Capacitor 8

Last reviewed Oct 11, 2026

Export as PDF

Prompt Details

Prompt Composition

3prompts
  1. JavaScript ES2026102 lines · 3.1K tokens
  2. Node.js 24101 lines · 5.3K tokens
  3. Capacitor 863 lines · 2.4K tokens
Total266 lines · 10.8K tokens

CWE Coverage

  • 20
  • 22
  • 59
  • 78
  • 79
  • 88
  • 89
  • 95
  • 113
  • 117
  • 208
  • 209
  • 214
  • 250
  • 295
  • 297
  • 319
  • 323
  • 330
  • 338
  • 346
  • 347
  • 352
  • 354
  • 362
  • 367
  • 377
  • 426
  • 444
  • 459
  • 471
  • 488
  • 494
  • 502
  • 524
  • 532
  • 602
  • 613
  • 653
  • 668
  • 732
  • 749
  • 770
  • 772
  • 807
  • 829
  • 838
  • 862
  • 863
  • 908
  • 916
  • 918
  • 922
  • 926
  • 941
  • 942
  • 943
  • 1004
  • 1321
  • 1333

Prompt Preview

Apply ES2026 to app code and Node.js 24 to Node-based build/CLI processes; app JavaScript runs in the device WebView, so verify browser APIs there. Checked against Capacitor 8.5.1: the CLI needs Node.js 22+, native minimums are iOS 15 and Android 7/API 24 with Xcode 26+ and JDK 21, and minimums don't establish security support. Apply plugin rules only when that compatible plugin is installed.

WebView and navigation

  • Ship bundled webDir assets: omit server.url, keep server.cleartext: false and android.allowMixedContent: false, and strip live-reload overrides from release config.
  • Keep production server.allowNavigation empty and open external content in a system browser or bridge-free view; added hosts gain trusted navigation without path authorization or native-network policy.
  • Keep untrusted documents/iframes out of the bridge WebView; put an early CSP meta in bundled index.html limiting script/connection sources, with frame-src 'none' unless embedding has reviewed isolation.
  • Validate user-controlled link targets before WebView rendering, and external destinations before window.open, browser plugins, or native intents; allow only required schemes/destinations. Opening outside the WebView validates nothing.
  • In custom shouldOverrideLoad, return true to reject and null (Android)/nil (iOS) for the default; never blanket false, which permits navigation.
  • With iOS WKAppBoundDomains, include the local hostname, enable ios.limitsNavigationsToAppBoundDomains, and test it; it limits navigation, not plugins.

Native bridge and permissions