Description
The iOS implementation of cordova-plugin-inappbrowser passes the id field from a WKScriptMessage body to commandDelegate sendPluginResult:callbackId: with no format validation (CDVWKInAppBrowser.m:560–574).
Recommendation
Update the cordova-plugin-inappbrowser package to the latest compatible version. Followings are version details:
- Affected version(s): < 6.0.1
- Patched version(s): 6.0.1
References
Could your website be exposed too?
SmartScanner can check your website for Cordova Plugin InAppBrowser: iOS: Arbitrary Cordova callback IDs can be dispatched without validation from InAppBrowser and gives you actionable findings to investigate.
Start a free scanRelated Issues
- Privilege Escalation in cordova-plugin-inappbrowser - CVE-2019-0219
- Flowise: RCE via CSVAgent csvFile data URI base64 segment is interpolated into Python source without validation - CVE-2026-69264
- Backstage: Catalog unprocessed read endpoints allow authenticated cross-owner data access without permission checks - @backstage/plugin-catalog-unprocessed-entities-common - CVE-2026-44374
- @babel/plugin-transform-modules-systemjs generates arbitrary code when compiling malicious input - CVE-2026-44728
You might also like:
See something that needs correcting? Let us knowUpdated June 12, 2026