Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

npm package

cordova-plugin-inappbrowser

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

2 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. Critical, CVSS 9.5npmAmendedPublished

    Cordova Plugin InAppBrowser: iOS: Arbitrary Cordova callback IDs can be dispatched without validation from InAppBrowser WebViews.

    CVE-2026-47430 · GHSA-q42j-x8rq-pjg6

    Affected
    • npm cordova-plugin-inappbrowser < 6.0.1
    Fixed in
    6.0.1· Vendor fix available
    Issue
    The iOS implementation of cordova-plugin-inappbrowser passes the id field from a WKScriptMessage body to commandDelegate sendPluginResult:callbackId: with no format validation (CDVWKInAppBrowser.m:560–574). Any web content loaded inside the InAppBrowser can fire any pending Cordova callback in the host app by posting a message whose id field is a guessable or enumerated callback identifier. An attack abusing this weakness must be tailored to the specific plugins and callback IDs the host app uses. Though an attacker with knowledge of common Cordova plugin configurations could craft reusable payloads targeting widely-adopted plugins. Impact An unauthenticated remote attacker who controls content displayed in the InAppBrowser — via a URL the app opens (OAuth redirect, marketing link, deep-link target) or a network interception — can call window.webkit.messageHandlers.cordovaiab.postMessage({id: '<victim-callback-id', d: '...'}) to fire callbacks belonging to any other installed…

    Recommended action: Upgrade to 6.0.1 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:github.com (1)osv.dev (2)Source checked Evidence →
  2. Critical, CVSS 9.8npmAmendedPublished

    Privilege Escalation in cordova-plugin-inappbrowser

    CVE-2019-0219 · GHSA-c6pw-q7f2-97hv

    Affected
    • npm cordova-plugin-inappbrowser < 3.1.0
    Fixed in
    3.1.0· Vendor fix available
    Issue
    Versions of cordova-plugin-inappbrowser prior to 3.1.0 are vulnerable to Privilege Escalation. A website running in the InAppBrowser webview on Android could execute arbitrary JavaScript in the main application's webview using a specially crafted gap-iab: URI. This affects Cordova Android applications using the package. Recommendation Upgrade to version 3.1.0 or later.

    Recommended action: Upgrade to 3.1.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:osv.dev (1)github.com (2)Source checked Evidence →