Loading story…
Apache disclosed CVE-2026-47430, an important-severity vulnerability in the iOS implementation of cordova-plugin-inappbrowser that allows web content loaded inside an InAppBrowser WebView to dispatch arbitrary Cordova callback IDs without validation. The flaw stems from a crafted id field in a WKScriptMessage being passed into Cordova’s command handling, enabling untrusted content to trigger pending callbacks that should belong to other parts of the host app.
Because Cordova callback IDs are predictable, a remote attacker controlling displayed content or intercepting traffic could enumerate identifiers and spoof results for other installed plugins, including Camera, Contacts, File, and Geolocation. Reported by Niklas Merz and tracked as issue #1152, the bug affects cordova-plugin-inappbrowser versions 3.1.0 through 6.0.0 on iOS; Apache fixed it in 6.0.1, and exploitation scenarios may include malicious webpages, OAuth redirect flows, or deep links viewed inside affected apps.
See affected versions and whether adversaries are exploiting it.
2 events from the most recent confirmed update back to the earliest known activity.
The vulnerability was fixed in cordova-plugin-inappbrowser version 6.0.1 by adding validation to prevent unauthorized callback execution. Users of affected iOS versions 3.1.0 through 6.0.0 were advised to upgrade.
Apache disclosed CVE-2026-47430, an important-severity flaw in the iOS implementation of cordova-plugin-inappbrowser that allows arbitrary Cordova callback IDs to be dispatched without validation from InAppBrowser WebViews. The issue affects versions 3.1.0 through 6.0.0 and was reported by Niklas Merz.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
3 references tracked. Mallory keeps watching after this page renders.
cvefeed.io
Open sourcesecurityonline.info
Open sourceseclists.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Apple patched **CVE-2016-4585**, a WebKit page-loading vulnerability in Safari that allowed remote attackers to inject arbitrary script or HTML through specially crafted HTTP redirections. The flaw affected **Safari before 9.1.2**, **iOS before 9.3.3**, and **tvOS before 9.2.2**, and stemmed from improper handling of redirect targets with malformed, non-numeric ports. Researchers showed Safari could send invalid `Host` headers after following such redirects, creating exploitable conditions in web applications that reflected the header into pages, scripts, links, forms, anchors, or subsequent `Location` values. The research also described an **origin confusion** condition in which pages reached through the malformed redirect could execute in a broken security context. When combined with an `iframe`, relative resources from a target page could be resolved against an attacker-controlled site, enabling cross-site scripting, spoofing, information theft, and possible content exfiltration or alteration under specific application conditions. Apple addressed the issue by tightening redirect URL validation so invalid redirection URLs trigger an error instead of being processed.
Aug 15, 2026
A chain of flaws in Apple’s iTunes Store and `StoreKitUIService` components allowed attacker-controlled content to execute inside a privileged iOS WebView and escalate to arbitrary code execution. A crafted `itms://` or `itms-ui` URL could bypass hostname trust checks and load malicious secondary content, including `data:` URIs, producing client-side XSS in a trusted Apple app context; that issue was tracked as **CVE-2021-1748**. In the same environment, an overly permissive Objective-C `WebScripting` bridge exposed native methods to JavaScript, enabling disclosure of device and account data, local file access within the app container, app enumeration and launching, heap pointer leaks, and direct object deallocation from script.
Aug 1, 2026
Apple and Red Hat disclosed **CVE-2026-43725**, an improper input validation flaw in WebKit and WebKitGTK that allows a malicious website to cause restricted web content to be processed outside the browser sandbox. Red Hat rates the issue **Important** with a **CVSS v3.1 score of 7.1** and maps it to `CWE-20`, warning that successful exploitation could affect confidentiality, integrity, and availability by exposing restricted resources. The vulnerability was addressed through improved input validation and fixed across Apple platforms including Safari, iOS, iPadOS, macOS Tahoe, tvOS, visionOS, and watchOS, while Red Hat published remediation through multiple advisories for supported **RHEL 7, 8, and 9** offerings. Red Hat's Bugzilla tracking links the issue to **WebKit bug 312832** and **WebKitGTK advisory `WSA-2026-0004`**, and notes that **RHEL 6** packages are outside support scope and should be assumed affected.
Aug 24, 2026