Is CVE-2026-42184 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-42184 being exploited in the wild.

How severe is CVE-2026-42184?

High severity, with a CVSS score of 8.8, published 27 May 2026.

Which products and versions are affected?

tauri (crates.io) SEMVER:introduced=2.0.0,fixed=2.11.1; Tauri-apps Tauri 2.0 to 2.11.0.

Is there a fix for CVE-2026-42184?

Yes. tauri (crates.io): upgrade to 2.11.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-42184 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-42184?

Check whether you run tauri (crates.io) or Tauri-apps Tauri at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-42184: Tauri origin confusion in is_local_url function on Windows and Android

CVE-2026-42184 · Severity: high · CVSS 8.8 · Published 2026-05-27

Tauri is a framework used to build desktop and mobile applications with web technologies. A security flaw on Windows and Android allows malicious websites to trick the application into thinking they are part of the app's own internal code. This allows an attacker to execute restricted commands, potentially leading to unauthorized data access or control over the application's backend functions.

Technologies: tauri (crates.io). Vendors: crates.io.

Quick answers

Is CVE-2026-42184 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-42184 being exploited in the wild.
How severe is CVE-2026-42184?: High severity, with a CVSS score of 8.8, published 27 May 2026.
Which products and versions are affected?: tauri (crates.io) SEMVER:introduced=2.0.0,fixed=2.11.1; Tauri-apps Tauri 2.0 to 2.11.0.
Is there a fix for CVE-2026-42184?: Yes. tauri (crates.io): upgrade to 2.11.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-42184 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-42184?: Check whether you run tauri (crates.io) or Tauri-apps Tauri at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

tauri (crates.io): upgrade to 2.11.1 or later
```
cargo update -p tauri
```

Technical details

An origin confusion vulnerability exists in Tauri's `is_local_url()` function on Windows and Android platforms. Due to WebView limitations, Tauri maps custom URI schemes to `http://<scheme>.localhost/`. The validation logic incorrectly uses `split_once('.')` on the domain and only checks if the first segment matches a registered protocol, failing to verify the remainder of the domain. An attacker can exploit this by hosting a malicious page on a domain like `http://app.attacker.com/`; if 'app' is a registered protocol, Tauri misclassifies the remote page as a trusted local origin. This allows the remote page to invoke IPC (Inter-Process Communication) commands that were intended to be restricted to the local frontend. The issue is patched in version 2.11.1.

Affected products

tauri-apps tauri >= 2.0.0, <= 2.11.0

Identifiers

CVE-2026-42184
GHSA-7gmj-67g7-phm9

Timeline

2026-05-06: disclosed
2026-05-06: advisory
2026-05-06: patched: Fixed in version 2.11.1

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.