This is an automated email from the ASF dual-hosted git repository. NiklasMerz pushed a commit to branch iab-6.0.1 in repository https://gitbox.apache.org/repos/asf/cordova-docs.git
commit cabfdf3660f080b430220dfc21b336cf03e03a46 Author: Niklas Merz <[email protected]> AuthorDate: Sun Jun 7 11:32:37 2026 +0200 chore(blog): announce iab 6.0.1 --- www/_posts/2026-05-31-cordova-ios-8.1.0.md | 1 + .../2026-06-07-inappbrowser-release-6.0.1.md | 51 ++++++++++++++++++++++ 2 files changed, 52 insertions(+) diff --git a/www/_posts/2026-05-31-cordova-ios-8.1.0.md b/www/_posts/2026-05-31-cordova-ios-8.1.0.md index ad0b22942e..e89c4292f4 100644 --- a/www/_posts/2026-05-31-cordova-ios-8.1.0.md +++ b/www/_posts/2026-05-31-cordova-ios-8.1.0.md @@ -2,6 +2,7 @@ layout: post author: name: Niklas Merz + url: https://w3c.social/@niklasmerz title: "Cordova iOS 8.1.0 is now available!" categories: announcements tags: news releases diff --git a/www/_posts/2026-06-07-inappbrowser-release-6.0.1.md b/www/_posts/2026-06-07-inappbrowser-release-6.0.1.md new file mode 100644 index 0000000000..410d8b9878 --- /dev/null +++ b/www/_posts/2026-06-07-inappbrowser-release-6.0.1.md @@ -0,0 +1,51 @@ +--- +layout: post +author: + name: Niklas Merz + url: https://w3c.social/@niklasmerz +title: "Cordova Plugin InAppBrowser 6.0.1 With Fix For CVE-2026-47430 Released!" +categories: announcements +tags: news releases plugins +--- + +We are happy to announce that we have just released an update to `cordova-plugin-inappbrowser`! + +* [[email protected]](https://www.npmjs.com/package/cordova-plugin-inappbrowser) + +## Release Highlights + +This is a small patch release that addresses the recently published vulnerability **CVE-2026-47430: Cordova Plugin InAppBrowser: iOS: Arbitrary Cordova callback IDs can be dispatched without validation from InAppBrowser WebViews**. Full details: + +*Severity: important* + +Affected versions: + +- Cordova Plugin InAppBrowser (cordova-plugin-inappbrowser) 3.1.0 through 6.0.0 + +Description: + +### Summary + +The iOS implementation of `cordova-plugin-inappbrowser` passes the `id` field from a `WKScriptMessage` body to `commandDelegate sendPluginResult:callbackId:` with no format validation (`CDVWKInAppBrowser.m:560–574`). Any web content loaded inside the InAppBrowser can fire any pending Cordova callback in the host app by posting a message whose `id` field is a guessable or enumerated callback identifier. An attack abusing this weakness must be tailored to the specific plugins and callback [...] + + +### Impact + +An unauthenticated remote attacker who controls content displayed in the InAppBrowser — via a URL the app opens (OAuth redirect, marketing link, deep-link target) or a network interception — can call `window.webkit.messageHandlers.cordova_iab.postMessage({id: '<victim-callback-id>', d: '...'})` to fire callbacks belonging to any other installed Cordova plugin (Camera, Contacts, File, Geolocation). Cordova callback IDs follow the predictable format `<PluginName><sequential-integer>`, maki [...] + +This issue affects Cordova Plugin InAppBrowser: from 3.1.0 through 6.0.0. + +Users are recommended to upgrade to version 6.0.1, which fixes the issue. + +References: + +https://www.cve.org/CVERecord?id=CVE-2026-47430 + +Please report any issues you find on [GitHub](http://https://github.com/apache/cordova-plugin-inappbrowser/issues)! + +<!--more--> +# Changes include: + +* [GH-1152](https://github.com/apache/cordova-plugin-inappbrowser/pull/1152) fix(ios): check callbackId with regex +* [GH-1095](https://github.com/apache/cordova-plugin-inappbrowser/pull/1095) chore: gh-action workflow, license header formatting & cleanups +* Fix npm audit issues --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
