Skip to content
OpenAdvisories

Product · Apache Software Foundation

Cordova Plugin InAppBrowser

1 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

1 result · Clear filters · Feed

  • Critical 9.5
    CVE-2026-47430

    Cordova Plugin InAppBrowser: iOS: Arbitrary Cordova callback IDs can be dispatched without validation from InAppBrowser WebViews

    ## Summary The iOS implementation of `cordova-plugin-inappbrowser` passes the `id` field from a `WKScriptMessage` body to `commandDelegate sendPluginResult:callbackId:` with no format validation (`CDVWKInAppBrowser.m:560–574`). Any web content loaded inside t…

    Apache Software Foundation Cordova Plugin InAppBrowser cordova-plugin-inappbrowser npm