Update dependency cordova-plugin-inappbrowser to v6 [SECURITY]

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
cordova-plugin-inappbrowser	^3.0.0 → ^6.0.0

---

Cordova Plugin InAppBrowser: iOS: Arbitrary Cordova callback IDs can be dispatched without validation from InAppBrowser WebViews.

CVE-2026-47430 / GHSA-q42j-x8rq-pjg6

More information

Details

Summary

The iOS implementation of cordova-plugin-inappbrowser passes the id field from a WKScriptMessage body to commandDelegate sendPluginResult:callbackId: with no format validation (CDVWKInAppBrowser.m:560–574). Any web content loaded inside the InAppBrowser can fire any pending Cordova callback in the host app by posting a message whose id field is a guessable or enumerated callback identifier. An attack abusing this weakness must be tailored to the specific plugins and callback IDs the host app uses. Though an attacker with knowledge of common Cordova plugin configurations could craft reusable payloads targeting widely-adopted plugins.

Impact

An unauthenticated remote attacker who controls content displayed in the InAppBrowser — via a URL the app opens (OAuth redirect, marketing link, deep-link target) or a network interception — can call window.webkit.messageHandlers.cordova_iab.postMessage({id: '<victim-callback-id>', d: '...'}) to fire callbacks belonging to any other installed Cordova plugin (Camera, Contacts, File, Geolocation). Cordova callback IDs follow the predictable format <PluginName><sequential-integer>, making enumeration feasible. Successful exploitation allows the attacker to spoof plugin results across trust boundaries — for example, injecting a forged camera approval, a fabricated contacts list, or a crafted file-read response.

This issue affects Cordova Plugin InAppBrowser: from 3.1.0 through 6.0.0.

Users are recommended to upgrade to version 6.0.1, which fixes the issue.

Severity

• CVSS Score: 9.5 / 10 (Critical)
• Vector String: CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

References

• https://nvd.nist.gov/vuln/detail/CVE-2026-47430
• https://lists.apache.org/thread/sb539nss3b0545wnyt1pbh7zgwjvz2qq
• http://www.openwall.com/lists/oss-security/2026/06/07/1
• https://github.com/advisories/GHSA-q42j-x8rq-pjg6

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Release Notes

apache/cordova-plugin-inappbrowser (cordova-plugin-inappbrowser)

v6.0.1

• GH-1152 fix(ios): check callbackId with regex
• GH-1095 chore: gh-action workflow, license header formatting & cleanups
• Fix npm audit issues

v6.0.0

Compare Source

• GH-1033 chore: bump to next major release 6.0.0 & update deependencies
• GH-1032 chore(lint): update eslint config and apply fixes
• GH-1030 fix!: remove deprecated platforms Windows & osx
• GH-1031 fix(ios): Remove deprecation warnings and old code
• GH-927 fix: explicitly import dependencies, instead of relying on PCH files. This is important in Swift projects, where you cannot use prefix headers.
• GH-968 GH-706 Android: Allow permissions requests
• GH-1029 chore: update asf config
• GH-1019 feat(android): Download event
• GH-1020 ci(gh-action): Paramedic CI sync
• GH-1015 feat(ios): Make WebView inspectable
• GH-1016 chore: use https urls in tests and README
• GH-1017 chore: Update SUPPORT_QUESTION.md template
• GH-977 fix(docs): missing xml indicator in code block
• GH-971 ci: sync workflow with paramedic
• GH-964 dep(npm): bump package-lock v2 w/ rebuild
• GH-957 ci(android): update java requirement for cordova-android@​11
• GH-946 fix(android): increase toolbar to 48dp
• GH-912 ci(ios): update workflow w/ iOS 15
• GH-907 ci: add action-badge
• GH-906 ci: remove travis & appveyor
• GH-903 ci: add gh-actions workflows
• GH-861 fix(android): add space between default useragent and custom AppendUserAgent
• GH-881 fix(ios): make system open tel, sms, mailto and geo links

v5.0.0

Compare Source

• GH-828 feat(ios): add InAppBrowserStatusBarStyle 'darkcontent' configuration option
• GH-823 chore: bump engines requirements
• GH-824 breaking: cleanup code for old Android versions
• GH-825 (ios): rename CDVWKProcessPoolFactory
• GH-826 ci: add node-14.x to workflow
• GH-821 breaking(android): replace magic numbers with Android.os.Build constants
• GH-717 ci(ios): remove wkwebview plugin

v4.1.0

Compare Source

• GH-792 fix(android): Add mitigation strategy for CVE-2020-6506
• GH-817 Updated typings
• GH-803 fix(android): allow compilation in old cordova-android versions
• GH-688 (ios): allow to set "preferredContentMode"
• GH-768 ci(travis): update osx xcode image
• add documentation for InAppBrowserStatusBarStyle preference
• undo whitespace changes due to editor preferrences
• GH-728 iOS: added InAppBrowserStatusBarStyle preference
• GH-767 ci(travis): updates Android API level
• (ios): Fix incorrect view height from the second open time
• GH-748 chore: adds package-lock file
• GH-746 chore(npm): use short notation in package.json
• GH-747 refactor(eslint): use cordova-eslint /w fix
• GH-737 fix(ios): exit event not fired on swipe down

v4.0.0

Compare Source

• GH-715 (ios): fix regression in 2706f34
• GH-685 chore: update install engines
• GH-656 (ios) Remove fake status bar with hardcoded height to fix issues in iOS devices with a notch
• GH-693 fix(ios): Allow loading local html files
• GH-293 Android: SSL errors handling in Android
• GH-672 fix(ios): prevent statusbar rotation after closing InAppBrowser
• chore(asf): update git notification settings
• GH-669 Allow App using InAppBrowser to be hosted in a cross-origin iframe
• GH-600 (all platforms): remove "window.open" overwrite
• GH-670 chore: bump version to 4.0.0-dev
• Update CONTRIBUTING.md
• GH-662 docs: replaces outdated transition and presentation style links
• GH-666 chore: remove deprecated orientation methods
• GH-515 Fix incorrect TypeScript typings
• GH-654 add check for openInSystem postNotification
• GH-659 ci: updates Node.js versions
• GH-658 chore(npm): improve ignore list
• GH-442 fix(android): Reset lefttoright if not set
• GH-648 (android) Correcting the documentation regarding lefttoright opt…
• GH-634 (android) Added option to turn on/off fullscreen mode in Android
• GH-616 (android) InAppBrowser: java.lang.IllegalArgumentException
• GH-635 breaking(ios): remove UIWebView

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[renovate]

Renovate Ignore Notification

Because you closed this PR without merging, Renovate will ignore this update. You will not get PRs for any future 6.x releases. But if you manually upgrade to 6.x then Renovate will re-enable minor and patch updates automatically.

If you accidentally closed this PR, or if you changed your mind: rename this PR to get a fresh replacement PR.