CVE-2026-47430

## Summary The iOS implementation of `cordova-plugin-inappbrowser` passes the `id` field from a `WKScriptMessage` body to `commandDelegate sendPluginResult:callbackId:` with no format validation (`CDVWKInAppBrowser.m:560–574`). Any web content loaded inside the InAppBrowser can fire any pending Cordova callback in the host app by posting a message whose `id` field is a guessable or enumerated callback identifier. An attack abusing this weakness must be tailored to the specific plugins and callback IDs the host app uses. Though an attacker with knowledge of common Cordova plugin configurations could craft reusable payloads targeting widely-adopted plugins. ## Impact An unauthenticated remote attacker who controls content displayed in the InAppBrowser — via a URL the app opens (OAuth redirect, marketing link, deep-link target) or a network interception — can call `window.webkit.messageHandlers.cordova_iab.postMessage({id: '<victim-callback-id>', d: '...'})` to fire callbacks belonging to any other installed Cordova plugin (Camera, Contacts, File, Geolocation). Cordova callback IDs follow the predictable format `<PluginName><sequential-integer>`, making enumeration feasible. Successful exploitation allows the attacker to spoof plugin results across trust boundaries — for example, injecting a forged camera approval, a fabricated contacts list, or a crafted file-read response. This issue affects Cordova Plugin InAppBrowser: from 3.1.0 through 6.0.0. Users are recommended to upgrade to version 6.0.1, which fixes the issue.

• CWE-20

• https://lists.apache.org/thread/sb539nss3b0545wnyt1pbh7zgwjvz2qqMailing List, Vendor Advisory
• http://www.openwall.com/lists/oss-security/2026/06/07/1Mailing List, Third Party Advisory

Published

Jun 8, 2026

Last Modified

Jul 23, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-47423DOMPurify is a DOM-only cross-site scripting sanitizer for H…8.2
• CVE-2026-47425Rattler is a library that provides common functionality used…6.9
• CVE-2026-47427GitHub MCP Server is GitHub's official MCP Server. Prior to …7.5
• CVE-2026-47428Vitest is a testing framework powered by Vite. From 4.0.17 u…9.6
• CVE-2026-47429Vitest is a testing framework powered by Vite. Prior to 3.2.…5.9
• CVE-2026-4743NULL Pointer Dereference vulnerability in taurusxin ncmdump …5.2
• CVE-2026-4744Out-of-bounds Read vulnerability in rizonesoft Notepad3 (‎sc…9.3
• CVE-2026-4745Improper Control of Generation of Code ('Code Injection') vu…10
• CVE-2026-4746Out-of-bounds Write vulnerability in timeplus-io proton (bas…10
• CVE-2026-4747Each RPCSEC_GSS data packet is validated by a routine which …8.8
• CVE-2026-47470NVIDIA TensorRT-LLM for any platform contains a vulnerabilit…6.2
• CVE-2026-47471NVIDIA TensorRT-LLM for any platform contains a vulnerabilit…7.5