CVE-2026-47430: Cordova Plugin InAppBrowser: iOS: Arbitrary Cordova callback IDs can be dispatched without validation from InAppBrowser WebViews

Synopsis

This is an insufficient input validation vulnerability in the iOS implementation of Apache Cordova Plugin InAppBrowser (versions 3.1.0 through 6.0.0). A remote attacker who controls content loaded inside an InAppBrowser WebView can reach the host app over the network with no authentication required, because the plugin passes the message 'id' field directly to the Cordova callback dispatcher without any format check. Successful exploitation lets the attacker fire arbitrary Cordova plugin callbacks in the host app, spoofing results from plugins such as Camera, Contacts, File, and Geolocation across trust boundaries. No fix version has been published yet; HarborGuard is tracking the advisory and will make a patched-image rebuild available as soon as an upstream fix is released.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must be able to reach the device over the network, either by controlling a URL the app opens (such as an OAuth redirect or deep-link target) or by intercepting network traffic to inject malicious content into the InAppBrowser WebView.

• AuthenticationNot required

  No credentials or account are needed; any web content rendered inside the InAppBrowser can post the malicious message without authenticating to the host app.

• Victim interactionNot required

  No user action beyond the app's normal operation of opening a URL in the InAppBrowser is needed; the attacker's payload executes as part of page load or script execution inside the WebView.

• Attack complexityDetail

  Attack complexity is high because the attacker must know or enumerate valid Cordova callback IDs and tailor the payload to the specific plugins and timing of pending callbacks in the host app, though the predictable callback ID format (PluginName plus a sequential integer) makes enumeration feasible.

Blast Radius

• The attacker can inject forged plugin results, such as a fabricated camera approval or a spoofed contacts list, into the host app's Cordova plugin dispatch pipeline.
• The attacker can feed crafted file-read or geolocation responses to any plugin awaiting a pending callback, causing the app to act on attacker-controlled data.
• Confidentiality is fully compromised at both the app and system scope: the attacker can extract data returned by camera, contacts, file, and geolocation plugins.
• Integrity of app state is fully compromised at both the app and system scope: the attacker can manipulate any decision or data flow that depends on plugin callback results.