Critical

Arbitrary Cordova callback dispatch in cordova-plugin-inappbrowser for iOS

IdentifiersCVE-2026-47430CWE-20· Improper Input Validation

CVE-2026-47430 affects the iOS implementation of Apache Cordova cordova-plugin-inappbrowser in versions 3.1.0 through 6.0.0. In CDVWKInAppBrowser.m (reported at lines 560-574), the plugin takes the id field from a WKScriptMessage body and passes it to commandDelegate sendPluginResult:callbackId: without validating that the callback identifier is in an expected format or belongs to the InAppBrowser context. As a result, any web content rendered inside the InAppBrowser WebView can invoke pending Cordova callbacks in the host application by posting a crafted message such as window.webkit.messageHandlers.cordova_iab.postMessage({id: '<victim-callback-id>', d: '...'}). Because Cordova callback IDs are predictable, typically following a pattern like <PluginName><sequential-integer>, an attacker can guess or enumerate valid callback IDs and dispatch forged results to other installed plugins. The flaw breaks the intended trust boundary between untrusted InAppBrowser content and the host app’s native/plugin command channel.

For your environment

Are you exposed to this one?

Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.

Start free trial

ANALYST BRIEF

Impact, mitigation & remediation

What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.

Impact

What an attacker gets, and what they’ve been doing with it.

Successful exploitation allows an unauthenticated remote attacker controlling content displayed in the InAppBrowser to spoof plugin results across trust boundaries in the host app. Depending on the app’s installed plugins and active pending callbacks, this can let the attacker inject fabricated responses for plugins such as Camera, Contacts, File, or Geolocation, including forged camera approval states, fake contact data, or crafted file-read results. The practical impact is unauthorized influence over application logic that trusts Cordova plugin callbacks, which can lead to sensitive data exposure, misuse of device capabilities, workflow manipulation, and potentially broader compromise of app behavior. The attack is plugin- and callback-dependent, so impact varies by host application design and active callback state.

Mitigation

If you can’t patch tonight, do this now.

Until patched, avoid loading untrusted or attacker-influenced content in the iOS InAppBrowser, including marketing links, deep-link targets, OAuth redirect destinations, or content that could be modified via network interception. Reduce exposure by limiting use of affected InAppBrowser flows, preferring trusted origins only, and adding application-side validation for sensitive plugin results where feasible so that unexpected or context-inappropriate callback data is not blindly trusted.

Remediation

Patch, then assume compromise.

Upgrade cordova-plugin-inappbrowser to version 6.0.1 or later. The provided content states that 6.0.1 fixes the issue by adding validation to prevent unauthorized callback execution. Affected deployments are versions 3.1.0 through 6.0.0 on iOS.

PUBLIC EXPLOITS

Exploits

No public exploits tracked yet. Mallory keeps watching.

VALID 0 / 0 TOTALView more in app

No public exploit code observed for this vulnerability.

EXPOSURE SURFACE

Affected products & vendors

Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.

VendorProductType

Apache Software FoundationCordova Inappbrowserapplication

Apache Software FoundationCordova-Plugin-Inappbrowserapplication

Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.

ACTIVITY FEED

Recent activity

6 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

6 SOURCESView more in app

security online infoNews

Jun 7, 2026

Cordova Vulnerability: InAppBrowser Callback Flaw

A vulnerability in the Apache Cordova InAppBrowser plugin for iOS that allows untrusted web content to break out of its sandbox and execute unauthorized commands in the host mobile app by abusing predictable callback identifiers and insufficient validation.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets are affected, which adversaries are exploiting it right now, which detections to deploy, and what to do tonight.

Start free trial

Exposure mapping

Query your assets running an affected version, and investigate the blast radius.

Threat actor evidence

Every observed campaign linking this CVE to a named adversary.

Associated malware

Malware families riding this exploit, with evidence and IOCs.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

Vendor-by-vendor mapping

Cross-references every affected SKU, including bundled OEM variants.

Social activity5