P5 Verified
Capacitor Android and iOS: remote content can be loaded at the app origin via the internal HTTP proxy path
CVE-2026-103922. EPSS 0.00213 (percentile 0.10517), scored 2026-10-03. Fixed version: 4d377eb2d3eabf83f9e6d1c07cb50d92c06db523. Fixed version: 60a677eae8bb27667e8c5c518b38e855c7228968. Fixed version: 82428936581035795b1640e60dc92b2a8d5eeed3. Fixed version: 0c9e35dec13a99ec4a582a2edc536cbec96bf27d. Fixed version: 430356a91e1419fc66862dc09835081aa501677e. Fixed version: 80b6c5e81d062e1e158914040f49e044d95b7ccb. Fixed version: 85ccc44151fdd5ae5e0d806d875766ef4b84ad5d. Fixed version: af9a287fef45f0ac68ce640cb42fed2d06b0f1b4. Fixed version: d5e3170ba0ff155fc542b7e6d16cff5201406540.
- CVE / CWE
- CVE-2026-103922 /
- Vendor / product
- Unavailable / Unavailable
- Severity
- 0.1
- CVSS
- Unavailable · CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N · osv
- EPSS
- 0.00213 · percentile 0.10517 · 2026-10-03
- KEV
- no · added unavailable · due unavailable · ransomware use unavailable
- Exploit signals
- Signal evidence
Affected products
- Product unavailable · Fixed version: 4d377eb2d3eabf83f9e6d1c07cb50d92c06db523
- Product unavailable · Fixed version: 60a677eae8bb27667e8c5c518b38e855c7228968
- Product unavailable · Fixed version: 82428936581035795b1640e60dc92b2a8d5eeed3
- Product unavailable · Fixed version: 0c9e35dec13a99ec4a582a2edc536cbec96bf27d
- Product unavailable · Fixed version: 430356a91e1419fc66862dc09835081aa501677e
- Product unavailable · Fixed version: 80b6c5e81d062e1e158914040f49e044d95b7ccb
- Product unavailable · Fixed version: 85ccc44151fdd5ae5e0d806d875766ef4b84ad5d
- Product unavailable · Fixed version: af9a287fef45f0ac68ce640cb42fed2d06b0f1b4
- Product unavailable · Fixed version: d5e3170ba0ff155fc542b7e6d16cff5201406540
- Product unavailable · Fixed version: ee586ae680887ba99d066616f976db149542d922
Provenance
- OSV.dev · Source record · observed 2026-10-04 08:10:59.885464+00:00 UTC
Stable permalink: https://cybercodered.org/item/cve-cve-2026-103922.html