Capacitor
Monthly
Untrusted-link activation inside an Ionic Capacitor app on Android or iOS can render attacker-controlled HTML at the application's own origin via the internal /_capacitor_http_interceptor_ proxy path, giving that script full same-origin access to storage, cookies and registered Capacitor plugin capabilities. Affected releases are 6.0.0 up to (but not including) 6.2.2, 7.6.9, 8.3.5, 8.4.3 and 8.5.1; exploitation requires the victim to activate an attacker-supplied link in the WebView (UI:R) but no authentication (PR:N) and no non-default feature flag, so apps are exposed even when the CapacitorHttp plugin is disabled because vulnerable builds serve the proxy path regardless of that setting. No public exploit code or confirmed active exploitation was identified at time of analysis, though the high CVSS score of 9.3 (S:C/C:H/I:H) and the broad mobile install base make patch urgency high.
Untrusted-link activation inside an Ionic Capacitor app on Android or iOS can render attacker-controlled HTML at the application's own origin via the internal /_capacitor_http_interceptor_ proxy path, giving that script full same-origin access to storage, cookies and registered Capacitor plugin capabilities. Affected releases are 6.0.0 up to (but not including) 6.2.2, 7.6.9, 8.3.5, 8.4.3 and 8.5.1; exploitation requires the victim to activate an attacker-supplied link in the WebView (UI:R) but no authentication (PR:N) and no non-default feature flag, so apps are exposed even when the CapacitorHttp plugin is disabled because vulnerable builds serve the proxy path regardless of that setting. No public exploit code or confirmed active exploitation was identified at time of analysis, though the high CVSS score of 9.3 (S:C/C:H/I:H) and the broad mobile install base make patch urgency high.