Tia N.List

Reported by 3 outlets

Capacitor Vulnerability CVE-2026-103922

hot0.0
Why this score
Breadth
1.50 / 2.0 · 3 sources
Authority
1.20 / 2.0 · best outlet weight
Severity
1.00 / 5.0 · CVSS + content signals
Velocity
0.00 / 2.0 · updates in 48h
Pickup speed
0.09 / 0.6 · time to second source
Recency
× 0.00 temporal multiplier
Community
+ 0.00 / 1.5 · reddit signal
Score
0.0 / 10 = base × recency + community
gbhackers.combeyondmachines.netintel.threadlinqs.com CVE-2026-103922 first seen 11d ago

Analysis

Capacitor vulnerability CVE-2026-103922 (CVSS 9.3) allows attacker-controlled remote content to execute within vulnerable Android and iOS apps at the application's own origin, exposing same-origin data, cookies, local storage, and native functionality through WebView navigation handling. The flaw requires a malicious link tapped by a user; once triggered, attacker scripts run with full app-origin trust. GBHackers and BeyondMachines reported the issue, and a Threadlinqs aggregator post notes 9 detections and 20 IOCs linked to TL-2026-2894. No patch timeline is confirmed in the event content. Watch for vendor patch releases and whether mobile apps in finance or healthcare adopt fixes quickly.

Timeline

  1. original reporting

    Capacitor Vulnerability Lets Remote Content Run With Full App Origin Trust

    gbhackers.com · 11d ago · October 2nd, 2026

    A critical vulnerability in Capacitor, identified as CVE-2026-103922, could allow attacker-controlled remote content to execute within vulnerable Android and iOS applications, posing as the application’s own trusted origin. This flaw, assigned a CVSS score of 9.3, affects WebView navigation handling in Capacitor and can expose same-origin data, cookies, local storage, and native functionality available through […] The post Capacitor Vulnerability Lets Remote Content Run With Full App Origin Trust appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform .

  2. update from beyondmachines.net

    Critical Capacitor Flaw Allows Malicious Links to Hijack Mobile App Data and Native Features Capacitor patched a critical vulnerability (CVE

    beyondmachines.net · 9d ago · October 4th, 2026

    Critical Capacitor Flaw Allows Malicious Links to Hijack Mobile App Data and Native Features Capacitor patched a critical vulnerability (CVE

    via Mastodon https://beyondmachines.net/event_details/critical-capacitor-flaw-allows-malicious-links-to-hijack-mobile-app-data-and-native-features-g-8-t-k-g/gD2P6Ple2L

Source on GitHub