{"generated_at":"2026-10-23T14:57:34.576Z","count":5,"incidents":[{"id":"capacitor-android-and-ios-remote-content-can-be-loaded-a-cve-2026-103922","url":"https://pwned.coffee/i/capacitor-android-and-ios-remote-content-can-be-loaded-a-cve-2026-103922","title":"Capacitor Android and iOS: remote content can be loaded at the app origin via the internal HTTP proxy path","summary":"### Impact Capacitor's WebView navigation guard validated only the **host and scheme** of a target URL, not its **path**. Because the internal HTTP proxy path (`/_capacitor_http_interceptor_`) is served at the application's own origin, a frame navigation to it was always treated as in-app navigation and allowed. Loading that path as a document caused the…","severity":"critical","patch_status":"partial","status":"live","exploited":false,"affected":"@capacitor/android (npm), @capacitor/ios (npm), github.com/ionic-team/capacitor-swift-pm (swift), com.capacitorjs:core (maven)","fixed_versions":["@capacitor/android 6.2.2","@capacitor/android 7.6.9","@capacitor/ios 6.2.2","@capacitor/ios 7.6.9","github.com/ionic-team/capacitor-swift-pm 6.2.2","github.com/ionic-team/capacitor-swift-pm 7.6.9","com.capacitorjs:core 6.2.2","com.capacitorjs:core 7.6.9","@capacitor/android 8.5.1","@capacitor/ios 8.5.1","github.com/ionic-team/capacitor-swift-pm 8.5.1","com.capacitorjs:core 8.5.1","com.capacitorjs:core 8.4.3","@capacitor/android 8.4.3","@capacitor/ios 8.4.3","github.com/ionic-team/capacitor-swift-pm 8.4.3"],"ids":["CVE-2026-103922"],"stack":["npm","java","apple","android"],"first_seen":"2026-10-05T22:53:10Z","updated_at":"2026-10-05T22:53:10Z"},{"id":"google-pixel-improper-authorization-vulnerability-cve-2026-58704","url":"https://pwned.coffee/i/google-pixel-improper-authorization-vulnerability-cve-2026-58704","title":"Google Pixel Improper Authorization Vulnerability","summary":"Google Pixel devices contain an improper authorization vulnerability in the cellular modem. A logic error may allow an attacker to bypass permission checks and escalate privileges. Added to CISA KEV on 2026-09-16 (federal deadline 2026-09-19).","severity":"high","patch_status":"patched","status":"past","exploited":true,"affected":"Google Pixel","fixed_versions":[],"ids":["CVE-2026-58704"],"stack":["android"],"first_seen":"2026-09-16T12:00:00.000Z","updated_at":"2026-09-16T12:00:00.000Z"},{"id":"android-framework-integer-overflow-vulnerability-cve-2025-48595","url":"https://pwned.coffee/i/android-framework-integer-overflow-vulnerability-cve-2025-48595","title":"Android Framework Integer Overflow Vulnerability","summary":"Android Framework contains an integer overflow vulnerability that allows for code execution that could allow for local privilege escalation. Added to CISA KEV on 2026-06-02 (federal deadline 2026-06-05).","severity":"high","patch_status":"patched","status":"past","exploited":true,"affected":"Android Framework","fixed_versions":[],"ids":["CVE-2025-48595"],"stack":["android"],"first_seen":"2026-06-02T12:00:00.000Z","updated_at":"2026-06-02T12:00:00.000Z"},{"id":"google-skia-out-of-bounds-write-vulnerability-cve-2026-3909","url":"https://pwned.coffee/i/google-skia-out-of-bounds-write-vulnerability-cve-2026-3909","title":"Google Skia Out-of-Bounds Write Vulnerability","summary":"Google Skia contains an out-of-bounds write vulnerability that could allow a remote attacker to perform out of bounds memory access via a crafted HTML page. This vulnerability affects Google Chrome and ChromeOS, Android, Flutter, and possibly other products. Added to CISA KEV on 2026-03-13 (federal deadline 2026-03-27).","severity":"high","patch_status":"patched","status":"past","exploited":true,"affected":"Google Skia","fixed_versions":[],"ids":["CVE-2026-3909"],"stack":["chrome","android"],"first_seen":"2026-03-13T12:00:00.000Z","updated_at":"2026-03-13T12:00:00.000Z"},{"id":"android-framework-information-disclosure-vulnerability","url":"https://pwned.coffee/i/android-framework-information-disclosure-vulnerability","title":"Android Framework Information Disclosure Vulnerability","summary":"Android Framework contains an unspecified vulnerability that allows for information disclosure. Can be chained with CVE-2025-48572. Added to CISA KEV on 2025-12-02 (federal deadline 2025-12-23).","severity":"high","patch_status":"patched","status":"past","exploited":true,"affected":"Android Framework","fixed_versions":[],"ids":["CVE-2025-48572","CVE-2025-48633"],"stack":["android"],"first_seen":"2025-12-02T12:00:00.000Z","updated_at":"2025-12-02T12:00:00.000Z"}]}