CVE-2026-47430

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-47430
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-47430.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-47430
Aliases
Published
2026-06-08T10:22:25Z
Modified
2026-08-12T03:51:24Z
Severity
  • 9.5 (Critical) CVSS_V4 - CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H CVSS Calculator
Summary
Cordova Plugin InAppBrowser: iOS: Arbitrary Cordova callback IDs can be dispatched without validation from InAppBrowser WebViews
Details

Summary

The iOS implementation of cordova-plugin-inappbrowser passes the id field from a WKScriptMessage body to commandDelegate sendPluginResult:callbackId: with no format validation (CDVWKInAppBrowser.m:560–574). Any web content loaded inside the InAppBrowser can fire any pending Cordova callback in the host app by posting a message whose id field is a guessable or enumerated callback identifier. An attack abusing this weakness must be tailored to the specific plugins and callback IDs the host app uses. Though an attacker with knowledge of common Cordova plugin configurations could craft reusable payloads targeting widely-adopted plugins.

Impact

An unauthenticated remote attacker who controls content displayed in the InAppBrowser — via a URL the app opens (OAuth redirect, marketing link, deep-link target) or a network interception — can call window.webkit.messageHandlers.cordova_iab.postMessage({id: '<victim-callback-id>', d: '...'}) to fire callbacks belonging to any other installed Cordova plugin (Camera, Contacts, File, Geolocation). Cordova callback IDs follow the predictable format <PluginName><sequential-integer>, making enumeration feasible. Successful exploitation allows the attacker to spoof plugin results across trust boundaries — for example, injecting a forged camera approval, a fabricated contacts list, or a crafted file-read response.

This issue affects Cordova Plugin InAppBrowser: from 3.1.0 through 6.0.0.

Users are recommended to upgrade to version 6.0.1, which fixes the issue.

Database specific 
{
    "cna_assigner": "apache",
    "cwe_ids": [
        "CWE-20"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/47xxx/CVE-2026-47430.json",
    "unresolved_ranges": [
        {
            "extracted_events": [
                {
                    "introduced": "3.1.0"
                },
                {
                    "last_affected": "6.0.0"
                }
            ],
            "source": "AFFECTED_FIELD"
        },
        {
            "extracted_events": [
                {
                    "introduced": "3.1.0"
                },
                {
                    "fixed": "6.0.0"
                }
            ],
            "source": "DESCRIPTION"
        }
    ]
}
References

Affected packages

Git / github.com/apache/cordova-plugin-inappbrowser

Affected ranges

Type
GIT
Repo
https://github.com/apache/cordova-plugin-inappbrowser
Events
Introduced
df623882c2404144123879b350d0f59f5694dbbe
Fixed
7df1c56c8feacac2e99eb93bc1ace016bb28e20e
Database specific
Show details 
{
    "cpe": "cpe:2.3:a:apache:cordova_inappbrowser:*:*:*:*:*:*:*:*",
    "extracted_events": [
        {
            "introduced": "3.1.0"
        },
        {
            "fixed": "6.0.1"
        }
    ],
    "source": "CPE_RANGE"
}

Affected versions

3.*
3.1.0
3.2.0
4.*
4.0.0
4.1.0
5.*
5.0.0
6.*
6.0.0
rel/3.*
rel/3.1.0
rel/3.2.0
rel/4.*
rel/4.0.0
rel/4.1.0
rel/5.*
rel/5.0.0
rel/6.*
rel/6.0.0

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-47430.json"