# CVE-2026-42184: Tauri origin confusion in is_local_url function on Windows and Android

Source: https://junglewise.ai/threats/cve-2026-42184-tauri-origin-confusion-in-is-local-url-function-on-windows-and  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-27. Updated: 2026-06-09  
License: CC BY 4.0 with a link back

CVE-2026-42184 · Severity: high · CVSS 8.8 · Published 2026-05-27

Tauri is a framework used to build desktop and mobile applications with web technologies. A security flaw on Windows and Android allows malicious websites to trick the application into thinking they are part of the app's own internal code. This allows an attacker to execute restricted commands, potentially leading to unauthorized data access or control over the application's backend functions.

Technologies: [tauri (crates.io)](https://junglewise.ai/threats/technologies/crates-io-tauri). Vendors: [crates.io](https://junglewise.ai/threats/vendors/crates-io).

## Quick answers

**Is CVE-2026-42184 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-42184 being exploited in the wild.

**How severe is CVE-2026-42184?** High severity, with a CVSS score of 8.8, published 27 May 2026.

**Which products and versions are affected?** tauri (crates.io) SEMVER:introduced=2.0.0,fixed=2.11.1; Tauri-apps Tauri 2.0 to 2.11.0.

**Is there a fix for CVE-2026-42184?** Yes. tauri (crates.io): upgrade to 2.11.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-42184 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-42184?** Check whether you run tauri (crates.io) or Tauri-apps Tauri at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- tauri (crates.io): upgrade to 2.11.1 or later

  ```sh
  cargo update -p tauri
  ```


## Technical details

An origin confusion vulnerability exists in Tauri's `is_local_url()` function on Windows and Android platforms. Due to WebView limitations, Tauri maps custom URI schemes to `http://<scheme>.localhost/`. The validation logic incorrectly uses `split_once('.')` on the domain and only checks if the first segment matches a registered protocol, failing to verify the remainder of the domain. An attacker can exploit this by hosting a malicious page on a domain like `http://app.attacker.com/`; if 'app' is a registered protocol, Tauri misclassifies the remote page as a trusted local origin. This allows the remote page to invoke IPC (Inter-Process Communication) commands that were intended to be restricted to the local frontend. The issue is patched in version 2.11.1.

## Affected products

- tauri-apps tauri >= 2.0.0, <= 2.11.0

## Identifiers

- CVE-2026-42184
- GHSA-7gmj-67g7-phm9

## Timeline

- 2026-05-06: disclosed
- 2026-05-06: advisory
- 2026-05-06: patched: Fixed in version 2.11.1

## References

- [https://api.github.com/users/grumpinout1](https://api.github.com/users/grumpinout1)
- [https://github.com/grumpinout1](https://github.com/grumpinout1)
- [https://api.github.com/users/grumpinout1/gists%7B/gist_id%7D](https://api.github.com/users/grumpinout1/gists%7B/gist_id%7D)
- [https://api.github.com/users/grumpinout1/repos](https://api.github.com/users/grumpinout1/repos)
- [https://avatars.githubusercontent.com/u/121962778?v=4](https://avatars.githubusercontent.com/u/121962778?v=4)
- [https://api.github.com/users/grumpinout1/events%7B/privacy%7D](https://api.github.com/users/grumpinout1/events%7B/privacy%7D)

## Related threats

- [iFrames Bypass Origin Checks for Tauri API Access Control](https://junglewise.ai/threats/cve-2024-35222-iframes-bypass-origin-checks-for-tauri-api-access-control)
- [Tauri vulnerable to Regression on Filesystem Scope Checks for Dotfiles](https://junglewise.ai/threats/cve-2023-34460-tauri-vulnerable-to-regression-on-filesystem-scope-checks-for)
- [Tauri Open Redirect Vulnerability Possibly Exposes IPC to External Sites](https://junglewise.ai/threats/cve-2023-31134-tauri-open-redirect-vulnerability-possibly-exposes-ipc-to)
- [Tauri Filesystem Scope Glob Pattern is too Permissive](https://junglewise.ai/threats/cve-2022-46171-tauri-filesystem-scope-glob-pattern-is-too-permissive)
- [RUSTSEC-2022-0091 - `tauri` filesystem scope partial bypass](https://junglewise.ai/threats/cve-2022-41874-tauri-filesystem-scope-can-be-partially-bypassed)