Local URL Classification Flaw in Tauri Framework for Windows and Android
CVE-2026-42184

6.1MEDIUM

Key Information:

Vendor

Tauri-apps

Status
Tauri
Vendor
CVE Published:
27 May 2026

What is CVE-2026-42184?

A flaw in the Tauri framework's is_local_url() function allows remote URLs to be incorrectly classified as trusted local origins on Windows and Android platforms. This vulnerability arises because, on these systems, the Tauri framework maps custom URI scheme protocols to http://.localhost/. The function only checks the first subdomain of the URL, allowing an attacker to exploit this by hosting a page on a domain with a subdomain that matches the custom scheme of the application. Consequently, the vulnerability poses significant risks for data integrity and application security. Users are encouraged to upgrade to version 2.10.3 or later to mitigate this issue.

Affected Version(s)

tauri >= 2.0, < 2.11.1

References

https://github.com/tauri-apps/tauri/security/advisories/G...
x_refsource_CONFIRM

CVSS V4

Score:
6.1
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
High
Availability:
Low
Attack Vector:
Network
Attack Complexity:
High
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.