com.capacitorjs vulnerabilities

Products

• com.capacitorjs/core 1

Latest com.capacitorjs CVEs

Newest publication first

1. CVE-2026-103922 Capacitor Android and iOS: remote content can be loaded at the app origin via the internal HTTP proxy path

   Published 2026-10-01

   Critical·CVSS 9.3 EPSS 0.34%

   Capacitor is a cross-platform native runtime for web applications. From 6.0.0 until 6.2.2, 7.6.9, 8.3.5, 8.4.3, and 8.5.1, the Android and iOS WebView navigation guard validates a target URL's host and scheme but not its path, allowing a victim who activates an untrusted link to...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.