CVE-2015-5256: Apache Cordova

Medium severity, CVSS 4.3. EPSS: 4.2% chance of exploitation in the next 30 days.

Apache Cordova-Android before 4.1.0, when an application relies on a remote server, improperly implements a JavaScript whitelist protection mechanism, which allows attackers to bypass intended access restrictions via a crafted URI.

Affected products

• Apache Cordova: up to and including 3.6.4

Published 2015-11-23. Last modified 2026-06-17.