Apache Cordova Inappbrowser vulnerabilities

2 CVEs affecting Apache Cordova Inappbrowser, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-47430, published 2026-06-08.

More from Apache.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2019-0219, published 2020-01-14. Critical severity, CVSS 9.8. EPSS: 7.8% chance of exploitation in the next 30 days. A website running in the InAppBrowser webview on Android could execute arbitrary JavaScript in the main application's webview using a specially crafted gap-iab: URI.
• CVE-2026-47430, published 2026-06-08. High severity, CVSS 7.5. EPSS: 0.8% chance of exploitation in the next 30 days. ## Summary The iOS implementation of `cordova-plugin-inappbrowser` passes the `id` field from a `WKScriptMessage` body to `commandDelegate sendPluginResult:callbackId:` with no format validation…