Vulnerability-Lookup

CVE-2026-47430 (GCVE-0-2026-47430)

Vulnerability from cvelistv5 – Published: 2026-06-08 10:22 – Updated: 2026-06-08 12:56

Title

Cordova Plugin InAppBrowser: iOS: Arbitrary Cordova callback IDs can be dispatched without validation from InAppBrowser WebViews

Summary

## Summary The iOS implementation of `cordova-plugin-inappbrowser` passes the `id` field from a `WKScriptMessage` body to `commandDelegate sendPluginResult:callbackId:` with no format validation (`CDVWKInAppBrowser.m:560–574`). Any web content loaded inside the InAppBrowser can fire any pending Cordova callback in the host app by posting a message whose `id` field is a guessable or enumerated callback identifier. An attack abusing this weakness must be tailored to the specific plugins and callback IDs the host app uses. Though an attacker with knowledge of common Cordova plugin configurations could craft reusable payloads targeting widely-adopted plugins. ## Impact An unauthenticated remote attacker who controls content displayed in the InAppBrowser — via a URL the app opens (OAuth redirect, marketing link, deep-link target) or a network interception — can call `window.webkit.messageHandlers.cordova_iab.postMessage({id: '<victim-callback-id>', d: '...'})` to fire callbacks belonging to any other installed Cordova plugin (Camera, Contacts, File, Geolocation). Cordova callback IDs follow the predictable format `<PluginName><sequential-integer>`, making enumeration feasible. Successful exploitation allows the attacker to spoof plugin results across trust boundaries — for example, injecting a forged camera approval, a fabricated contacts list, or a crafted file-read response. This issue affects Cordova Plugin InAppBrowser: from 3.1.0 through 6.0.0. Users are recommended to upgrade to version 6.0.1, which fixes the issue.

Severity

9.5 (Critical)


                        
                          CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator (v2.0.3)

CWE

CWE-20 - Improper Input Validation

Assigner

apache

References

2 references

URL	Tags
https://lists.apache.org/thread/sb539nss3b0545wny…	vendor-advisory
http://www.openwall.com/lists/oss-security/2026/06/07/1

Impacted products

1 product

Vendor	Product	Version
Apache Software Foundation	Cordova Plugin InAppBrowser	Affected: 3.1.0 , ≤ 6.0.0 (semver)

Credits

Niklas Merz

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2026-06-08T11:41:19.007Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "http://www.openwall.com/lists/oss-security/2026/06/07/1"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-47430",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-06-08T12:56:09.426783Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-06-08T12:56:23.693Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://www.npmjs.com/package/cordova-plugin-inappbrowser",
          "defaultStatus": "unaffected",
          "packageName": "cordova-plugin-inappbrowser",
          "product": "Cordova Plugin InAppBrowser",
          "vendor": "Apache Software Foundation",
          "versions": [
            {
              "lessThanOrEqual": "6.0.0",
              "status": "affected",
              "version": "3.1.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "Niklas Merz"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003e## Summary\u003cbr\u003e\u003cbr\u003eThe iOS implementation of `cordova-plugin-inappbrowser` passes the `id` field from a `WKScriptMessage` body to `commandDelegate sendPluginResult:callbackId:` with no format validation (`CDVWKInAppBrowser.m:560\u2013574`). Any web content loaded inside the InAppBrowser can fire any pending Cordova callback in the host app by posting a message whose `id` field is a guessable or enumerated callback identifier. An attack abusing this weakness must be tailored to the specific plugins and callback IDs the host app uses. Though an attacker with knowledge of common Cordova plugin configurations could craft reusable payloads targeting widely-adopted plugins.\u003c/p\u003e\u003cp\u003e\u003cbr\u003e## Impact\u003cbr\u003e\u003cbr\u003eAn unauthenticated remote attacker who controls content displayed in the InAppBrowser \u2014 via a URL the app opens (OAuth redirect, marketing link, deep-link target) or a network interception \u2014 can call `window.webkit.messageHandlers.cordova_iab.postMessage({id: \u0027\u0026lt;victim-callback-id\u0026gt;\u0027, d: \u0027...\u0027})` to fire callbacks belonging to any other installed Cordova plugin (Camera, Contacts, File, Geolocation). Cordova callback IDs follow the predictable format `\u0026lt;PluginName\u0026gt;\u0026lt;sequential-integer\u0026gt;`, making enumeration feasible. Successful exploitation allows the attacker to spoof plugin results across trust boundaries \u2014 for example, injecting a forged camera approval, a fabricated contacts list, or a crafted file-read response.\u003c/p\u003e\u003cp\u003eThis issue affects Cordova Plugin InAppBrowser: from 3.1.0 through 6.0.0.\u003c/p\u003e\u003cp\u003eUsers are recommended to upgrade to version 6.0.1, which fixes the issue.\u003c/p\u003e"
            }
          ],
          "value": "## Summary\n\nThe iOS implementation of `cordova-plugin-inappbrowser` passes the `id` field from a `WKScriptMessage` body to `commandDelegate sendPluginResult:callbackId:` with no format validation (`CDVWKInAppBrowser.m:560\u2013574`). Any web content loaded inside the InAppBrowser can fire any pending Cordova callback in the host app by posting a message whose `id` field is a guessable or enumerated callback identifier. An attack abusing this weakness must be tailored to the specific plugins and callback IDs the host app uses. Though an attacker with knowledge of common Cordova plugin configurations could craft reusable payloads targeting widely-adopted plugins.\n\n\n## Impact\n\nAn unauthenticated remote attacker who controls content displayed in the InAppBrowser \u2014 via a URL the app opens (OAuth redirect, marketing link, deep-link target) or a network interception \u2014 can call `window.webkit.messageHandlers.cordova_iab.postMessage({id: \u0027\u003cvictim-callback-id\u003e\u0027, d: \u0027...\u0027})` to fire callbacks belonging to any other installed Cordova plugin (Camera, Contacts, File, Geolocation). Cordova callback IDs follow the predictable format `\u003cPluginName\u003e\u003csequential-integer\u003e`, making enumeration feasible. Successful exploitation allows the attacker to spoof plugin results across trust boundaries \u2014 for example, injecting a forged camera approval, a fabricated contacts list, or a crafted file-read response.\n\nThis issue affects Cordova Plugin InAppBrowser: from 3.1.0 through 6.0.0.\n\nUsers are recommended to upgrade to version 6.0.1, which fixes the issue."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "HIGH",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 9.5,
            "baseSeverity": "CRITICAL",
            "privilegesRequired": "NONE",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "HIGH",
            "subConfidentialityImpact": "HIGH",
            "subIntegrityImpact": "HIGH",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        },
        {
          "other": {
            "content": {
              "text": "important"
            },
            "type": "Textual description of severity"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-20",
              "description": "CWE-20 Improper Input Validation",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-06-08T10:22:25.138Z",
        "orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
        "shortName": "apache"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://lists.apache.org/thread/sb539nss3b0545wnyt1pbh7zgwjvz2qq"
        }
      ],
      "source": {
        "defect": [
          "#1152"
        ],
        "discovery": "INTERNAL"
      },
      "timeline": [
        {
          "lang": "en",
          "time": "2026-06-07T11:00:00.000Z",
          "value": "Fix released"
        }
      ],
      "title": "Cordova Plugin InAppBrowser: iOS: Arbitrary Cordova callback IDs can be dispatched without validation from InAppBrowser WebViews",
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
    "assignerShortName": "apache",
    "cveId": "CVE-2026-47430",
    "datePublished": "2026-06-08T10:22:25.138Z",
    "dateReserved": "2026-05-19T19:48:39.914Z",
    "dateUpdated": "2026-06-08T12:56:23.693Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-47430",
      "date": "2026-07-26",
      "epss": "0.00723",
      "percentile": "0.5024"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-47430\",\"sourceIdentifier\":\"security@apache.org\",\"published\":\"2026-06-08T12:16:32.193\",\"lastModified\":\"2026-07-23T07:10:00.113\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"## Summary\\n\\nThe iOS implementation of `cordova-plugin-inappbrowser` passes the `id` field from a `WKScriptMessage` body to `commandDelegate sendPluginResult:callbackId:` with no format validation (`CDVWKInAppBrowser.m:560\u2013574`). Any web content loaded inside the InAppBrowser can fire any pending Cordova callback in the host app by posting a message whose `id` field is a guessable or enumerated callback identifier. An attack abusing this weakness must be tailored to the specific plugins and callback IDs the host app uses. Though an attacker with knowledge of common Cordova plugin configurations could craft reusable payloads targeting widely-adopted plugins.\\n\\n\\n## Impact\\n\\nAn unauthenticated remote attacker who controls content displayed in the InAppBrowser \u2014 via a URL the app opens (OAuth redirect, marketing link, deep-link target) or a network interception \u2014 can call `window.webkit.messageHandlers.cordova_iab.postMessage({id: \u0027\u003cvictim-callback-id\u003e\u0027, d: \u0027...\u0027})` to fire callbacks belonging to any other installed Cordova plugin (Camera, Contacts, File, Geolocation). Cordova callback IDs follow the predictable format `\u003cPluginName\u003e\u003csequential-integer\u003e`, making enumeration feasible. Successful exploitation allows the attacker to spoof plugin results across trust boundaries \u2014 for example, injecting a forged camera approval, a fabricated contacts list, or a crafted file-read response.\\n\\nThis issue affects Cordova Plugin InAppBrowser: from 3.1.0 through 6.0.0.\\n\\nUsers are recommended to upgrade to version 6.0.1, which fixes the issue.\"},{\"lang\":\"es\",\"value\":\"## Resumen\\n\\nLa implementaci\u00f3n para iOS de \u0027cordova-plugin-inappbrowser\u0027 pasa el campo \u0027id\u0027 de un cuerpo de \u0027WKScriptMessage\u0027 a \u0027commandDelegate sendPluginResult:callbackId:\u0027 sin validaci\u00f3n de formato (\u0027CDVWKInAppBrowser.m:560-574\u0027). Cualquier contenido web cargado dentro del InAppBrowser puede activar cualquier callback de Cordova pendiente en la aplicaci\u00f3n anfitriona publicando un mensaje cuyo campo \u0027id\u0027 es un identificador de callback adivinable o enumerado. Un ataque que abuse de esta debilidad debe adaptarse a los \u0027plugins\u0027 espec\u00edficos y a los IDs de callback que utiliza la aplicaci\u00f3n anfitriona. Aunque un atacante con conocimiento de configuraciones comunes de \u0027plugins\u0027 de Cordova podr\u00eda crear cargas \u00fatiles reutilizables dirigidas a \u0027plugins\u0027 ampliamente adoptados.\\n\\n## Impacto\\n\\nUn atacante remoto no autenticado que controla el contenido mostrado en el InAppBrowser - a trav\u00e9s de una URL que la aplicaci\u00f3n abre (redirecci\u00f3n OAuth, enlace de marketing, objetivo de enlace profundo) o una intercepci\u00f3n de red - puede llamar a \u0027window.webkit.messageHandlers.cordova_iab.postMessage({id:   victim-callback-id  , d:  ... })\u0027 para activar callbacks pertenecientes a cualquier otro \u0027plugin\u0027 de Cordova instalado (C\u00e1mara, Contactos, Archivo, Geolocalizaci\u00f3n). Los IDs de callback de Cordova siguen el formato predecible \u0027 PluginName  sequential-integer \u0027, lo que hace que la enumeraci\u00f3n sea factible. La explotaci\u00f3n exitosa permite al atacante suplantar resultados de \u0027plugins\u0027 a trav\u00e9s de l\u00edmites de confianza - por ejemplo, inyectando una aprobaci\u00f3n de c\u00e1mara falsificada, una lista de contactos fabricada o una respuesta de lectura de archivo manipulada.\\n\\nEste problema afecta al \u0027plugin\u0027 de Cordova InAppBrowser: desde la versi\u00f3n 3.1.0 hasta la 6.0.0.\\n\\nSe recomienda a los usuarios actualizar a la versi\u00f3n 6.0.1, que corrige el problema.\"}],\"affected\":[{\"source\":\"security@apache.org\",\"affectedData\":[{\"vendor\":\"Apache Software Foundation\",\"product\":\"Cordova Plugin InAppBrowser\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://www.npmjs.com/package/cordova-plugin-inappbrowser\",\"packageName\":\"cordova-plugin-inappbrowser\",\"versions\":[{\"version\":\"3.1.0\",\"lessThanOrEqual\":\"6.0.0\",\"versionType\":\"semver\",\"status\":\"affected\"}]}]}],\"metrics\":{\"cvssMetricV40\":[{\"source\":\"security@apache.org\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"4.0\",\"vectorString\":\"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X\",\"baseScore\":9.5,\"baseSeverity\":\"CRITICAL\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"HIGH\",\"attackRequirements\":\"NONE\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"vulnConfidentialityImpact\":\"HIGH\",\"vulnIntegrityImpact\":\"HIGH\",\"vulnAvailabilityImpact\":\"HIGH\",\"subConfidentialityImpact\":\"HIGH\",\"subIntegrityImpact\":\"HIGH\",\"subAvailabilityImpact\":\"HIGH\",\"exploitMaturity\":\"NOT_DEFINED\",\"confidentialityRequirement\":\"NOT_DEFINED\",\"integrityRequirement\":\"NOT_DEFINED\",\"availabilityRequirement\":\"NOT_DEFINED\",\"modifiedAttackVector\":\"NOT_DEFINED\",\"modifiedAttackComplexity\":\"NOT_DEFINED\",\"modifiedAttackRequirements\":\"NOT_DEFINED\",\"modifiedPrivilegesRequired\":\"NOT_DEFINED\",\"modifiedUserInteraction\":\"NOT_DEFINED\",\"modifiedVulnConfidentialityImpact\":\"NOT_DEFINED\",\"modifiedVulnIntegrityImpact\":\"NOT_DEFINED\",\"modifiedVulnAvailabilityImpact\":\"NOT_DEFINED\",\"modifiedSubConfidentialityImpact\":\"NOT_DEFINED\",\"modifiedSubIntegrityImpact\":\"NOT_DEFINED\",\"modifiedSubAvailabilityImpact\":\"NOT_DEFINED\",\"Safety\":\"NOT_DEFINED\",\"Automatable\":\"NOT_DEFINED\",\"Recovery\":\"NOT_DEFINED\",\"valueDensity\":\"NOT_DEFINED\",\"vulnerabilityResponseEffort\":\"NOT_DEFINED\",\"providerUrgency\":\"NOT_DEFINED\"}}],\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N\",\"baseScore\":7.5,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":3.9,\"impactScore\":3.6}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2026-06-08T12:56:09.426783Z\",\"id\":\"CVE-2026-47430\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"total\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"security@apache.org\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-20\"}]},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"NVD-CWE-noinfo\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:cordova_inappbrowser:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"3.1.0\",\"versionEndExcluding\":\"6.0.1\",\"matchCriteriaId\":\"04A55D64-2A2D-4C7E-8232-6283DDE62A6D\"}]}]}],\"references\":[{\"url\":\"https://lists.apache.org/thread/sb539nss3b0545wnyt1pbh7zgwjvz2qq\",\"source\":\"security@apache.org\",\"tags\":[\"Mailing List\",\"Vendor Advisory\"]},{\"url\":\"http://www.openwall.com/lists/oss-security/2026/06/07/1\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Mailing List\",\"Third Party Advisory\"]}]}}",
    "redhat_vex": {
      "current_release_date": "2026-06-09T14:59:00+00:00",
      "cve": "CVE-2026-47430",
      "id": "CVE-2026-47430",
      "initial_release_date": "2026-01-01T00:00:00+00:00",
      "product_status:known_not_affected": "1",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "Cordova Plugin InAppBrowser: iOS: Arbitrary Cordova callback IDs can be dispatched without validation from InAppBrowser WebViews",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-47430.json",
      "version": "3"
    },
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"http://www.openwall.com/lists/oss-security/2026/06/07/1\"}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2026-06-08T11:41:19.007Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2026-47430\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"total\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-06-08T12:56:09.426783Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-06-08T12:56:19.742Z\"}}], \"cna\": {\"title\": \"Cordova Plugin InAppBrowser: iOS: Arbitrary Cordova callback IDs can be dispatched without validation from InAppBrowser WebViews\", \"source\": {\"defect\": [\"#1152\"], \"discovery\": \"INTERNAL\"}, \"credits\": [{\"lang\": \"en\", \"type\": \"reporter\", \"value\": \"Niklas Merz\"}], \"metrics\": [{\"format\": \"CVSS\", \"cvssV4_0\": {\"Safety\": \"NOT_DEFINED\", \"version\": \"4.0\", \"Recovery\": \"NOT_DEFINED\", \"baseScore\": 9.5, \"Automatable\": \"NOT_DEFINED\", \"attackVector\": \"NETWORK\", \"baseSeverity\": \"CRITICAL\", \"valueDensity\": \"NOT_DEFINED\", \"vectorString\": \"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H\", \"providerUrgency\": \"NOT_DEFINED\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"HIGH\", \"attackRequirements\": \"NONE\", \"privilegesRequired\": \"NONE\", \"subIntegrityImpact\": \"HIGH\", \"vulnIntegrityImpact\": \"HIGH\", \"subAvailabilityImpact\": \"HIGH\", \"vulnAvailabilityImpact\": \"HIGH\", \"subConfidentialityImpact\": \"HIGH\", \"vulnConfidentialityImpact\": \"HIGH\", \"vulnerabilityResponseEffort\": \"NOT_DEFINED\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"GENERAL\"}]}, {\"other\": {\"type\": \"Textual description of severity\", \"content\": {\"text\": \"important\"}}}], \"affected\": [{\"vendor\": \"Apache Software Foundation\", \"product\": \"Cordova Plugin InAppBrowser\", \"versions\": [{\"status\": \"affected\", \"version\": \"3.1.0\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.0.0\"}], \"packageName\": \"cordova-plugin-inappbrowser\", \"collectionURL\": \"https://www.npmjs.com/package/cordova-plugin-inappbrowser\", \"defaultStatus\": \"unaffected\"}], \"timeline\": [{\"lang\": \"en\", \"time\": \"2026-06-07T11:00:00.000Z\", \"value\": \"Fix released\"}], \"references\": [{\"url\": \"https://lists.apache.org/thread/sb539nss3b0545wnyt1pbh7zgwjvz2qq\", \"tags\": [\"vendor-advisory\"]}], \"x_generator\": {\"engine\": \"Vulnogram 0.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"## Summary\\n\\nThe iOS implementation of `cordova-plugin-inappbrowser` passes the `id` field from a `WKScriptMessage` body to `commandDelegate sendPluginResult:callbackId:` with no format validation (`CDVWKInAppBrowser.m:560\\u2013574`). Any web content loaded inside the InAppBrowser can fire any pending Cordova callback in the host app by posting a message whose `id` field is a guessable or enumerated callback identifier. An attack abusing this weakness must be tailored to the specific plugins and callback IDs the host app uses. Though an attacker with knowledge of common Cordova plugin configurations could craft reusable payloads targeting widely-adopted plugins.\\n\\n\\n## Impact\\n\\nAn unauthenticated remote attacker who controls content displayed in the InAppBrowser \\u2014 via a URL the app opens (OAuth redirect, marketing link, deep-link target) or a network interception \\u2014 can call `window.webkit.messageHandlers.cordova_iab.postMessage({id: \u0027\u003cvictim-callback-id\u003e\u0027, d: \u0027...\u0027})` to fire callbacks belonging to any other installed Cordova plugin (Camera, Contacts, File, Geolocation). Cordova callback IDs follow the predictable format `\u003cPluginName\u003e\u003csequential-integer\u003e`, making enumeration feasible. Successful exploitation allows the attacker to spoof plugin results across trust boundaries \\u2014 for example, injecting a forged camera approval, a fabricated contacts list, or a crafted file-read response.\\n\\nThis issue affects Cordova Plugin InAppBrowser: from 3.1.0 through 6.0.0.\\n\\nUsers are recommended to upgrade to version 6.0.1, which fixes the issue.\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"\u003cp\u003e## Summary\u003cbr\u003e\u003cbr\u003eThe iOS implementation of `cordova-plugin-inappbrowser` passes the `id` field from a `WKScriptMessage` body to `commandDelegate sendPluginResult:callbackId:` with no format validation (`CDVWKInAppBrowser.m:560\\u2013574`). Any web content loaded inside the InAppBrowser can fire any pending Cordova callback in the host app by posting a message whose `id` field is a guessable or enumerated callback identifier. An attack abusing this weakness must be tailored to the specific plugins and callback IDs the host app uses. Though an attacker with knowledge of common Cordova plugin configurations could craft reusable payloads targeting widely-adopted plugins.\u003c/p\u003e\u003cp\u003e\u003cbr\u003e## Impact\u003cbr\u003e\u003cbr\u003eAn unauthenticated remote attacker who controls content displayed in the InAppBrowser \\u2014 via a URL the app opens (OAuth redirect, marketing link, deep-link target) or a network interception \\u2014 can call `window.webkit.messageHandlers.cordova_iab.postMessage({id: \u0027\u0026lt;victim-callback-id\u0026gt;\u0027, d: \u0027...\u0027})` to fire callbacks belonging to any other installed Cordova plugin (Camera, Contacts, File, Geolocation). Cordova callback IDs follow the predictable format `\u0026lt;PluginName\u0026gt;\u0026lt;sequential-integer\u0026gt;`, making enumeration feasible. Successful exploitation allows the attacker to spoof plugin results across trust boundaries \\u2014 for example, injecting a forged camera approval, a fabricated contacts list, or a crafted file-read response.\u003c/p\u003e\u003cp\u003eThis issue affects Cordova Plugin InAppBrowser: from 3.1.0 through 6.0.0.\u003c/p\u003e\u003cp\u003eUsers are recommended to upgrade to version 6.0.1, which fixes the issue.\u003c/p\u003e\", \"base64\": false}]}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-20\", \"description\": \"CWE-20 Improper Input Validation\"}]}], \"providerMetadata\": {\"orgId\": \"f0158376-9dc2-43b6-827c-5f631a4d8d09\", \"shortName\": \"apache\", \"dateUpdated\": \"2026-06-08T10:22:25.138Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2026-47430\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-06-08T12:56:23.693Z\", \"dateReserved\": \"2026-05-19T19:48:39.914Z\", \"assignerOrgId\": \"f0158376-9dc2-43b6-827c-5f631a4d8d09\", \"datePublished\": \"2026-06-08T10:22:25.138Z\", \"assignerShortName\": \"apache\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

FKIE_CVE-2026-47430

Vulnerability from fkie_nvd - Published: 2026-06-08 12:16 - Updated: 2026-07-23 07:10

Severity

7.5 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Summary

References

	URL	Tags
	security@apache.org	https://lists.apache.org/thread/sb539nss3b0545wnyt1pbh7zgwjvz2qq	Mailing List, Vendor Advisory
	af854a3a-2127-422b-91ae-364da2661108	http://www.openwall.com/lists/oss-security/2026/06/07/1	Mailing List, Third Party Advisory

Impacted products

	Vendor	Product	Version
	apache	cordova_inappbrowser	*

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "collectionURL": "https://www.npmjs.com/package/cordova-plugin-inappbrowser",
          "defaultStatus": "unaffected",
          "packageName": "cordova-plugin-inappbrowser",
          "product": "Cordova Plugin InAppBrowser",
          "vendor": "Apache Software Foundation",
          "versions": [
            {
              "lessThanOrEqual": "6.0.0",
              "status": "affected",
              "version": "3.1.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "source": "security@apache.org"
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:apache:cordova_inappbrowser:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "04A55D64-2A2D-4C7E-8232-6283DDE62A6D",
              "versionEndExcluding": "6.0.1",
              "versionStartIncluding": "3.1.0",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "## Summary\n\nThe iOS implementation of `cordova-plugin-inappbrowser` passes the `id` field from a `WKScriptMessage` body to `commandDelegate sendPluginResult:callbackId:` with no format validation (`CDVWKInAppBrowser.m:560\u2013574`). Any web content loaded inside the InAppBrowser can fire any pending Cordova callback in the host app by posting a message whose `id` field is a guessable or enumerated callback identifier. An attack abusing this weakness must be tailored to the specific plugins and callback IDs the host app uses. Though an attacker with knowledge of common Cordova plugin configurations could craft reusable payloads targeting widely-adopted plugins.\n\n\n## Impact\n\nAn unauthenticated remote attacker who controls content displayed in the InAppBrowser \u2014 via a URL the app opens (OAuth redirect, marketing link, deep-link target) or a network interception \u2014 can call `window.webkit.messageHandlers.cordova_iab.postMessage({id: \u0027\u003cvictim-callback-id\u003e\u0027, d: \u0027...\u0027})` to fire callbacks belonging to any other installed Cordova plugin (Camera, Contacts, File, Geolocation). Cordova callback IDs follow the predictable format `\u003cPluginName\u003e\u003csequential-integer\u003e`, making enumeration feasible. Successful exploitation allows the attacker to spoof plugin results across trust boundaries \u2014 for example, injecting a forged camera approval, a fabricated contacts list, or a crafted file-read response.\n\nThis issue affects Cordova Plugin InAppBrowser: from 3.1.0 through 6.0.0.\n\nUsers are recommended to upgrade to version 6.0.1, which fixes the issue."
    },
    {
      "lang": "es",
      "value": "## Resumen\n\nLa implementaci\u00f3n para iOS de \u0027cordova-plugin-inappbrowser\u0027 pasa el campo \u0027id\u0027 de un cuerpo de \u0027WKScriptMessage\u0027 a \u0027commandDelegate sendPluginResult:callbackId:\u0027 sin validaci\u00f3n de formato (\u0027CDVWKInAppBrowser.m:560-574\u0027). Cualquier contenido web cargado dentro del InAppBrowser puede activar cualquier callback de Cordova pendiente en la aplicaci\u00f3n anfitriona publicando un mensaje cuyo campo \u0027id\u0027 es un identificador de callback adivinable o enumerado. Un ataque que abuse de esta debilidad debe adaptarse a los \u0027plugins\u0027 espec\u00edficos y a los IDs de callback que utiliza la aplicaci\u00f3n anfitriona. Aunque un atacante con conocimiento de configuraciones comunes de \u0027plugins\u0027 de Cordova podr\u00eda crear cargas \u00fatiles reutilizables dirigidas a \u0027plugins\u0027 ampliamente adoptados.\n\n## Impacto\n\nUn atacante remoto no autenticado que controla el contenido mostrado en el InAppBrowser - a trav\u00e9s de una URL que la aplicaci\u00f3n abre (redirecci\u00f3n OAuth, enlace de marketing, objetivo de enlace profundo) o una intercepci\u00f3n de red - puede llamar a \u0027window.webkit.messageHandlers.cordova_iab.postMessage({id:   victim-callback-id  , d:  ... })\u0027 para activar callbacks pertenecientes a cualquier otro \u0027plugin\u0027 de Cordova instalado (C\u00e1mara, Contactos, Archivo, Geolocalizaci\u00f3n). Los IDs de callback de Cordova siguen el formato predecible \u0027 PluginName  sequential-integer \u0027, lo que hace que la enumeraci\u00f3n sea factible. La explotaci\u00f3n exitosa permite al atacante suplantar resultados de \u0027plugins\u0027 a trav\u00e9s de l\u00edmites de confianza - por ejemplo, inyectando una aprobaci\u00f3n de c\u00e1mara falsificada, una lista de contactos fabricada o una respuesta de lectura de archivo manipulada.\n\nEste problema afecta al \u0027plugin\u0027 de Cordova InAppBrowser: desde la versi\u00f3n 3.1.0 hasta la 6.0.0.\n\nSe recomienda a los usuarios actualizar a la versi\u00f3n 6.0.1, que corrige el problema."
    }
  ],
  "id": "CVE-2026-47430",
  "lastModified": "2026-07-23T07:10:00.113",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 7.5,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "NONE",
          "integrityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 3.6,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ],
    "cvssMetricV40": [
      {
        "cvssData": {
          "Automatable": "NOT_DEFINED",
          "Recovery": "NOT_DEFINED",
          "Safety": "NOT_DEFINED",
          "attackComplexity": "HIGH",
          "attackRequirements": "NONE",
          "attackVector": "NETWORK",
          "availabilityRequirement": "NOT_DEFINED",
          "baseScore": 9.5,
          "baseSeverity": "CRITICAL",
          "confidentialityRequirement": "NOT_DEFINED",
          "exploitMaturity": "NOT_DEFINED",
          "integrityRequirement": "NOT_DEFINED",
          "modifiedAttackComplexity": "NOT_DEFINED",
          "modifiedAttackRequirements": "NOT_DEFINED",
          "modifiedAttackVector": "NOT_DEFINED",
          "modifiedPrivilegesRequired": "NOT_DEFINED",
          "modifiedSubAvailabilityImpact": "NOT_DEFINED",
          "modifiedSubConfidentialityImpact": "NOT_DEFINED",
          "modifiedSubIntegrityImpact": "NOT_DEFINED",
          "modifiedUserInteraction": "NOT_DEFINED",
          "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
          "modifiedVulnConfidentialityImpact": "NOT_DEFINED",
          "modifiedVulnIntegrityImpact": "NOT_DEFINED",
          "privilegesRequired": "NONE",
          "providerUrgency": "NOT_DEFINED",
          "subAvailabilityImpact": "HIGH",
          "subConfidentialityImpact": "HIGH",
          "subIntegrityImpact": "HIGH",
          "userInteraction": "NONE",
          "valueDensity": "NOT_DEFINED",
          "vectorString": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
          "version": "4.0",
          "vulnAvailabilityImpact": "HIGH",
          "vulnConfidentialityImpact": "HIGH",
          "vulnIntegrityImpact": "HIGH",
          "vulnerabilityResponseEffort": "NOT_DEFINED"
        },
        "source": "security@apache.org",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-47430",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2026-06-08T12:56:09.426783Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2026-06-08T12:16:32.193",
  "references": [
    {
      "source": "security@apache.org",
      "tags": [
        "Mailing List",
        "Vendor Advisory"
      ],
      "url": "https://lists.apache.org/thread/sb539nss3b0545wnyt1pbh7zgwjvz2qq"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Mailing List",
        "Third Party Advisory"
      ],
      "url": "http://www.openwall.com/lists/oss-security/2026/06/07/1"
    }
  ],
  "sourceIdentifier": "security@apache.org",
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-20"
        }
      ],
      "source": "security@apache.org",
      "type": "Secondary"
    },
    {
      "description": [
        {
          "lang": "en",
          "value": "NVD-CWE-noinfo"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}

GHSA-Q42J-X8RQ-PJG6

Vulnerability from github – Published: 2026-06-08 12:30 – Updated: 2026-06-12 21:01

Summary

Cordova Plugin InAppBrowser: iOS: Arbitrary Cordova callback IDs can be dispatched without validation from InAppBrowser WebViews.

Details

Summary

The iOS implementation of cordova-plugin-inappbrowser passes the id field from a WKScriptMessage body to commandDelegate sendPluginResult:callbackId: with no format validation (CDVWKInAppBrowser.m:560–574). Any web content loaded inside the InAppBrowser can fire any pending Cordova callback in the host app by posting a message whose id field is a guessable or enumerated callback identifier. An attack abusing this weakness must be tailored to the specific plugins and callback IDs the host app uses. Though an attacker with knowledge of common Cordova plugin configurations could craft reusable payloads targeting widely-adopted plugins.

Impact

An unauthenticated remote attacker who controls content displayed in the InAppBrowser — via a URL the app opens (OAuth redirect, marketing link, deep-link target) or a network interception — can call window.webkit.messageHandlers.cordova_iab.postMessage({id: '<victim-callback-id>', d: '...'}) to fire callbacks belonging to any other installed Cordova plugin (Camera, Contacts, File, Geolocation). Cordova callback IDs follow the predictable format <PluginName><sequential-integer>, making enumeration feasible. Successful exploitation allows the attacker to spoof plugin results across trust boundaries — for example, injecting a forged camera approval, a fabricated contacts list, or a crafted file-read response.

This issue affects Cordova Plugin InAppBrowser: from 3.1.0 through 6.0.0.

Users are recommended to upgrade to version 6.0.1, which fixes the issue.

Severity

9.5 (Critical)


                  
                    CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "npm",
        "name": "cordova-plugin-inappbrowser"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.0.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-47430"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-20"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-06-12T21:01:06Z",
    "nvd_published_at": "2026-06-08T12:16:32Z",
    "severity": "CRITICAL"
  },
  "details": "## Summary\n\nThe iOS implementation of `cordova-plugin-inappbrowser` passes the `id` field from a `WKScriptMessage` body to `commandDelegate sendPluginResult:callbackId:` with no format validation (`CDVWKInAppBrowser.m:560\u2013574`). Any web content loaded inside the InAppBrowser can fire any pending Cordova callback in the host app by posting a message whose `id` field is a guessable or enumerated callback identifier. An attack abusing this weakness must be tailored to the specific plugins and callback IDs the host app uses. Though an attacker with knowledge of common Cordova plugin configurations could craft reusable payloads targeting widely-adopted plugins.\n\n\n## Impact\n\nAn unauthenticated remote attacker who controls content displayed in the InAppBrowser \u2014 via a URL the app opens (OAuth redirect, marketing link, deep-link target) or a network interception \u2014 can call `window.webkit.messageHandlers.cordova_iab.postMessage({id: \u0027\u003cvictim-callback-id\u003e\u0027, d: \u0027...\u0027})` to fire callbacks belonging to any other installed Cordova plugin (Camera, Contacts, File, Geolocation). Cordova callback IDs follow the predictable format `\u003cPluginName\u003e\u003csequential-integer\u003e`, making enumeration feasible. Successful exploitation allows the attacker to spoof plugin results across trust boundaries \u2014 for example, injecting a forged camera approval, a fabricated contacts list, or a crafted file-read response.\n\nThis issue affects Cordova Plugin InAppBrowser: from 3.1.0 through 6.0.0.\n\nUsers are recommended to upgrade to version 6.0.1, which fixes the issue.",
  "id": "GHSA-q42j-x8rq-pjg6",
  "modified": "2026-06-12T21:01:06Z",
  "published": "2026-06-08T12:30:29Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-47430"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/apache/cordova-plugin-inappbrowser"
    },
    {
      "type": "WEB",
      "url": "https://lists.apache.org/thread/sb539nss3b0545wnyt1pbh7zgwjvz2qq"
    },
    {
      "type": "WEB",
      "url": "http://www.openwall.com/lists/oss-security/2026/06/07/1"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H",
      "type": "CVSS_V4"
    }
  ],
  "summary": "Cordova Plugin InAppBrowser: iOS: Arbitrary Cordova callback IDs can be dispatched without validation from InAppBrowser WebViews."
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.

Action not permitted

CVE-2026-47430 (GCVE-0-2026-47430)

FKIE_CVE-2026-47430

GHSA-Q42J-X8RQ-PJG6

Summary

Impact

Tags

Sightings

Nomenclature