Skip to content

🚨 [security] Update @capacitor/android 7.4.3 → 7.6.9 (minor) - #251

Open
depfu[bot] wants to merge 1 commit into
mainfrom
depfu-update-npm-capacitor-android-7.6.9
Open

🚨 [security] Update @capacitor/android 7.4.3 → 7.6.9 (minor)#251
depfu[bot] wants to merge 1 commit into
mainfrom
depfu-update-npm-capacitor-android-7.6.9

Conversation

@depfu

@depfu depfu Bot commented Oct 6, 2026

Copy link
Copy Markdown
Contributor

🚨 Your current dependencies have known security vulnerabilities 🚨

This dependency update fixes known security vulnerabilities. Please see the details below and assess their impact carefully. We recommend to merge and deploy this as soon as possible!

Here is everything you need to know about this update. Please take a good look at what changed and the test results before merging this pull request.

What changed?

✳️ @​capacitor/android (7.4.3 → 7.6.9) · Repo · Changelog

Security Advisories 🚨

🚨 Capacitor Android and iOS: remote content can be loaded at the app origin via the internal HTTP proxy path

Impact

Capacitor's WebView navigation guard validated only the host and scheme of a
target URL, not its path. Because the internal HTTP proxy path
(/_capacitor_http_interceptor_) is served at the application's own origin, a
frame navigation to it was always treated as in-app navigation and allowed.

Loading that path as a document caused the native layer to fetch an arbitrary,
caller-specified URL and return the response body to the WebView at the app's
own origin. Script in that response then ran with full same-origin trust:
access to localStorage, cookies, and every native capability the application
exposes through its registered Capacitor plugins.

The proxy handler was additionally served regardless of whether the
CapacitorHttp plugin was enabled, so applications that never enabled
CapacitorHttp were also affected.

Exploitation requires a victim to activate a link inside the application's
WebView. Any Capacitor application that renders user-controlled or unsanitized
links (chat messages, comments, rich-text content) is a viable delivery surface.

Both Android and iOS are affected.

Patches

Two changes on each platform:

  1. The navigation guard now blocks frame navigations whose path is the internal
    proxy path.
  2. The proxy handler is served only when CapacitorHttp is enabled, and never
    for a document (main frame) request.

Legitimate CapacitorHttp usage is unaffected. fetch and XMLHttpRequest are
subresource requests and do not pass through the navigation guard.

Upgrade to a patched version, then rebuild and redistribute your application.

Workarounds

If you cannot upgrade immediately, note first that disabling CapacitorHttp
is not sufficient on affected versions, because the proxy path is served
regardless of that setting.

Registered plugins are consulted before the navigation guard runs, so a small
plugin can block the path. On Android, override shouldOverrideLoad(Uri url) and
return true when url.getPath() starts with /_capacitor_http_interceptor_.
On iOS, implement shouldOverrideLoad(_:) and return true for the same path.
Returning true cancels the navigation; return null/nil for all other URLs
so normal navigation is unchanged.

Independently, sanitize user-controlled link targets before rendering them in the
WebView.

Release Notes

7.6.9

7.6.9 (2026-08-31)

Bug Fixes

  • block navigation to the internal HTTP proxy path (430356a)
  • block the HTTP proxy path in subframes (80b6c5e)

7.6.0

7.6.0 (2026-03-06)

Bug Fixes

  • android: Add missing null checks in BridgeActivity (#8185) (48b1a33)
  • android: Concurrent Range Requests for assets (#8357) (87cfc86)
  • android: handle lowercase range header (#8368) (634ee64)
  • android: invalid http range seeking (#8369) (1357a34)
  • cli: Allow to run update on non macOS (#8344) (#8345) (0579499)
  • cli: Don't overwrite config.server section with --live-reload (#7528) (bf5e07f)

Features

  • cli: Add --https option for --live-reload (#8194) (de47d79)

7.5.0

7.5.0 (2026-02-11)

Bug Fixes

  • android: AGP 9.0 no longer supports proguard-android.txt (#8315) (d716e41)
  • cli: Update tar package (#8311) (#8313) (f62bf77)
  • cookies: only send expires param on web if a date is set (259202b)

Features

7.4.4

7.4.4 (2025-10-22)

Bug Fixes

  • cli: change SPM incompatible plugin message (#8129) (#8130) (bbaa8fa)
  • cli: Don't exclude Cordova plugins from SPM management (#8140) (#8142) (e871851)
  • ios: also call bridge.reset() on webViewWebContentProcessDidTerminate (#8150) (5287a74)

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by 61 commits:

✳️ @​capacitor/core (7.4.3 → 7.6.9) · Repo · Changelog

Commits

See the full diff on Github. The new version differs by 61 commits:

Depfu Status

Depfu will automatically keep this PR conflict-free, as long as you don't add any commits to this branch yourself. You can also trigger a rebase manually by commenting with @depfu rebase.

All Depfu comment commands
@​depfu rebase
Rebases against your default branch and redoes this update
@​depfu recreate
Recreates this PR, overwriting any edits that you've made to it
@​depfu merge
Merges this PR once your tests are passing and conflicts are resolved
@​depfu cancel merge
Cancels automatic merging of this PR
@​depfu close
Closes this PR and deletes the branch
@​depfu reopen
Restores the branch and reopens this PR (if it's closed)
@​depfu pause
Ignores all future updates for this dependency and closes this PR
@​depfu pause [minor|major]
Ignores all future minor/major updates for this dependency and closes this PR
@​depfu resume
Future versions of this dependency will create PRs again (leaves this PR as is)

@depfu depfu Bot added dependencies Only updates dependecies depfu labels Oct 6, 2026
@depfu depfu Bot assigned Tobi2K Oct 6, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

@Tobi2K Tobi2K

Labels

dependencies Only updates dependecies depfu

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@Tobi2K