CVE-2026-103922

Summary

This flaw allows an attacker to navigate a frame to a specific path, enabling the proxy to fetch an attacker-selected URL and access same-origin storage and cookies, posing a significant risk to application security.

Exploitability

Exploitation is relatively straightforward once an untrusted link is activated, requiring the victim to click on the link.

Blast radius

If exploited, the attacker can access sensitive data and execute scripts within the application’s origin, leading to potential data breaches and unauthorized actions.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to Capacitor version 6.2.2, 7.6.9, 8.3.5, 8.4.3, or 8.5.1.

Analysis generated locally by qwen2.5:7b-instruct (no data left the box). AI-assisted — verify against primary sources before acting.