Skip to content
OpenAdvisories

Package · npm

cordova-plugin-inappbrowser

2 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

2 results · Feed

  • Critical 9.5
    CVE-2026-47430

    Cordova Plugin InAppBrowser: iOS: Arbitrary Cordova callback IDs can be dispatched without validation from InAppBrowser WebViews

    ## Summary The iOS implementation of `cordova-plugin-inappbrowser` passes the `id` field from a `WKScriptMessage` body to `commandDelegate sendPluginResult:callbackId:` with no format validation (`CDVWKInAppBrowser.m:560–574`). Any web content loaded inside t…

    Apache Software Foundation Cordova Plugin InAppBrowser cordova-plugin-inappbrowser npm
  • Critical 9.8
    CVE-2019-0219

    Privilege Escalation in cordova-plugin-inappbrowser

    A website running in the InAppBrowser webview on Android could execute arbitrary JavaScript in the main application's webview using a specially crafted gap-iab: URI.

    Apache Cordova cordova-plugin-inappbrowser npm