The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →CVE-2026-103922 is a critical flaw in Capacitor’s Android and iOS WebViews. It can let a crafted link opened inside an app load attacker-chosen content with the app’s own origin, potentially exposing WebView storage and capabilities provided through registered plugins. The fix is to upgrade to the patched release for your branch, then rebuild and redistribute the app. The headline’s download figure needs qualification: npm displayed 4,853,190 weekly downloads for @capacitor/core when checked in 2026, not 5.5 million; downloads do not indicate how many apps are vulnerable.
What CVE-2026-103922 does
Capacitor’s navigation guard checked a destination’s scheme and host but did not adequately validate its path. That left an internal HTTP proxy endpoint, /_capacitor_http_interceptor_, reachable as an in-app document. When a frame navigated to that path, the native proxy could fetch a caller-selected URL and return its response body to the WebView as content from the application’s own origin.
As an Amazon Associate I earn from qualifying purchases.
Because the returned content is treated as same-origin, script in it can access WebView data such as localStorage and cookies, as well as capabilities exposed through registered Capacitor plugins. This is not simply a case of an external link opening in a browser: the risk comes from the proxy returning attacker-selected content with the app’s origin trust.
Free tools Windows power users keep installed
One-click scans. No signup required.
The Ionic advisory rates the issue Critical, with a CVSS v3.1 base score of 9.3. Its vector includes required user interaction (UI:R), changed scope (S:C), and high confidentiality and integrity impact. The advisory says exploitation requires a victim to activate a link inside the application’s WebView; it is not a zero-click attack. See the Ionic security advisory.
#1 Best Overall
- All products are tested for stability, consistency and reliability,Ensure product excellence
- Save time with this handy box full of the most practical and common electronic components
- Easy to store: Each different component is packaged in a plastic bag, Resistors values are stamped with the according value
- Electronic components set include: diodes, resistors, transistors, LED diodes, electrolytic capacitors, ceramic capacitors
- Electronics component kit: This is a great assortment of components for electronic professionals or enthusiasts
Am I affected by CVE-2026-103922?
Check the Capacitor versions actually included in your Android or iOS app, rather than relying only on the version declared in a package manifest. The advisory covers both platforms and identifies affected artifacts across npm, Maven, and Swift package ecosystems. Compare the version in the project’s lockfile and native build against the affected ranges below.
| Capacitor branch | Affected versions listed by Ionic | Fixed version |
|---|---|---|
| 6.x | 6.0.0 up to, but not including, 6.2.2 | 6.2.2 |
| 7.x | 7.0.0 up to, but not including, 7.6.9 | 7.6.9 |
| 8.x | 8.0.0 up to, but not including, 8.3.5; 8.3.5 up to 8.4.3; and 8.5.0 up to 8.5.1 | 8.3.5, 8.4.3, and 8.5.1, respectively |
The affected and fixed ranges above are those in the Ionic advisory. Use the fix corresponding to your branch; do not assume that a patch number on one major branch applies to another. The official Capacitor 8.5.1 release notes, dated 2026-08-31, specifically list blocking navigation to the internal HTTP proxy path as a bug fix.
Rank #2
- 【Package Included】Electronic components set includes 6 different kinds components: LED diodes, metal film resistors, electrolytic capacitor package, common diodes, ceramic capacitors, common transistor, 1400 pcs in total.
- 【High Quality Electronic Components】This electronic component assortment kit is adopted with high quality material which is safe and durable. All products are tested for stability, consistency and reliability, so you can use them with confidence.
- 【Easy to sort & store 】Each different component is well organized , and you can find the component easily with the sticky note stamped on the bag. Moreover, all components are packaged in a plastic bag which can protect them form damaged and lost.
- 【Great component kit】This is a great assortment of components for electronic professionals or enthusiasts and1400pcs components will meet your various needs. It's value for money!
- 【Service Guarantee】If you have any questions about this electronic component assortment kit, please feel free to contact us and we will reply within 24 hours. Sincerely wish you a happy shopping!
How the flaw could reach an app
A user must activate a link in the app’s WebView. The advisory identifies user-controlled or unsanitized links in chats, comments, and rich-text content as possible delivery surfaces. Exposure therefore depends in part on whether an app renders such links in its WebView; the advisory does not establish that every Capacitor app or user is compromised.
The issue is not limited to cases where an app deliberately enables the CapacitorHttp plugin. The advisory says the proxy handler existed regardless of that setting, so disabling CapacitorHttp does not mitigate affected releases.
Rank #3
- 24 Values, 480pcs Total: Includes 20pcs of each value (10pF, 22pF, 30pF, 47pF, 100pF, 220pF, 330pF, 470pF, 1nF, 2.2nF, 3.3nF, 4.7nF, 6.8nF, 10nF, 22nF, 47nF, 68nF, 100nF, 220nF, 470nF, 1uF, 2.2uF, 4.7uF, 10uF), covering a wide range for diverse electronics projects.
- Premium Quality & Durability: Multilayer monolithic ceramic capacitors with 50V withstand voltage, ±10% tolerance, and epoxy resin coating for humidity resistance and long-term reliability.
- Organized Storage Box: Compact re-sealable plastic case with labeled compartments to prevent mixing and ensure easy access. Ideal for hobbyists and engineers.
- Versatile Applications: Perfect for bypass circuits, filtering, signal coupling, DIY electronics, industrial control systems, and electron experiments.
- Clear Markings & Easy Identification: Each capacitor features printed capacitance codes (e.g., 104=100nF=0.1uF), simplifying component selection during assembly.
How to fix CVE-2026-103922
- Identify the shipped branch and versions. Inspect the dependency lockfile and the Android and iOS native build configuration to determine which Capacitor artifacts are included.
- Upgrade to that branch’s fixed release. Use 6.2.2 for the affected 6.x range, 7.6.9 for 7.x, or the appropriate 8.x fix listed above. Follow the vendor advisory for the package-specific details.
- Rebuild and redistribute the application. Updating a source dependency does not change binaries already installed on users’ devices. Ionic’s instruction is: “Upgrade to a patched version, then rebuild and redistribute your application.”
- Review WebView link handling. Sanitize user-controlled link targets before rendering them, especially in chat, comment, or rich-text features.
Legitimate CapacitorHttp use is not expected to be broken by the fix: according to the advisory, fetch and XMLHttpRequest traffic is handled as subresource requests and does not pass through the navigation guard.
Temporary protection if an upgrade cannot ship yet
The Ionic advisory describes a plugin workaround that blocks navigations whose path starts with /_capacitor_http_interceptor_. It identifies the platform hooks as Android shouldOverrideLoad(Uri url) and iOS shouldOverrideLoad(_:). Apply a path check to the navigation on each affected platform while preparing the patched release, and verify that the check rejects the internal proxy path before it can load as a document.
Rank #4
- LED : 100 Pcs 3 mm and 100 Pcs 5 mm diodes 5 colors (red yellow white blue green)
- Diodes : 100 Pcs (8 Type) 1N4007 1N4148 1N5399 1N5819 FR107 FR207 1N5822 1N5408
- Transistor : 180 Pcs (18 Type 10 pcs each) S9012 S9013 S9014 S9015 S9018 A1015 C1815 S8050 S8550 A42 2N5401 2N5551 A733 C945 2N3906 2N3904 2N2222 A92
- Aluminum electrolytic capacitors : 120 Pcs (12 Type 10 pcs each) 50 V 0.22 0.47 1 2.2 4.7 uF ; 16V 22 33 47 100 220 470 uF ; 25V 10uF
- Ceramic capacitors : 300 Pcs (30 models 10 pcs each) 2 / 3 / 5 / 10 / 15 / 22 / 30 / 33 / 47 / 68 / 75 / 82 / 101 / 151 / 221 / 331 / 471 / 681 / 102 / 152 / 222 / 332 / 472 / 682 / 103 / 223 / 473 / 683 / 104 pF
This is a temporary guard, not a substitute for upgrading and redistributing a patched app. Simply turning off CapacitorHttp is not a workaround because the vulnerable proxy path remains served in affected versions.
What the 5.5 million download claim means
The npm listing for @capacitor/core displayed 4,853,190 weekly downloads when accessed in 2026. That is a volatile package-download count, not a count of distinct apps, installations, or vulnerable users. It does not substantiate the headline’s 5.5 million figure, and neither that count nor the advisory establishes how many deployed apps are affected. The current count can change; see the npm package listing.
Quick Recap
Best Value
- Box including: Resistors, Transistors, Diodes, Zeners, Inductors, ICs, Crystal Oscillators, PCBs, LEDs, Mini Switch, Potentiometer, Trim Pots, LDRs, Headers, Terminals
- Includes 2200 pcs of the most important and usefull Eletronic Components Electronic Component Assortment
- Assorted by Professionals, made for Professionals
- Comes in a recyclable 11 * 7 * 2.5 inch Box, well organized
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
