Critical Capacitor Flaw Lets Malicious Links Access App Data and Native Features
ID: f4507567-e305-5ee5-8c97-32e2b8a96161
STIX ID: report--f4507567-e305-5ee5-8c97-32e2b8a96161
Feed Name: Cyber Press
Threat Score
**Executive Summary:** A critical flaw in Capacitor (CVE-2026-103922) allows attacker-supplied links rendered in a WebView to reach an internal proxy path (/_capacitor_http_interceptor_) so the native layer fetches remote content and returns it as app-origin content, enabling same-origin script execution that can access localStorage, cookies, and native plugin functionality; patches and recommended version upgrades (6.2.2, 7.6.9, 8.3.5, 8.4.3, 8.5.1) and mitigations (navigation blocking and sanitizing links) are provided.
Your team is not currently subscribed to this feed. You must subscribe to it in order to see this post.