@capacitor/android 8.3.5-nightly-20260529T161937.0 → 8.3.5

package/capacitor/src/main/java/com/getcapacitor/Bridge.java

@@ -387,6 +387,12 @@ public class Bridge {
     }
 
     public boolean launchIntent(Uri url) {
+        // The proxy returns a remote body at the app origin, so block it before plugins can allow it.
+        String path = url.getPath();
+        if (path != null && path.startsWith(CAPACITOR_HTTP_INTERCEPTOR_START)) {
+            return true;
+        }
+
         /*
          * Give plugins the chance to handle the url
          */

package/capacitor/src/main/java/com/getcapacitor/Plugin.java

@@ -1003,7 +1003,8 @@ public class Plugin {
      * Give the plugins a chance to take control when a URL is about to be loaded in the WebView.
      * Returning true causes the WebView to abort loading the URL.
      * Returning false causes the WebView to continue loading the URL.
-     * Returning null will defer to the default Capacitor policy
+     * Returning null will defer to the default Capacitor policy.
+     * Not called for Capacitor's internal HTTP proxy path, which is always blocked.
      */
     @SuppressWarnings("unused")
     public Boolean shouldOverrideLoad(Uri url) {

package/capacitor/src/main/java/com/getcapacitor/PluginConfig.java

@@ -65,17 +65,6 @@ public class PluginConfig {
         return JSONUtils.getInt(config, configKey, defaultValue);
     }
 
-    /**
-     * Get a double value for a plugin in the Capacitor config.
-     *
-     * @param configKey The key of the value to retrieve
-     * @param defaultValue A default value to return if the key does not exist in the config
-     * @return The value from the config, if key exists. Default value returned if not
-     */
-    public double getDouble(String configKey, double defaultValue) {
-        return JSONUtils.getDouble(config, configKey, defaultValue);
-    }
-
     /**
      * Get a string array value for a plugin in the Capacitor config.
      *

package/capacitor/src/main/java/com/getcapacitor/WebViewLocalServer.java

@@ -185,6 +185,11 @@ public class WebViewLocalServer {
         Uri loadingUrl = request.getUrl();
 
         if (null != loadingUrl.getPath() && loadingUrl.getPath().startsWith(Bridge.CAPACITOR_HTTP_INTERCEPTOR_START)) {
+            // Only fetch/XHR should reach the proxy; a document would run remote content at the app origin.
+            boolean httpEnabled = bridge.getConfig().getPluginConfiguration("CapacitorHttp").getBoolean("enabled", false);
+            if (!httpEnabled || isDocumentRequest(request)) {
+                return null;
+            }
             Logger.debug("Handling CapacitorHttp request: " + loadingUrl);
             try {
                 return handleCapacitorHttpRequest(request);
@@ -210,6 +215,24 @@ public class WebViewLocalServer {
         }
     }
 
+    /** isForMainFrame() is false for an iframe and a fetch alike; only navigations send this header. */
+    private boolean isDocumentRequest(WebResourceRequest request) {
+        if (request.isForMainFrame()) {
+            return true;
+        }
+        Map<String, String> headers = request.getRequestHeaders();
+        if (headers == null) {
+            // The proxy needs the headers too, so the request fails there anyway.
+            return false;
+        }
+        for (String header : headers.keySet()) {
+            if ("Upgrade-Insecure-Requests".equalsIgnoreCase(header)) {
+                return true;
+            }
+        }
+        return false;
+    }
+
     private boolean isLocalFile(Uri uri) {
         String path = uri.getPath();
         return path.startsWith(capacitorContentStart) || path.startsWith(capacitorFileStart);
@@ -333,6 +356,9 @@ public class WebViewLocalServer {
         int responseCode = connection.getResponseCode();
         String reasonPhrase = getReasonPhraseFromResponseCode(responseCode);
 
+        // Nothing should render this. If anything does, sandbox keeps it inert and off the app origin.
+        responseHeaders.put("Content-Security-Policy", "sandbox; frame-ancestors 'none'");
+
         return new WebResourceResponse(mimeType, encoding, responseCode, reasonPhrase, responseHeaders, inputStream);
     }
 

package/capacitor/src/main/java/com/getcapacitor/cordova/MockCordovaWebViewImpl.java

@@ -70,12 +70,14 @@ public class MockCordovaWebViewImpl implements CordovaWebView {
 
         @Override
         public void onNativeToJsMessageAvailable(final NativeToJsMessageQueue queue) {
-            cordova.getActivity().runOnUiThread(() -> {
-                String js = queue.popAndEncodeAsJs();
-                if (js != null) {
-                    webView.evaluateJavascript(js, null);
-                }
-            });
+            cordova
+                .getActivity()
+                .runOnUiThread(() -> {
+                    String js = queue.popAndEncodeAsJs();
+                    if (js != null) {
+                        webView.evaluateJavascript(js, null);
+                    }
+                });
         }
     }
 

package/capacitor/src/main/java/com/getcapacitor/plugin/SystemBars.java

@@ -164,18 +164,13 @@ public class SystemBars extends Plugin {
     }
 
     private void initSafeAreaCSSVariables() {
-        WindowInsetsCompat insets;
-
-        if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.VANILLA_ICE_CREAM) {
+        if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.VANILLA_ICE_CREAM && insetHandlingEnabled) {
             View v = (View) this.getBridge().getWebView().getParent();
-            insets = ViewCompat.getRootWindowInsets(v);
-        } else {
-            insets = WindowInsetsCompat.CONSUMED;
-        }
-
-        if (insets != null) {
-            Insets safeAreaInsets = calcSafeAreaInsets(insets);
-            injectSafeAreaCSS(safeAreaInsets.top, safeAreaInsets.right, safeAreaInsets.bottom, safeAreaInsets.left);
+            WindowInsetsCompat insets = ViewCompat.getRootWindowInsets(v);
+            if (insets != null) {
+                Insets safeAreaInsets = calcSafeAreaInsets(insets);
+                injectSafeAreaCSS(safeAreaInsets.top, safeAreaInsets.right, safeAreaInsets.bottom, safeAreaInsets.left);
+            }
         }
     }
 
@@ -191,8 +186,10 @@ public class SystemBars extends Plugin {
                 // We need to correct for a possible shown IME
                 v.setPadding(0, 0, 0, keyboardVisible ? imeInsets.bottom : 0);
 
-                Insets safeAreaInsets = calcSafeAreaInsets(insets);
-                injectSafeAreaCSS(safeAreaInsets.top, safeAreaInsets.right, safeAreaInsets.bottom, safeAreaInsets.left);
+                if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.VANILLA_ICE_CREAM && hasViewportCover && insetHandlingEnabled) {
+                    Insets safeAreaInsets = calcSafeAreaInsets(insets);
+                    injectSafeAreaCSS(safeAreaInsets.top, safeAreaInsets.right, safeAreaInsets.bottom, safeAreaInsets.left);
+                }
 
                 return new WindowInsetsCompat.Builder(insets)
                     .setInsets(
@@ -224,8 +221,10 @@ public class SystemBars extends Plugin {
                 .setInsets(WindowInsetsCompat.Type.systemBars() | WindowInsetsCompat.Type.displayCutout(), Insets.of(0, 0, 0, 0))
                 .build();
 
-            Insets safeAreaInsets = calcSafeAreaInsets(newInsets);
-            injectSafeAreaCSS(safeAreaInsets.top, safeAreaInsets.right, safeAreaInsets.bottom, safeAreaInsets.left);
+            if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.VANILLA_ICE_CREAM && hasViewportCover && insetHandlingEnabled) {
+                Insets safeAreaInsets = calcSafeAreaInsets(newInsets);
+                injectSafeAreaCSS(safeAreaInsets.top, safeAreaInsets.right, safeAreaInsets.bottom, safeAreaInsets.left);
+            }
 
             return newInsets;
         });

package/capacitor/src/main/java/com/getcapacitor/util/JSONUtils.java

@@ -75,26 +75,6 @@ public class JSONUtils {
         return defaultValue;
     }
 
-    /**
-     * Get a double value from the given JSON object.
-     *
-     * @param jsonObject A JSON object to search
-     * @param key A key to fetch from the JSON object
-     * @param defaultValue A default value to return if the key cannot be found
-     * @return The value at the given key in the JSON object, or the default value
-     */
-    public static double getDouble(JSONObject jsonObject, String key, double defaultValue) {
-        String k = getDeepestKey(key);
-        try {
-            JSONObject o = getDeepestObject(jsonObject, key);
-            return o.getDouble(k);
-        } catch (JSONException ignore) {
-            // value was not found
-        }
-
-        return defaultValue;
-    }
-
     /**
      * Get a JSON object value from the given JSON object.
      *

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@capacitor/android",
-  "version": "8.3.5-nightly-20260529T161937.0",
+  "version": "8.3.5",
   "description": "Capacitor: Cross-platform apps with JavaScript and the web",
   "homepage": "https://capacitorjs.com",
   "author": "Ionic Team <hi@ionic.io> (https://ionic.io)",
@@ -23,7 +23,7 @@
     "verify": "./gradlew clean lint build test -b capacitor/build.gradle"
   },
   "peerDependencies": {
-    "@capacitor/core": "^8.3.0-nightly-20260529T161937.0"
+    "@capacitor/core": "^8.3.0"
   },
   "publishConfig": {
     "access": "public"