CVE-2026-47430
Cordova Plugin InAppBrowser: iOS: Arbitrary Cordova callback IDs can be dispatched without validation from InAppBrowser WebViews
Description
## Summary The iOS implementation of `cordova-plugin-inappbrowser` passes the `id` field from a `WKScriptMessage` body to `commandDelegate sendPluginResult:callbackId:` with no format validation (`CDVWKInAppBrowser.m:560–574`). Any web content loaded inside the InAppBrowser can fire any pending Cordova callback in the host app by posting a message whose `id` field is a guessable or enumerated callback identifier. An attack abusing this weakness must be tailored to the specific plugins and callback IDs the host app uses. Though an attacker with knowledge of common Cordova plugin configurations could craft reusable payloads targeting widely-adopted plugins. ## Impact An unauthenticated remote attacker who controls content displayed in the InAppBrowser — via a URL the app opens (OAuth redirect, marketing link, deep-link target) or a network interception — can call `window.webkit.messageHandlers.cordova_iab.postMessage({id: '<victim-callback-id>', d: '...'})` to fire callbacks belonging to any other installed Cordova plugin (Camera, Contacts, File, Geolocation). Cordova callback IDs follow the predictable format `<PluginName><sequential-integer>`, making enumeration feasible. Successful exploitation allows the attacker to spoof plugin results across trust boundaries — for example, injecting a forged camera approval, a fabricated contacts list, or a crafted file-read response. This issue affects Cordova Plugin InAppBrowser: from 3.1.0 through 6.0.0. Users are recommended to upgrade to version 6.0.1, which fixes the issue.
INFO
Published Date :
June 8, 2026, 12:16 p.m.
Last Modified :
July 23, 2026, 7:10 a.m.
Remotely Exploit :
Yes !
Source :
[email protected]
CVSS Scores
| Score | Version | Severity | Vector | Exploitability Score | Impact Score | Source |
|---|---|---|---|---|---|---|
| CVSS | 134c704f-9b21-4f2e-91b3-4a467353bcc0 | |||||
| CVSS 3.1 | HIGH | [email protected] | ||||
| CVSS 4.0 | CRITICAL | f0158376-9dc2-43b6-827c-5f631a4d8d09 | ||||
| CVSS 4.0 | CRITICAL | [email protected] |
Solution
- Upgrade cordova-plugin-inappbrowser to version 6.0.1.
Public PoC/Exploit Available at Github
CVE-2026-47430 has a 2 public
PoC/Exploit available at Github.
Go to the Public Exploits tab to see the list.
References to Advisories, Solutions, and Tools
Here, you will find a curated list of external links that provide in-depth
information, practical solutions, and valuable tools related to
CVE-2026-47430.
| URL | Resource |
|---|---|
| https://lists.apache.org/thread/sb539nss3b0545wnyt1pbh7zgwjvz2qq | Mailing List Vendor Advisory |
| http://www.openwall.com/lists/oss-security/2026/06/07/1 | Mailing List Third Party Advisory |
CWE - Common Weakness Enumeration
While CVE identifies
specific instances of vulnerabilities, CWE categorizes the common flaws or
weaknesses that can lead to vulnerabilities. CVE-2026-47430 is
associated with the following CWEs:
Common Attack Pattern Enumeration and Classification (CAPEC)
Common Attack Pattern Enumeration and Classification
(CAPEC)
stores attack patterns, which are descriptions of the common attributes and
approaches employed by adversaries to exploit the CVE-2026-47430
weaknesses.
We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).
In-app browser and WebView runtime for Cordova (Android + iOS): many native views at once, native or headless chrome, document-start injection into isolated worlds, an origin-checked bridge, downloads, permissions, cookies, and a user-installable browser-extension system. JS global: boogieBrowser.
android browser browser-extension cordova cordova-plugin custom-tabs inappbrowser ios webview wkwebview
Java Objective-C JavaScript
In-app browser and WebView runtime for Cordova (Android + iOS): many native views at once, native or headless chrome, document-start injection into isolated worlds, an origin-checked bridge, downloads, permissions, cookies, and a user-installable browser-extension system. JS global: boogieBrowser.
android browser browser-extension cordova cordova-plugin custom-tabs inappbrowser ios webview wkwebview
Java Objective-C JavaScript
Results are limited to the first 15 repositories due to potential performance issues.
The following list is the news that have been mention
CVE-2026-47430 vulnerability anywhere in the article.
The following table lists the changes that have been made to the
CVE-2026-47430 vulnerability over time.
Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.
-
CVE Translated by [email protected]
Jul. 23, 2026
Action Type Old Value New Value Added Translation Title: Cordova Plugin InAppBrowser de Apache Software Foundation, Description: ## Resumen La implementación para iOS de 'cordova-plugin-inappbrowser' pasa el campo 'id' de un cuerpo de 'WKScriptMessage' a 'commandDelegate sendPluginResult:callbackId:' sin validación de formato ('CDVWKInAppBrowser.m:560-574'). Cualquier contenido web cargado dentro del InAppBrowser puede activar cualquier callback de Cordova pendiente en la aplicación anfitriona publicando un mensaje cuyo campo 'id' es un identificador de callback adivinable o enumerado. Un ataque que abuse de esta debilidad debe adaptarse a los 'plugins' específicos y a los IDs de callback que utiliza la aplicación anfitriona. Aunque un atacante con conocimiento de configuraciones comunes de 'plugins' de Cordova podría crear cargas útiles reutilizables dirigidas a 'plugins' ampliamente adoptados. ## Impacto Un atacante remoto no autenticado que controla el contenido mostrado en el InAppBrowser - a través de una URL que la aplicación abre (redirección OAuth, enlace de marketing, objetivo de enlace profundo) o una intercepción de red - puede llamar a 'window.webkit.messageHandlers.cordova_iab.postMessage({id: victim-callback-id , d: ... })' para activar callbacks pertenecientes a cualquier otro 'plugin' de Cordova instalado (Cámara, Contactos, Archivo, Geolocalización). Los IDs de callback de Cordova siguen el formato predecible ' PluginName sequential-integer ', lo que hace que la enumeración sea factible. La explotación exitosa permite al atacante suplantar resultados de 'plugins' a través de límites de confianza - por ejemplo, inyectando una aprobación de cámara falsificada, una lista de contactos fabricada o una respuesta de lectura de archivo manipulada. Este problema afecta al 'plugin' de Cordova InAppBrowser: desde la versión 3.1.0 hasta la 6.0.0. Se recomienda a los usuarios actualizar a la versión 6.0.1, que corrige el problema. -
Initial Analysis by [email protected]
Jun. 30, 2026
Action Type Old Value New Value Added CVSS V3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N Added CWE NVD-CWE-noinfo Added CPE Configuration OR *cpe:2.3:a:apache:cordova_inappbrowser:*:*:*:*:*:*:*:* versions from (including) 3.1.0 up to (excluding) 6.0.1 Added Reference Type Apache Software Foundation: https://lists.apache.org/thread/sb539nss3b0545wnyt1pbh7zgwjvz2qq Types: Mailing List, Vendor Advisory Added Reference Type CVE: http://www.openwall.com/lists/oss-security/2026/06/07/1 Types: Mailing List, Third Party Advisory -
CVE Modified by [email protected]
Jun. 17, 2026
Action Type Old Value New Value Added Affected [{'vendor': 'Apache Software Foundation', 'product': 'Cordova Plugin InAppBrowser', 'versions': [{'status': 'affected', 'version': '3.1.0', 'versionType': 'semver', 'lessThanOrEqual': '6.0.0'}], 'packageName': 'cordova-plugin-inappbrowser', 'collectionURL': 'https://www.npmjs.com/package/cordova-plugin-inappbrowser', 'defaultStatus': 'unaffected'}] -
CVE Modified by 134c704f-9b21-4f2e-91b3-4a467353bcc0
Jun. 17, 2026
Action Type Old Value New Value Added SSVC {'id': 'CVE-2026-47430', 'role': 'CISA Coordinator', 'options': [{'exploitation': 'none'}, {'automatable': 'no'}, {'technicalImpact': 'total'}], 'version': '2.0.3', 'timestamp': '2026-06-08T12:56:09.426783Z'} -
CVE Modified by af854a3a-2127-422b-91ae-364da2661108
Jun. 08, 2026
Action Type Old Value New Value Added Reference http://www.openwall.com/lists/oss-security/2026/06/07/1 -
New CVE Received by [email protected]
Jun. 08, 2026
Action Type Old Value New Value Added Description ## Summary The iOS implementation of `cordova-plugin-inappbrowser` passes the `id` field from a `WKScriptMessage` body to `commandDelegate sendPluginResult:callbackId:` with no format validation (`CDVWKInAppBrowser.m:560–574`). Any web content loaded inside the InAppBrowser can fire any pending Cordova callback in the host app by posting a message whose `id` field is a guessable or enumerated callback identifier. An attack abusing this weakness must be tailored to the specific plugins and callback IDs the host app uses. Though an attacker with knowledge of common Cordova plugin configurations could craft reusable payloads targeting widely-adopted plugins. ## Impact An unauthenticated remote attacker who controls content displayed in the InAppBrowser — via a URL the app opens (OAuth redirect, marketing link, deep-link target) or a network interception — can call `window.webkit.messageHandlers.cordova_iab.postMessage({id: '<victim-callback-id>', d: '...'})` to fire callbacks belonging to any other installed Cordova plugin (Camera, Contacts, File, Geolocation). Cordova callback IDs follow the predictable format `<PluginName><sequential-integer>`, making enumeration feasible. Successful exploitation allows the attacker to spoof plugin results across trust boundaries — for example, injecting a forged camera approval, a fabricated contacts list, or a crafted file-read response. This issue affects Cordova Plugin InAppBrowser: from 3.1.0 through 6.0.0. Users are recommended to upgrade to version 6.0.1, which fixes the issue. Added CVSS V4.0 AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Added CWE CWE-20 Added Reference https://lists.apache.org/thread/sb539nss3b0545wnyt1pbh7zgwjvz2qq