[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
@capacitor/ios (source)	6.1.0 → 6.2.2

---

Capacitor Android and iOS: remote content can be loaded at the app origin via the internal HTTP proxy path

CVE-2026-103922 / GHSA-rvm3-566m-v7fv

More information

Details

Impact

Capacitor's WebView navigation guard validated only the host and scheme of a
target URL, not its path. Because the internal HTTP proxy path
(/_capacitor_http_interceptor_) is served at the application's own origin, a
frame navigation to it was always treated as in-app navigation and allowed.

Loading that path as a document caused the native layer to fetch an arbitrary,
caller-specified URL and return the response body to the WebView at the app's
own origin. Script in that response then ran with full same-origin trust:
access to localStorage, cookies, and every native capability the application
exposes through its registered Capacitor plugins.

The proxy handler was additionally served regardless of whether the
CapacitorHttp plugin was enabled, so applications that never enabled
CapacitorHttp were also affected.

Exploitation requires a victim to activate a link inside the application's
WebView. Any Capacitor application that renders user-controlled or unsanitized
links (chat messages, comments, rich-text content) is a viable delivery surface.

Both Android and iOS are affected.

Patches

Two changes on each platform:

1. The navigation guard now blocks frame navigations whose path is the internal
   proxy path.
2. The proxy handler is served only when CapacitorHttp is enabled, and never
   for a document (main frame) request.

Legitimate CapacitorHttp usage is unaffected. fetch and XMLHttpRequest are
subresource requests and do not pass through the navigation guard.

Upgrade to a patched version, then rebuild and redistribute your application.

Workarounds

If you cannot upgrade immediately, note first that disabling CapacitorHttp
is not sufficient on affected versions, because the proxy path is served
regardless of that setting.

Registered plugins are consulted before the navigation guard runs, so a small
plugin can block the path. On Android, override shouldOverrideLoad(Uri url) and
return true when url.getPath() starts with /_capacitor_http_interceptor_.
On iOS, implement shouldOverrideLoad(_:) and return true for the same path.
Returning true cancels the navigation; return null/nil for all other URLs
so normal navigation is unchanged.

Independently, sanitize user-controlled link targets before rendering them in the
WebView.

Severity

• CVSS Score: 9.3 / 10 (Critical)
• Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N

References

• https://github.com/ionic-team/capacitor/security/advisories/GHSA-rvm3-566m-v7fv
• https://nvd.nist.gov/vuln/detail/CVE-2026-103922
• https://github.com/ionic-team/capacitor/commit/430356a91e1419fc66862dc09835081aa501677e
• https://github.com/ionic-team/capacitor/commit/745b5f805bf77bc6463977cc7d718cd9de44ccbc
• https://github.com/ionic-team/capacitor/commit/80b6c5e81d062e1e158914040f49e044d95b7ccb
• https://github.com/ionic-team/capacitor/commit/85ccc44151fdd5ae5e0d806d875766ef4b84ad5d
• https://github.com/ionic-team/capacitor/commit/af9a287fef45f0ac68ce640cb42fed2d06b0f1b4
• https://github.com/ionic-team/capacitor/commit/d5e3170ba0ff155fc542b7e6d16cff5201406540
• https://github.com/ionic-team/capacitor/commit/ee586ae680887ba99d066616f976db149542d922
• https://github.com/ionic-team/capacitor/releases/tag/8.5.1
• https://github.com/advisories/GHSA-rvm3-566m-v7fv

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Release Notes

ionic-team/capacitor (@​capacitor/ios)

v6.2.2

Compare Source

Bug Fixes

• block navigation to the internal HTTP proxy path (d5e3170)
• block the HTTP proxy path in subframes (85ccc44)
• publish Capacitor 6 as latest-6 (#​7950) (5ee9161)

v6.2.1

Compare Source

Bug Fixes

• android: sanitize portable file name (#​7894) (#​7895) (0ac1d50)
• cli: don't run bundle if not installed (#​7896) (#​7903) (03dcb5e)
• http: boundary not added for Request objects (#​7897) (#​7904) (459cac2)
• ios: don't check isMediaExtension on range requests (#​7868) (#​7873) (f34a008)

v6.2.0

Compare Source

Bug Fixes

• cli: make Cordova plugins use same default kotlin version as Capacitor (#​7756) (96dde8c)
• cli: replace app-store deprecated method on build (#​7637) (942b108)
• ios: fix retain cycle caused by CDVPluginManager (#​7692) (#​7694) (dd068fe)
• use Capacitor 6 for SPM dependency (#​7737) (8e55ca5)

Features

• core: cherrypick: expose methodName via CAPPluginCall (#​7641) (#​7684) (bf6ef8e)
• ios: cherry-pick - JSValueEncoder/Decoder feature parity with JSONEncoder/Decoder (#​7657) (ce30924)

v6.1.2

Compare Source

Bug Fixes

• android: better cleaning of allowedOrigin url (#​7607) (d123260)
• http: pass original url as query param on the proxy url (#​7527) (1da06e6)
• support dependencies with ".swift" at the end of name (#​7583) (ceee68a)

v6.1.1

Compare Source

Bug Fixes

• android: Allow WebView to load blob urls (#​7551) (0dca917)
• android: javascript injection not working on urls with query (#​7545) (57ce5c6)
• android: send FormData on older devices (#​7519) (de8b50d)
• android: UTF-8 encode form data value (#​7525) (a73ed31)
• cli: enable cleartext for live reload (#​7563) (e06648f)
• http: handle UInt8Array on body (#​7546) (cfb9ce1)
• ios: make removeAllListeners accessible from javascript (#​7566) (388a822)
• ios: Match CapApp-SPM iOS version with project version (#​7556) (df4dc9a)

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.