Apache Cordova Inappbrowser vulnerabilities
2 known vulnerabilities affecting apache/cordova_inappbrowser.
Total CVEs
2
CISA KEV
0
Public exploits
0
Exploited in wild
0
Severity breakdown
CRITICAL1HIGH1
Vulnerabilities
Page 1 of 1
CVE-2019-0219P3CRITICALCVSS 9.8≤ 3.0.02020-01-14
CVE-2019-0219 [CRITICAL] CVE-2019-0219: A website running in the InAppBrowser webview on Android could execute arbitrary JavaScript in the m
A website running in the InAppBrowser webview on Android could execute arbitrary JavaScript in the main application's webview using a specially crafted gap-iab: URI.
nvd
CVE-2026-47430P3HIGHCVSS 7.5≥ 3.1.0, < 6.0.12026-06-08
CVE-2026-47430 [HIGH] CWE-20 CVE-2026-47430: ## Summary The iOS implementation of `cordova-plugin-inappbrowser` passes the `id` field from a `WK
## Summary
The iOS implementation of `cordova-plugin-inappbrowser` passes the `id` field from a `WKScriptMessage` body to `commandDelegate sendPluginResult:callbackId:` with no format validation (`CDVWKInAppBrowser.m:560–574`). Any web content loaded inside the InAppBrowser can fire any pending Cordova callback in the host app by posting a message whos
nvd