CVE-2026-47430
The iOS version of Cordova’s InAppBrowser plugin fails to validate the callback ID sent from web content, letting a remote attacker trigger any Cordova plugin callback. This flaw allows an attacker to spoof plugin responses such as camera approvals or contact lists. The issue affects InAppBrowser versions 3.1.0 through 6.0.0.
An official fix is available, so this entry is kept for 30 days and then removed automatically.
Who is affected
Cordova Plugin InAppBrowser on iOS, versions 3.1.0‑6.0.0, used in mobile apps built with Apache Cordova.
Real-world impact
An attacker who can control the web page displayed in the InAppBrowser can send a crafted message that triggers any installed Cordova plugin’s callback, enabling them to forge data or actions—e.g., fake camera permissions, fabricated contacts, or manipulated file reads—without the user’s knowledge.
Why this severity
The CVSS score of 9.5 reflects the high impact of spoofing plugin results across trust boundaries and the remote, unauthenticated nature of the attack. The vulnerability is highly exploitable because the attacker only needs to load a malicious URL or intercept traffic to the InAppBrowser, and the predictable callback ID format makes enumeration straightforward.
What to do about it
- 01Upgrade the cordova-plugin-inappbrowser to version 6.0.1 or later.
- 02Restart the application to ensure the new plugin version is loaded.
NVD-referenced vendor advisory
Timeline
- Jun 8, 2026 · Jun 8, 2026PublishedDisclosed and added to the National Vulnerability Database.
- Jul 23, 2026 · 12d agoAdvisory updatedThe NVD record was last revised.
- Jul 24, 2026 · 11d agoOfficial fix availableA vendor patch or mitigation now exists — see the remediation steps above.
How it’s attacked
References & advisories
- lists.apache.org/thread/sb539nss3b0545wnyt1p…mailing listvendor advisory
- openwall.com/lists/oss-security/2026/06/…mailing listthird party advisory