Capacitor’s Android and iOS WebView navigation guard validates only the URL’s host and scheme, but it fails to check the path. This oversight allows an attacker to direct a user to the special path /_capacitor_http_interceptor_, where the native proxy retrieves any arbitrary URL chosen by the attacker and serves that content back to the application as if it originated from the app’s own domain. JavaScript executing in that served content therefore gains same‑origin access to the application’s storage, cookies and Capacitor plugin capabilities, effectively permitting remote code execution inside the app’s trusted context. The vulnerability is represented by CWE‑346 (Improper Restriction Of Necessary Privilege) and CWE‑441 (Insecure Direct Object References).

The flaw touches Capacitor for Android and iOS, including the core packages @capacitor:android, @capacitor:ios, com.capacitorjs:core, ionic-team:capacitor, and swift:github.com/ionic-team/capacitor-swift-pm. Any application built with Capacitor versions 6.0.0 through 8.5.1—specifically 6.0.0–6.2.2, 7.6.9, 8.3.5, 8.4.3, and 8.5.1—remains vulnerable, even if the CapacitorHttp feature is disabled, because the proxy path is still exposed. The issue is fixed in the same version numbers listed above and in newer releases.

With a CVSS score of 9.3, the vulnerability is classified as critical. Exploitation requires only that a victim clicks an unexpected or malicious link, which an attacker could embed in email, messaging, or a compromised website. Because the proxy serves content at the app’s origin, the attack bypasses same‑origin policy checks, giving the attacker full control over data and plugin functions. No additional technical barriers exist beyond convincing the user to activate the link, so the risk is high. EPSS is not available and the issue is not listed in KEV, but its severity and mobility make it a top priority.