Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
Miggo AIRoot Cause AnalysisThe vulnerability stems from an origin validation error in Capacitor's Android and iOS platforms. The navigation guards in both platforms only validated the host and scheme of a target URL, but not its path. This allowed a malicious actor to craft a URL pointing to the internal HTTP proxy path (/_capacitor_http_interceptor_). Because this path is served from the application's own origin (e.g., https://localhost), the navigation guard incorrectly treated it as a safe, in-app navigation.
When the WebView navigated to this path, the native layer would fetch an arbitrary, attacker-specified URL and return its content to the WebView. This content would then execute within the app's origin, granting it full access to localStorage, cookies, and any native capabilities exposed via Capacitor plugins. The vulnerability was exacerbated by the fact that the proxy handler was served regardless of whether the CapacitorHttp plugin was enabled.
The identified vulnerable functions are the specific methods in the Android and iOS codebases responsible for handling URL navigation and request interception. The patches show that these functions were modified to add the missing path validation and to ensure the proxy is only served when explicitly enabled and not for main frame document requests. These functions (launchIntent, shouldInterceptRequest on Android, and the webView delegate methods on iOS) are the direct entry points where the lack of validation allowed the exploit to occur.
com.getcapacitor.Bridge.launchIntentandroid/capacitor/src/main/java/com/getcapacitor/Bridge.java
com.getcapacitor.WebViewLocalServer.shouldInterceptRequestandroid/capacitor/src/main/java/com/getcapacitor/WebViewLocalServer.java
Capacitor.WebViewDelegationHandler.webViewios/Capacitor/Capacitor/WebViewDelegationHandler.swift
Capacitor.WebViewAssetHandler.webViewios/Capacitor/Capacitor/WebViewAssetHandler.swift
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| @capacitor/android | npm | >= 6.0.0, < 6.2.2 | 6.2.2 |
| @capacitor/android | npm | >= 7.0.0, < 7.6.9 | 7.6.9 |
| @capacitor/ios |
| npm |
| >= 6.0.0, < 6.2.2 |
| 6.2.2 |
| @capacitor/ios | npm | >= 7.0.0, < 7.6.9 | 7.6.9 |
| github.com/ionic-team/capacitor-swift-pm | swift | >= 6.0.0, < 6.2.2 | 6.2.2 |
| github.com/ionic-team/capacitor-swift-pm | swift | >= 7.0.0, < 7.6.9 | 7.6.9 |
| com.capacitorjs:core | maven | >= 6.0.0, < 6.2.2 | 6.2.2 |
| com.capacitorjs:core | maven | >= 7.0.0, < 7.6.9 | 7.6.9 |
| @capacitor/android | npm | >= 8.5.0, < 8.5.1 | 8.5.1 |
| @capacitor/ios | npm | >= 8.5.0, < 8.5.1 | 8.5.1 |
| github.com/ionic-team/capacitor-swift-pm | swift | >= 8.5.0, < 8.5.1 | 8.5.1 |
| com.capacitorjs:core | maven | >= 8.5.0, < 8.5.1 | 8.5.1 |
| com.capacitorjs:core | maven | >= 8.3.5, < 8.4.3 | 8.4.3 |
| @capacitor/android | npm | >= 8.3.5, < 8.4.3 | 8.4.3 |
| @capacitor/ios | npm | >= 8.3.5, < 8.4.3 | 8.4.3 |
| github.com/ionic-team/capacitor-swift-pm | swift | >= 8.3.5, < 8.4.3 | 8.4.3 |
| github.com/ionic-team/capacitor-swift-pm | swift | >= 8.0.0, <= 8.3.4 |
| com.capacitorjs:core | maven | >= 8.0.0, <= 8.3.4 |
| @capacitor/android | npm | >= 8.0.0, <= 8.3.4 |
| @capacitor/ios | npm | >= 8.0.0, <= 8.3.4 |
Registered plugins are consulted before the navigation guard runs, so a small
plugin can block the path. On Android, override shouldOverrideLoad(Uri url) and
return true when url.getPath() starts with /_capacitor_http_interceptor_.
On iOS, implement shouldOverrideLoad(_:) and return true for the same path.
Returning true cancels the navigation; return null/nil for all other URLs
so normal navigation is unchanged.
Independently, sanitize user-controlled link targets before rendering them in the WebView.