CVE-2026-47430

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-47430", "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "state": "PUBLISHED", "assignerShortName": "apache", "dateReserved": "2026-05-19T19:48:39.914Z", "datePublished": "2026-06-08T10:22:25.138Z", "dateUpdated": "2026-06-08T12:56:23.693Z"}, "containers": {"cna": {"affected": [{"collectionURL": "https://www.npmjs.com/package/cordova-plugin-inappbrowser", "defaultStatus": "unaffected", "packageName": "cordova-plugin-inappbrowser", "product": "Cordova Plugin InAppBrowser", "vendor": "Apache Software Foundation", "versions": [{"lessThanOrEqual": "6.0.0", "status": "affected", "version": "3.1.0", "versionType": "semver"}]}], "credits": [{"lang": "en", "type": "reporter", "value": "Niklas Merz"}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<p>## Summary<br><br>The iOS implementation of `cordova-plugin-inappbrowser` passes the `id` field from a `WKScriptMessage` body to `commandDelegate sendPluginResult:callbackId:` with no format validation (`CDVWKInAppBrowser.m:560\u2013574`). Any web content loaded inside the InAppBrowser can fire any pending Cordova callback in the host app by posting a message whose `id` field is a guessable or enumerated callback identifier. An attack abusing this weakness must be tailored to the specific plugins and callback IDs the host app uses. Though an attacker with knowledge of common Cordova plugin configurations could craft reusable payloads targeting widely-adopted plugins.</p><p><br>## Impact<br><br>An unauthenticated remote attacker who controls content displayed in the InAppBrowser \u2014 via a URL the app opens (OAuth redirect, marketing link, deep-link target) or a network interception \u2014 can call `window.webkit.messageHandlers.cordova_iab.postMessage({id: '&lt;victim-callback-id&gt;', d: '...'})` to fire callbacks belonging to any other installed Cordova plugin (Camera, Contacts, File, Geolocation). Cordova callback IDs follow the predictable format `&lt;PluginName&gt;&lt;sequential-integer&gt;`, making enumeration feasible. Successful exploitation allows the attacker to spoof plugin results across trust boundaries \u2014 for example, injecting a forged camera approval, a fabricated contacts list, or a crafted file-read response.</p><p>This issue affects Cordova Plugin InAppBrowser: from 3.1.0 through 6.0.0.</p><p>Users are recommended to upgrade to version 6.0.1, which fixes the issue.</p>"}], "value": "## Summary\n\nThe iOS implementation of `cordova-plugin-inappbrowser` passes the `id` field from a `WKScriptMessage` body to `commandDelegate sendPluginResult:callbackId:` with no format validation (`CDVWKInAppBrowser.m:560\u2013574`). Any web content loaded inside the InAppBrowser can fire any pending Cordova callback in the host app by posting a message whose `id` field is a guessable or enumerated callback identifier. An attack abusing this weakness must be tailored to the specific plugins and callback IDs the host app uses. Though an attacker with knowledge of common Cordova plugin configurations could craft reusable payloads targeting widely-adopted plugins.\n\n\n## Impact\n\nAn unauthenticated remote attacker who controls content displayed in the InAppBrowser \u2014 via a URL the app opens (OAuth redirect, marketing link, deep-link target) or a network interception \u2014 can call `window.webkit.messageHandlers.cordova_iab.postMessage({id: '<victim-callback-id>', d: '...'})` to fire callbacks belonging to any other installed Cordova plugin (Camera, Contacts, File, Geolocation). Cordova callback IDs follow the predictable format `<PluginName><sequential-integer>`, making enumeration feasible. Successful exploitation allows the attacker to spoof plugin results across trust boundaries \u2014 for example, injecting a forged camera approval, a fabricated contacts list, or a crafted file-read response.\n\nThis issue affects Cordova Plugin InAppBrowser: from 3.1.0 through 6.0.0.\n\nUsers are recommended to upgrade to version 6.0.1, which fixes the issue."}], "metrics": [{"cvssV4_0": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "HIGH", "attackRequirements": "NONE", "attackVector": "NETWORK", "baseScore": 9.5, "baseSeverity": "CRITICAL", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "HIGH", "subConfidentialityImpact": "HIGH", "subIntegrityImpact": "HIGH", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}, {"other": {"content": {"text": "important"}, "type": "Textual description of severity"}}], "problemTypes": [{"descriptions": [{"cweId": "CWE-20", "description": "CWE-20 Improper Input Validation", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "shortName": "apache", "dateUpdated": "2026-06-08T10:22:25.138Z"}, "references": [{"tags": ["vendor-advisory"], "url": "https://lists.apache.org/thread/sb539nss3b0545wnyt1pbh7zgwjvz2qq"}], "source": {"defect": ["#1152"], "discovery": "INTERNAL"}, "timeline": [{"lang": "en", "time": "2026-06-07T11:00:00.000Z", "value": "Fix released"}], "title": "Cordova Plugin InAppBrowser: iOS: Arbitrary Cordova callback IDs can be dispatched without validation from InAppBrowser WebViews", "x_generator": {"engine": "Vulnogram 0.2.0"}}, "adp": [{"title": "CVE Program Container", "references": [{"url": "http://www.openwall.com/lists/oss-security/2026/06/07/1"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2026-06-08T11:41:19.007Z"}}, {"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-06-08T12:56:09.426783Z", "id": "CVE-2026-47430", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-06-08T12:56:23.693Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "http://www.openwall.com/lists/oss-security/2026/06/07/1"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2026-06-08T11:41:19.007Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-47430", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-06-08T12:56:09.426783Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-06-08T12:56:19.742Z"}}], "cna": {"title": "Cordova Plugin InAppBrowser: iOS: Arbitrary Cordova callback IDs can be dispatched without validation from InAppBrowser WebViews", "source": {"defect": ["#1152"], "discovery": "INTERNAL"}, "credits": [{"lang": "en", "type": "reporter", "value": "Niklas Merz"}], "metrics": [{"format": "CVSS", "cvssV4_0": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 9.5, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "HIGH", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "subAvailabilityImpact": "HIGH", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}, {"other": {"type": "Textual description of severity", "content": {"text": "important"}}}], "affected": [{"vendor": "Apache Software Foundation", "product": "Cordova Plugin InAppBrowser", "versions": [{"status": "affected", "version": "3.1.0", "versionType": "semver", "lessThanOrEqual": "6.0.0"}], "packageName": "cordova-plugin-inappbrowser", "collectionURL": "https://www.npmjs.com/package/cordova-plugin-inappbrowser", "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2026-06-07T11:00:00.000Z", "value": "Fix released"}], "references": [{"url": "https://lists.apache.org/thread/sb539nss3b0545wnyt1pbh7zgwjvz2qq", "tags": ["vendor-advisory"]}], "x_generator": {"engine": "Vulnogram 0.2.0"}, "descriptions": [{"lang": "en", "value": "## Summary\n\nThe iOS implementation of `cordova-plugin-inappbrowser` passes the `id` field from a `WKScriptMessage` body to `commandDelegate sendPluginResult:callbackId:` with no format validation (`CDVWKInAppBrowser.m:560\u2013574`). Any web content loaded inside the InAppBrowser can fire any pending Cordova callback in the host app by posting a message whose `id` field is a guessable or enumerated callback identifier. An attack abusing this weakness must be tailored to the specific plugins and callback IDs the host app uses. Though an attacker with knowledge of common Cordova plugin configurations could craft reusable payloads targeting widely-adopted plugins.\n\n\n## Impact\n\nAn unauthenticated remote attacker who controls content displayed in the InAppBrowser \u2014 via a URL the app opens (OAuth redirect, marketing link, deep-link target) or a network interception \u2014 can call `window.webkit.messageHandlers.cordova_iab.postMessage({id: '<victim-callback-id>', d: '...'})` to fire callbacks belonging to any other installed Cordova plugin (Camera, Contacts, File, Geolocation). Cordova callback IDs follow the predictable format `<PluginName><sequential-integer>`, making enumeration feasible. Successful exploitation allows the attacker to spoof plugin results across trust boundaries \u2014 for example, injecting a forged camera approval, a fabricated contacts list, or a crafted file-read response.\n\nThis issue affects Cordova Plugin InAppBrowser: from 3.1.0 through 6.0.0.\n\nUsers are recommended to upgrade to version 6.0.1, which fixes the issue.", "supportingMedia": [{"type": "text/html", "value": "<p>## Summary<br><br>The iOS implementation of `cordova-plugin-inappbrowser` passes the `id` field from a `WKScriptMessage` body to `commandDelegate sendPluginResult:callbackId:` with no format validation (`CDVWKInAppBrowser.m:560\u2013574`). Any web content loaded inside the InAppBrowser can fire any pending Cordova callback in the host app by posting a message whose `id` field is a guessable or enumerated callback identifier. An attack abusing this weakness must be tailored to the specific plugins and callback IDs the host app uses. Though an attacker with knowledge of common Cordova plugin configurations could craft reusable payloads targeting widely-adopted plugins.</p><p><br>## Impact<br><br>An unauthenticated remote attacker who controls content displayed in the InAppBrowser \u2014 via a URL the app opens (OAuth redirect, marketing link, deep-link target) or a network interception \u2014 can call `window.webkit.messageHandlers.cordova_iab.postMessage({id: '&lt;victim-callback-id&gt;', d: '...'})` to fire callbacks belonging to any other installed Cordova plugin (Camera, Contacts, File, Geolocation). Cordova callback IDs follow the predictable format `&lt;PluginName&gt;&lt;sequential-integer&gt;`, making enumeration feasible. Successful exploitation allows the attacker to spoof plugin results across trust boundaries \u2014 for example, injecting a forged camera approval, a fabricated contacts list, or a crafted file-read response.</p><p>This issue affects Cordova Plugin InAppBrowser: from 3.1.0 through 6.0.0.</p><p>Users are recommended to upgrade to version 6.0.1, which fixes the issue.</p>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-20", "description": "CWE-20 Improper Input Validation"}]}], "providerMetadata": {"orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "shortName": "apache", "dateUpdated": "2026-06-08T10:22:25.138Z"}}}, "cveMetadata": {"cveId": "CVE-2026-47430", "state": "PUBLISHED", "dateUpdated": "2026-06-08T12:56:23.693Z", "dateReserved": "2026-05-19T19:48:39.914Z", "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "datePublished": "2026-06-08T10:22:25.138Z", "assignerShortName": "apache"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"collectionURL": "https://www.npmjs.com/package/cordova-plugin-inappbrowser", "defaultStatus": "unaffected", "packageName": "cordova-plugin-inappbrowser", "product": "Cordova Plugin InAppBrowser", "vendor": "Apache Software Foundation", "versions": [{"lessThanOrEqual": "6.0.0", "status": "affected", "version": "3.1.0", "versionType": "semver"}]}], "source": "security@apache.org"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:apache:cordova_inappbrowser:*:*:*:*:*:*:*:*", "matchCriteriaId": "04A55D64-2A2D-4C7E-8232-6283DDE62A6D", "versionEndExcluding": "6.0.1", "versionStartIncluding": "3.1.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "## Summary\n\nThe iOS implementation of `cordova-plugin-inappbrowser` passes the `id` field from a `WKScriptMessage` body to `commandDelegate sendPluginResult:callbackId:` with no format validation (`CDVWKInAppBrowser.m:560\u2013574`). Any web content loaded inside the InAppBrowser can fire any pending Cordova callback in the host app by posting a message whose `id` field is a guessable or enumerated callback identifier. An attack abusing this weakness must be tailored to the specific plugins and callback IDs the host app uses. Though an attacker with knowledge of common Cordova plugin configurations could craft reusable payloads targeting widely-adopted plugins.\n\n\n## Impact\n\nAn unauthenticated remote attacker who controls content displayed in the InAppBrowser \u2014 via a URL the app opens (OAuth redirect, marketing link, deep-link target) or a network interception \u2014 can call `window.webkit.messageHandlers.cordova_iab.postMessage({id: '<victim-callback-id>', d: '...'})` to fire callbacks belonging to any other installed Cordova plugin (Camera, Contacts, File, Geolocation). Cordova callback IDs follow the predictable format `<PluginName><sequential-integer>`, making enumeration feasible. Successful exploitation allows the attacker to spoof plugin results across trust boundaries \u2014 for example, injecting a forged camera approval, a fabricated contacts list, or a crafted file-read response.\n\nThis issue affects Cordova Plugin InAppBrowser: from 3.1.0 through 6.0.0.\n\nUsers are recommended to upgrade to version 6.0.1, which fixes the issue."}, {"lang": "es", "value": "## Resumen\n\nLa implementaci\u00f3n para iOS de 'cordova-plugin-inappbrowser' pasa el campo 'id' de un cuerpo de 'WKScriptMessage' a 'commandDelegate sendPluginResult:callbackId:' sin validaci\u00f3n de formato ('CDVWKInAppBrowser.m:560-574'). Cualquier contenido web cargado dentro del InAppBrowser puede activar cualquier callback de Cordova pendiente en la aplicaci\u00f3n anfitriona publicando un mensaje cuyo campo 'id' es un identificador de callback adivinable o enumerado. Un ataque que abuse de esta debilidad debe adaptarse a los 'plugins' espec\u00edficos y a los IDs de callback que utiliza la aplicaci\u00f3n anfitriona. Aunque un atacante con conocimiento de configuraciones comunes de 'plugins' de Cordova podr\u00eda crear cargas \u00fatiles reutilizables dirigidas a 'plugins' ampliamente adoptados.\n\n## Impacto\n\nUn atacante remoto no autenticado que controla el contenido mostrado en el InAppBrowser - a trav\u00e9s de una URL que la aplicaci\u00f3n abre (redirecci\u00f3n OAuth, enlace de marketing, objetivo de enlace profundo) o una intercepci\u00f3n de red - puede llamar a 'window.webkit.messageHandlers.cordova_iab.postMessage({id: victim-callback-id , d: ... })' para activar callbacks pertenecientes a cualquier otro 'plugin' de Cordova instalado (C\u00e1mara, Contactos, Archivo, Geolocalizaci\u00f3n). Los IDs de callback de Cordova siguen el formato predecible ' PluginName sequential-integer ', lo que hace que la enumeraci\u00f3n sea factible. La explotaci\u00f3n exitosa permite al atacante suplantar resultados de 'plugins' a trav\u00e9s de l\u00edmites de confianza - por ejemplo, inyectando una aprobaci\u00f3n de c\u00e1mara falsificada, una lista de contactos fabricada o una respuesta de lectura de archivo manipulada.\n\nEste problema afecta al 'plugin' de Cordova InAppBrowser: desde la versi\u00f3n 3.1.0 hasta la 6.0.0.\n\nSe recomienda a los usuarios actualizar a la versi\u00f3n 6.0.1, que corrige el problema."}], "id": "CVE-2026-47430", "lastModified": "2026-07-23T07:10:00.113", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "HIGH", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 9.5, "baseSeverity": "CRITICAL", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "HIGH", "subConfidentialityImpact": "HIGH", "subIntegrityImpact": "HIGH", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "security@apache.org", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-47430", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-06-08T12:56:09.426783Z", "version": "2.0.3"}}]}, "published": "2026-06-08T12:16:32.193", "references": [{"source": "security@apache.org", "tags": ["Mailing List", "Vendor Advisory"], "url": "https://lists.apache.org/thread/sb539nss3b0545wnyt1pbh7zgwjvz2qq"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Mailing List", "Third Party Advisory"], "url": "http://www.openwall.com/lists/oss-security/2026/06/07/1"}], "sourceIdentifier": "security@apache.org", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-20"}], "source": "security@apache.org", "type": "Secondary"}, {"description": [{"lang": "en", "value": "NVD-CWE-noinfo"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[3.1.0,6.0.0]"}}], "enrichment": {"confidence": 89.0, "confidence_source": "matching", "scores": [{"score": 95.0, "source": "inferred"}, {"score": 89.0, "source": "matching"}]}, "original": {"product": "Cordova Plugin InAppBrowser", "source": "cna", "vendor": "Apache Software Foundation"}, "product": "cordova_in-app-browser", "vendor": "apache"}], "created": "2026-06-08T13:00:15.795299+00:00", "updated": "2026-08-13T23:00:06.985510+00:00", "vendors": ["apache", "apache$PRODUCT$cordova_in-app-browser"]}