Critical Capacitor Flaw Lets Malicious Links Access App Data and Native Features

What happened?

A critical vulnerability in Capacitor for Android and iOS could let a malicious link opened inside an affected mobile app load attacker-controlled web content at the application’s trusted origin. The issue, tracked as CVE-2026-103922, can expose app data stored in localStorage and cookies and give malicious scripts access to native Capacitor features available through registered plugins. The vulnerability affects Capacitor applications using vulnerable releases of the Android, iOS, Maven, and Sw

Key details

• A malicious link opened in a vulnerable Capacitor app can load attacker‑controlled web content under the app’s trusted origin.
• The flaw may expose data stored in localStorage and cookies and allow malicious scripts to use native Capacitor plugin capabilities.
• Exploitation requires the victim to click the crafted link inside the app’s WebView, providing the necessary user interaction.
• Disabling the CapacitorHttp plugin does not mitigate the issue because the internal proxy handler stays active on vulnerable versions.

Summarised by SecOraLens from Cyber Security News. Always read the original source before acting. How SecOraLens verifies advisories.