GHSA-q42j-x8rq-pjg6

Source

https://github.com/advisories/GHSA-q42j-x8rq-pjg6

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/06/GHSA-q42j-x8rq-pjg6/GHSA-q42j-x8rq-pjg6.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-q42j-x8rq-pjg6

Aliases

CVE-2026-47430

Published

2026-06-08T12:30:29Z

Modified

2026-06-12T21:15:14.274874319Z

Severity

9.5 (Critical) CVSS_V4 - CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H CVSS Calculator

Summary

Cordova Plugin InAppBrowser: iOS: Arbitrary Cordova callback IDs can be dispatched without validation from InAppBrowser WebViews.

Details

Summary

The iOS implementation of cordova-plugin-inappbrowser passes the id field from a WKScriptMessage body to commandDelegate sendPluginResult:callbackId: with no format validation (CDVWKInAppBrowser.m:560–574). Any web content loaded inside the InAppBrowser can fire any pending Cordova callback in the host app by posting a message whose id field is a guessable or enumerated callback identifier. An attack abusing this weakness must be tailored to the specific plugins and callback IDs the host app uses. Though an attacker with knowledge of common Cordova plugin configurations could craft reusable payloads targeting widely-adopted plugins.

Impact

An unauthenticated remote attacker who controls content displayed in the InAppBrowser — via a URL the app opens (OAuth redirect, marketing link, deep-link target) or a network interception — can call window.webkit.messageHandlers.cordova_iab.postMessage({id: '<victim-callback-id>', d: '...'}) to fire callbacks belonging to any other installed Cordova plugin (Camera, Contacts, File, Geolocation). Cordova callback IDs follow the predictable format <PluginName><sequential-integer>, making enumeration feasible. Successful exploitation allows the attacker to spoof plugin results across trust boundaries — for example, injecting a forged camera approval, a fabricated contacts list, or a crafted file-read response.

This issue affects Cordova Plugin InAppBrowser: from 3.1.0 through 6.0.0.

Users are recommended to upgrade to version 6.0.1, which fixes the issue.

Database specific

{
    "github_reviewed_at": "2026-06-12T21:01:06Z",
    "severity": "CRITICAL",
    "cwe_ids": [
        "CWE-20"
    ],
    "nvd_published_at": "2026-06-08T12:16:32Z",
    "github_reviewed": true
}

References

Affected packages

npm / cordova-plugin-inappbrowser

Package

Name: cordova-plugin-inappbrowser; View open source insights on deps.dev
Purl: pkg:npm/cordova-plugin-inappbrowser

Affected ranges

Type: SEMVER
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

6.0.1

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/06/GHSA-q42j-x8rq-pjg6/GHSA-q42j-x8rq-pjg6.json"