6.1

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-42184

CVE-2026-42184: Tauri: Origin Confusion Allows Remote Pages to Invoke Local-Only IPC Commands

Tauri is a framework for building binaries for all major desktop platforms. From 2.0 to 2.11.0, a flaw in Tauri's is_local_url() function causes it to incorrectly classify remote URLs as trusted local origins on Windows and Android. On these systems, Tauri maps custom URI scheme protocols to http://<scheme>.localhost/ because those platforms' WebView implementations cannot serve custom URI schemes directly. The issue is that Tauri's check to see if the origin is local, only checks the first subdomain of the URL. An attacker can abuse this by hosting a page on a domain whose subdomain matches the custom scheme of the application. This vulnerability is fixed in 2.10.3.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-42184

CVE-2026-42184:

6.1

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

SSVC / BOD 26-04 ↗

Exploitation pocAutomatable NoTech Impact Partial

Select your environment

→SSVCDeferfix on upgrade

Runtime reachability resolves your actual outcome.Book a demo

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
tauri	rust	>= 2.0.0, <= 2.11.0	2.11.1

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability exists in the is_local_url function within the tauri::webview::Webview implementation, specifically under compilation targets for Windows and Android. The advisory and the commit patch clearly indicate that the logic for determining a local origin was flawed. The original code would extract the first part of a domain name (e.g., 'app' from 'app.evil.com') and check if it matched a registered custom protocol. This created an origin confusion vulnerability, allowing a remote page to be treated as a trusted local page. The identified vulnerable function, tauri::webview::Webview::is_local_url, is the exact location of this flawed logic. The patch replaces the incorrect domain parsing with a strict check that the domain must be of the format <protocol>.localhost, effectively mitigating the vulnerability. Therefore, any runtime profile during exploitation on an affected system would show this function in the stack trace when the malicious URL is being processed.

Vulnerable functions

tauri::webview::Webview::is_local_url

crates/tauri/src/webview/mod.rs

On Windows and Android, the `is_local_url` function incorrectly validated if a URL was local. It would split the domain on the first '.' and check if the resulting substring matched a registered protocol. This allowed an attacker to use a domain like `app.evil.com` to impersonate a local `app://` URL, because the check would only see 'app'. This flaw granted the remote page access to local-only IPC commands. The patch corrects this by ensuring the domain strictly ends with '.localhost' and the preceding part matches a registered protocol.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.