CVE-2019-0219: Apache Cordova Inappbrowser

Critical severity, CVSS 9.8. EPSS: 7.8% chance of exploitation in the next 30 days.

A website running in the InAppBrowser webview on Android could execute arbitrary JavaScript in the main application's webview using a specially crafted gap-iab: URI.

Affected products

• Apache Cordova Inappbrowser: up to and including 3.0.0
• Oracle Instantis Enterprisetrack: version 17.1 only; version 17.2 only; version 17.3 only
• Oracle Retail Xstore Point Of Service: version 16.0.6 only; version 17.0.4 only; version 18.0.3 only; version 19.0.2 only

Published 2020-01-14. Last modified 2026-06-17.