AI analysis
Ionic Capacitor on Android and iOS fails to check the path when its WebView navigation guard validates a target URL, so a crafted link can load the built-in /_capacitor_http_interceptor_ proxy path. If a user opens that untrusted link, the native proxy fetches an attacker-chosen URL and returns the response as a document on the app's own origin. Script in that response can then read same-origin storage and cookies and call registered Capacitor plugins. Apps stay vulnerable even when CapacitorHttp is disabled, because affected releases still serve the proxy path. Affected ranges are 6.0.0 before 6.2.2, 7.x before 7.6.9, and 8.x before 8.3.5, 8.4.3, and 8.5.1; it is not on the CISA KEV list and no public proof-of-concept is known.
What to do: Upgrade the Capacitor runtime used by each Android and iOS app to 6.2.2, 7.6.9, 8.3.5, 8.4.3, or 8.5.1 on the matching release line, then rebuild and ship the app. Turning CapacitorHttp off does not close this issue. Until users install the update, avoid opening untrusted links inside the app WebView.
Affected
| Ionic Capacitor (Android and iOS) | 6.0.0 before 6.2.2; 7.x before 7.6.9; 8.x before 8.3.5, 8.4.3, and 8.5.1 |
Estimated exposure
largeLikely hundreds of thousands of developer installs; end-user device count unknown — Capacitor is a mainstream Ionic hybrid-app runtime with high public npm download volume for @capacitor/core, but there is no public census of production apps still on the listed vulnerable releases or of their end users.
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description
Capacitor is a cross-platform native runtime for web applications. From 6.0.0 until 6.2.2, 7.6.9, 8.3.5, 8.4.3, and 8.5.1, the Android and iOS WebView navigation guard validates a target URL's host and scheme but not its path, allowing a victim who activates an untrusted link to navigate a frame to /_capacitor_http_interceptor_. The native proxy can fetch an attacker-selected URL and return the response as a document at the application's own origin, allowing script in that response to access same-origin storage, cookies, and registered Capacitor plugin capabilities. Applications remain affected when CapacitorHttp is disabled because affected releases serve the proxy path regardless of that setting. This issue is fixed in versions 6.2.2, 7.6.9, 8.3.5, 8.4.3, and 8.5.1.