package": {
      "name": "com.capacitorjs:core",
      "purl": "pkg:maven/com.capacitorjs/core",
      "ecosystem": "Maven"
    },
    "versions": [
      "8.4.0",
      "8.4.1",
      "8.4.2"
    ],
    "database_specific": {
      "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/10/GHSA-rvm3-566m-v7fv/GHSA-rvm3-566m-v7fv.json"
    }
  },
  {
    "ranges": [
      {
        "type": "SEMVER",
        "events": [
          {
            "introduced": "8.3.5"
          },
          {
            "fixed": "8.4.3"
          }
        ]
      }
    ],
    "package": {
      "name": "@capacitor/android",
      "purl": "pkg:npm/%40capacitor/android",
      "ecosystem": "npm"
    },
    "database_specific": {
      "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/10/GHSA-rvm3-566m-v7fv/GHSA-rvm3-566m-v7fv.json"
    }
  },
  {
    "ranges": [
      {
        "type": "SEMVER",
        "events": [
          {
            "introduced": "8.3.5"
          },
          {
            "fixed": "8.4.3"
          }
        ]
      }
    ],
    "package": {
      "name": "@capacitor/ios",
      "purl": "pkg:npm/%40capacitor/ios",
      "ecosystem": "npm"
    },
    "database_specific": {
      "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/10/GHSA-rvm3-566m-v7fv/GHSA-rvm3-566m-v7fv.json"
    }
  },
  {
    "ranges": [
      {
        "type": "SEMVER",
        "events": [
          {
            "introduced": "8.3.5"
          },
          {
            "fixed": "8.4.3"
          }
        ]
      }
    ],
    "package": {
      "name": "github.com/ionic-team/capacitor-swift-pm",
      "purl": "pkg:swift/github.com/ionic-team/capacitor-swift-pm",
      "ecosystem": "SwiftURL"
    },
    "database_specific": {
      "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/10/GHSA-rvm3-566m-v7fv/GHSA-rvm3-566m-v7fv.json"
    }
  },
  {
    "ranges": [
      {
        "type": "SEMVER",
        "events": [
          {
            "introduced": "8.0.0"
          },
          {
            "last_affected": "8.3.4"
          }
        ]
      }
    ],
    "package": {
      "name": "github.com/ionic-team/capacitor-swift-pm",
      "purl": "pkg:swift/github.com/ionic-team/capacitor-swift-pm",
      "ecosystem": "SwiftURL"
    },
    "database_specific": {
      "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/10/GHSA-rvm3-566m-v7fv/GHSA-rvm3-566m-v7fv.json"
    }
  },
  {
    "ranges": [
      {
        "type": "ECOSYSTEM",
        "events": [
          {
            "introduced": "8.0.0"
          },
          {
            "last_affected": "8.3.4"
          }
        ]
      }
    ],
    "package": {
      "name": "com.capacitorjs:core",
      "purl": "pkg:maven/com.capacitorjs/core",
      "ecosystem": "Maven"
    },
    "versions": [
      "8.0.0",
      "8.0.1",
      "8.0.2",
      "8.1.0",
      "8.2.0",
      "8.3.0",
      "8.3.1",
      "8.3.2",
      "8.3.3",
      "8.3.4"
    ],
    "database_specific": {
      "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/10/GHSA-rvm3-566m-v7fv/GHSA-rvm3-566m-v7fv.json"
    }
  },
  {
    "ranges": [
      {
        "type": "SEMVER",
        "events": [
          {
            "introduced": "8.0.0"
          },
          {
            "last_affected": "8.3.4"
          }
        ]
      }
    ],
    "package": {
      "name": "@capacitor/android",
      "purl": "pkg:npm/%40capacitor/android",
      "ecosystem": "npm"
    },
    "database_specific": {
      "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/10/GHSA-rvm3-566m-v7fv/GHSA-rvm3-566m-v7fv.json"
    }
  },
  {
    "ranges": [
      {
        "type": "SEMVER",
        "events": [
          {
            "introduced": "8.0.0"
          },
          {
            "last_affected": "8.3.4"
          }
        ]
      }
    ],
    "package": {
      "name": "@capacitor/ios",
      "purl": "pkg:npm/%40capacitor/ios",
      "ecosystem": "npm"
    },
    "database_specific": {
      "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/10/GHSA-rvm3-566m-v7fv/GHSA-rvm3-566m-v7fv.json"
    }
  }
]

Related CVEs: CVE-2026-103922
Source reference: /aliases

Publisher severity

critical

Source reference: /database_specific/severity

Linked CVE context

These ratings describe the referenced vulnerabilities and products. They are not a severity rating for every application using this dependency.

CVE-2026-103922 · Critical

capacitor, android, ios, core, github.com/ionic-team/capacitor-swift-pm

Event: #85867 · Revision 1
Added to Heist Feed: Tue, 27 Oct 2026 04:02:13 GMT
Publisher date: Mon, 05 Oct 2026 22:53:10 GMT

Read the original announcement

Revision history

27 Oct 2026GHSA-rvm3-566m-v7fv · Revision 1Source updated