This is an automated email from the ASF dual-hosted git repository.
github-actions[bot] pushed a commit to branch asf-site
in repository https://gitbox.apache.org/repos/asf/cordova-docs.git
The following commit(s) were added to refs/heads/asf-site by this push:
new cb20033cae Deploying to asf-site from @
apache/cordova-docs@ef3d0a8a29889f39caf6451c2084ca34ed6be096 🚀
cb20033cae is described below
commit cb20033caea2909faedf9e3b91cdc1f549ea454a
Author: NiklasMerz <[email protected]>
AuthorDate: Mon Jun 8 12:51:49 2026 +0000
Deploying to asf-site from @
apache/cordova-docs@ef3d0a8a29889f39caf6451c2084ca34ed6be096 🚀
---
announcements/2026/05/31/cordova-ios-8.1.0.html | 22 +++-
.../07/inappbrowser-release-6.0.1.html} | 117 +++++++--------------
blog/index.html | 70 +++++++++++-
downloads/index.html | 38 ++++++-
feed.xml | 112 ++++++++++++--------
sitemap.xml | 5 +
static/js/index.js | 1 +
7 files changed, 234 insertions(+), 131 deletions(-)
diff --git a/announcements/2026/05/31/cordova-ios-8.1.0.html
b/announcements/2026/05/31/cordova-ios-8.1.0.html
index c57a8edebc..c9567f3604 100644
--- a/announcements/2026/05/31/cordova-ios-8.1.0.html
+++ b/announcements/2026/05/31/cordova-ios-8.1.0.html
@@ -123,7 +123,7 @@
<div class="title">Cordova iOS 8.1.0 is now available!</div>
<div class="author">By:
- Niklas Merz
+ <a href="https://w3c.social/@niklasmerz";>Niklas Merz</a>
</div>
<div class="date">31 May 2026</div>
@@ -234,6 +234,26 @@ cordova platform add [email protected]
</div>
<div class="col-sm-6">
+ <a
href="/announcements/2026/06/07/inappbrowser-release-6.0.1.html">Next</a>
+ <br>
+ <br>
+ <a class="title"
href="/announcements/2026/06/07/inappbrowser-release-6.0.1.html">Cordova Plugin
InAppBrowser 6.0.1 With Fix For CVE-2026-47430 Released!</a>
+ <div class="date"> 07 Jun 2026 - By Niklas Merz </div>
+ <p class="content">
+ <!--
+ NOTE:
+ the markdownify filter is used here
+ because posts are rendered in sequence;
+ that is, the next post's content isn't
+ yet rendered at the time that this post
+ is being rendered, so page.next.excerpt
+ is still in Markdown and not HTML
+
+ Reference:
https://github.com/jekyll/jekyll/issues/2860
+ -->
+ We are happy to announce that we have just released an
update...
+ </p>
+
</div>
</div>
</footer>
diff --git a/announcements/2026/05/31/cordova-ios-8.1.0.html
b/announcements/2026/06/07/inappbrowser-release-6.0.1.html
similarity index 57%
copy from announcements/2026/05/31/cordova-ios-8.1.0.html
copy to announcements/2026/06/07/inappbrowser-release-6.0.1.html
index c57a8edebc..e32fe1f5a4 100644
--- a/announcements/2026/05/31/cordova-ios-8.1.0.html
+++ b/announcements/2026/06/07/inappbrowser-release-6.0.1.html
@@ -6,12 +6,12 @@
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8" />
<meta name="format-detection" content="telephone=no">
<meta name="viewport" content="user-scalable=no, initial-scale=1,
maximum-scale=1, minimum-scale=1, width=device-width" />
- <meta name="description" content="We are happy to announce that we have
just released Cordova iOS 8.1.0! This is one of Cordova's supported
platforms for building iOS applications.This re...">
+ <meta name="description" content="We are happy to announce that we have
just released an update to cordova-plugin-inappbrowser!
[email protected] HighlightsThis is a s...">
<title>
- Cordova iOS 8.1.0 is now available! - Apache Cordova
+ Cordova Plugin InAppBrowser 6.0.1 With Fix For CVE-2026-47430
Released! - Apache Cordova
</title>
@@ -23,7 +23,7 @@
- <link rel="canonical"
href="https://cordova.apache.org/announcements/2026/05/31/cordova-ios-8.1.0.html";>
+ <link rel="canonical"
href="https://cordova.apache.org/announcements/2026/06/07/inappbrowser-release-6.0.1.html";>
<!-- CSS -->
<link rel="stylesheet" type="text/css" href="/static/css/main.css">
@@ -120,100 +120,61 @@
<div class="post">
<header>
- <div class="title">Cordova iOS 8.1.0 is now available!</div>
+ <div class="title">Cordova Plugin InAppBrowser 6.0.1 With Fix For
CVE-2026-47430 Released!</div>
<div class="author">By:
- Niklas Merz
+ <a href="https://w3c.social/@niklasmerz";>Niklas Merz</a>
</div>
- <div class="date">31 May 2026</div>
+ <div class="date">07 Jun 2026</div>
</header>
<section>
<div>
- <p>We are happy to announce that we have just released
<code>Cordova iOS 8.1.0</code>! This is one of Cordova's supported
platforms for building iOS applications.</p>
-
-<p>This release contains fixes for several bugs that were reported against the
8.0.1 version.</p>
+ <p>We are happy to announce that we have just released an update
to <code>cordova-plugin-inappbrowser</code>!</p>
<ul>
- <li><a
href="https://www.npmjs.com/package/cordova-ios";>[email protected]</a></li>
+ <li><a
href="https://www.npmjs.com/package/cordova-plugin-inappbrowser";>[email protected]</a></li>
</ul>
-<p><strong>To upgrade:</strong></p>
-
-<div class="language-bash highlighter-rouge"><div class="highlight"><pre
class="highlight"><code>cordova platform remove ios
-cordova platform add [email protected]
-</code></pre></div></div>
+<h2>Release Highlights</h2>
-<p><strong>To install:</strong></p>
+<p>This is a small patch release that addresses the recently published
vulnerability <strong><a
href="https://www.cve.org/CVERecord?id=CVE-2026-47430";>CVE-2026-47430</a>:
Cordova Plugin InAppBrowser: iOS: Arbitrary Cordova callback IDs can be
dispatched without validation from InAppBrowser WebViews</strong>. Full
details:</p>
-<div class="language-bash highlighter-rouge"><div class="highlight"><pre
class="highlight"><code>cordova platform add [email protected]
-</code></pre></div></div>
+<p><em>Severity: important</em></p>
-<h2>Release Highlights</h2>
+<p>Affected versions:</p>
<ul>
- <li>
- <p><strong>Fix for Ionic WebView plugin</strong></p>
-
- <p>Re-add an implementation of the deprecated
<code>shouldOverrideLoadWithRequest:navigationType:</code> selector because the
Ionic WebView plugin relies on it.</p>
- </li>
- <li>
- <p><strong>Fix <code>/_app_file_/</code> URLs not working</strong></p>
-
- <p>During refactoring of the <strong>URLSchemeTask</strong> handler for
cordova-ios 8, an error was introduced where <code>/_app_file_</code> URLs were
treated as being relative to the resources directory rather than as filesystem
paths.</p>
- </li>
- <li>
- <p><strong>Fixes various build issues</strong></p>
- </li>
+ <li>Cordova Plugin InAppBrowser (cordova-plugin-inappbrowser) 3.1.0 through
6.0.0</li>
</ul>
-<!--more-->
-<h2>Changes include:</h2>
+<p>Description:</p>
-<p><strong>Fixes:</strong></p>
+<h3>Summary</h3>
-<ul>
- <li><a href="https://github.com/apache/cordova-ios/pull/1653";>GH-1653</a>
fix(actions): fix CDVURLSchemeHandlerTest warnings</li>
- <li><a href="https://github.com/apache/cordova-ios/pull/1652";>GH-1652</a>
fix(actions): IPhone 16e not found on macOS 26 for latest OS</li>
- <li><a href="https://github.com/apache/cordova-ios/pull/1640";>GH-1640</a>
fix: <code>NSInternalInconsistencyException: "No response has been sent for
this task"</code> - second attempt</li>
- <li><a href="https://github.com/apache/cordova-ios/pull/1637";>GH-1637</a>
fix(build): Target a generic <strong>iOS</strong> simulator for building</li>
- <li><a href="https://github.com/apache/cordova-ios/pull/1632";>GH-1632</a>
fix(ionic): Add workaround for Ionic WebView plugin</li>
- <li><a href="https://github.com/apache/cordova-ios/pull/1618";>GH-1618</a>
fix(xcode): Fix library search paths for target</li>
- <li><a href="https://github.com/apache/cordova-ios/pull/1621";>GH-1621</a>
fix(xcode): Ensure we do NFD normalization on PRODUCT_NAME</li>
- <li><a href="https://github.com/apache/cordova-ios/pull/1616";>GH-1616</a>
fix(spm): Ensure the deployment target always gets set</li>
- <li><a href="https://github.com/apache/cordova-ios/pull/1606";>GH-1606</a>
fix(webview): Ensure scheme task is always finished</li>
- <li><a href="https://github.com/apache/cordova-ios/pull/1610";>GH-1610</a>
fix(scheme): Fix /<em>app_file</em>/ URLs not working</li>
- <li><a href="https://github.com/apache/cordova-ios/pull/1612";>GH-1612</a>
fix(spm): Set deployment target in Package.swift</li>
- <li><a href="https://github.com/apache/cordova-ios/pull/1597";>GH-1597</a>
fix: ignore spm build artifacts</li>
-</ul>
+<p>The iOS implementation of <code>cordova-plugin-inappbrowser</code> passes
the <code>id</code> field from a <code>WKScriptMessage</code> body to
<code>commandDelegate sendPluginResult:callbackId:</code> with no format
validation (<code>CDVWKInAppBrowser.m:560–574</code>). Any web content loaded
inside the InAppBrowser can fire any pending Cordova callback in the host app
by posting a message whose <code>id</code> field is a guessable or enumerated
callback identifier. An attack abusing [...]
+
+<h3>Impact</h3>
-<p><strong>Others:</strong></p>
+<p>An unauthenticated remote attacker who controls content displayed in the
InAppBrowser — via a URL the app opens (OAuth redirect, marketing link,
deep-link target) or a network interception — can call
<code>window.webkit.messageHandlers.cordova_iab.postMessage({id:
'<victim-callback-id>', d: '...'})</code> to fire callbacks belonging to
any other installed Cordova plugin (Camera, Contacts, File, Geolocation).
Cordova callback IDs follow the predictable format <code><PluginName [...]
+
+<p>This issue affects Cordova Plugin InAppBrowser: from 3.1.0 through
6.0.0.</p>
+
+<p>Users are recommended to upgrade to version 6.0.1, which fixes the
issue.</p>
+
+<p>References:</p>
+
+<p>https://www.cve.org/CVERecord?id=CVE-2026-47430</p>
+
+<p>Please report any issues you find on <a
href="http://https://github.com/apache/cordova-plugin-inappbrowser/issues";>GitHub</a>!</p>
+
+<!--more-->
+<h1>Changes include:</h1>
<ul>
- <li><a href="https://github.com/apache/cordova-ios/pull/1650";>GH-1650</a>
chore: remove redundant Hello World template files</li>
- <li><a href="https://github.com/apache/cordova-ios/pull/1647";>GH-1647</a>
chore(deps): bump @xmldom/xmldom from 0.8.12 to 0.8.13</li>
- <li><a href="https://github.com/apache/cordova-ios/pull/1634";>GH-1634</a>
doc: <code>keepCallback</code> and <code>setKeepCallbackAsBool:</code> of
<code>CDVPluginResult</code></li>
- <li><a href="https://github.com/apache/cordova-ios/pull/1646";>GH-1646</a>
chore(deps): bump lodash from 4.17.23 to 4.18.1</li>
- <li><a href="https://github.com/apache/cordova-ios/pull/1644";>GH-1644</a>
chore(deps): bump @xmldom/xmldom from 0.8.11 to 0.8.12</li>
- <li><a href="https://github.com/apache/cordova-ios/pull/1642";>GH-1642</a>
chore(deps): bump picomatch</li>
- <li><a href="https://github.com/apache/cordova-ios/pull/1639";>GH-1639</a>
chore: update package-lock</li>
- <li><a href="https://github.com/apache/cordova-ios/pull/1635";>GH-1635</a>
chore: Fix improperly ignored deprecation warning</li>
- <li><a href="https://github.com/apache/cordova-ios/pull/1633";>GH-1633</a>
chore: Bump patch level for ongoing dev work</li>
- <li><a href="https://github.com/apache/cordova-ios/pull/1628";>GH-1628</a>
chore: Fix missing licence headers</li>
- <li><a href="https://github.com/apache/cordova-ios/pull/1627";>GH-1627</a>
release(8.0.1): Update release notes and version</li>
- <li><a href="https://github.com/apache/cordova-ios/pull/1623";>GH-1623</a>
chore(ci): draft release</li>
- <li><a href="https://github.com/apache/cordova-ios/pull/1624";>GH-1624</a>
chore: cleanup license headers</li>
- <li><a href="https://github.com/apache/cordova-ios/pull/1625";>GH-1625</a>
chore: add DEVELOPMENT.md & cleanup <code>README</code>.md</li>
- <li><a href="https://github.com/apache/cordova-ios/pull/1622";>GH-1622</a>
refactor(versions): Refactor version code for test reliability</li>
- <li><a href="https://github.com/apache/cordova-ios/pull/1619";>GH-1619</a>
chore(deps): Update to latest jasmine & c8 versions</li>
- <li><a href="https://github.com/apache/cordova-ios/pull/1614";>GH-1614</a>
doc(readme): improve badges</li>
- <li><a href="https://github.com/apache/cordova-ios/pull/1601";>GH-1601</a>
chore: Remove compileBitcode from export options</li>
- <li><a href="https://github.com/apache/cordova-ios/pull/1611";>GH-1611</a>
chore: set swift-tools-version to 5.9</li>
- <li><a href="https://github.com/apache/cordova-ios/pull/1599";>GH-1599</a>
chore(deps): bump lodash from 4.17.21 to 4.17.23</li>
- <li><a href="https://github.com/apache/cordova-ios/pull/1598";>GH-1598</a>
Add missing trailing new line</li>
- <li><a href="https://github.com/apache/cordova-ios/pull/1592";>GH-1592</a>
doc(readme): add minimum <strong>iOS</strong> version</li>
- <li><a href="https://github.com/apache/cordova-ios/pull/1591";>GH-1591</a>
doc(readme): add Link to <strong>iOS</strong> Platform Guide</li>
- <li><a href="https://github.com/apache/cordova-ios/pull/1588";>GH-1588</a>
chore: update release audit workflow & license headers</li>
+ <li><a
href="https://github.com/apache/cordova-plugin-inappbrowser/pull/1152";>GH-1152</a>
fix(ios): check callbackId with regex</li>
+ <li><a
href="https://github.com/apache/cordova-plugin-inappbrowser/pull/1095";>GH-1095</a>
chore: gh-action workflow, license header formatting & cleanups</li>
+ <li>Fix npm audit issues</li>
</ul>
</div>
@@ -222,13 +183,13 @@ cordova platform add [email protected]
<div class="row">
<div class="col-sm-6">
- <a
href="/announcements/2026/05/16/cordova-plugin-network-information-3.1.0.html">Previous</a>
+ <a
href="/announcements/2026/05/31/cordova-ios-8.1.0.html">Previous</a>
<br>
<br>
- <a class="title"
href="/announcements/2026/05/16/cordova-plugin-network-information-3.1.0.html">Network
Information Plugin 3.1.0 Released!</a>
- <div class="date"> 16 May 2026 - By Manuel Beck </div>
+ <a class="title"
href="/announcements/2026/05/31/cordova-ios-8.1.0.html">Cordova iOS 8.1.0 is
now available!</a>
+ <div class="date"> 31 May 2026 - By Niklas Merz </div>
<p class="content">
- We are happy to announce that we have just released an
update...
+ We are happy to announce that we have just released
Cordova iOS...
</p>
</div>
diff --git a/blog/index.html b/blog/index.html
index 25d8acf50a..c7544a2692 100644
--- a/blog/index.html
+++ b/blog/index.html
@@ -121,6 +121,72 @@
</h1>
<ul class="posts">
+ <li>
+ <header>
+ <div class="adorner" blogTime="Sun, 07 Jun 2026 00:00:00
+0000"></div>
+
+
+ <h2 class="title">
+ <a
href="/announcements/2026/06/07/inappbrowser-release-6.0.1.html">Cordova Plugin
InAppBrowser 6.0.1 With Fix For CVE-2026-47430 Released!</a>
+ </h2>
+ <div class="details">
+ <span class="date">07 Jun 2026</span>
+ - by
+ <span class="author">
+
+ <a
href="https://w3c.social/@niklasmerz";>Niklas Merz</a>
+
+ </span>
+ </div>
+
+
+ </header>
+ <section class="post-excerpt">
+ <p><p>We are happy to announce that we have just released
an update to <code>cordova-plugin-inappbrowser</code>!</p>
+
+<ul>
+ <li><a
href="https://www.npmjs.com/package/cordova-plugin-inappbrowser";>[email protected]</a></li>
+</ul>
+
+<h2>Release Highlights</h2>
+
+<p>This is a small patch release that addresses the recently published
vulnerability <strong><a
href="https://www.cve.org/CVERecord?id=CVE-2026-47430";>CVE-2026-47430</a>:
Cordova Plugin InAppBrowser: iOS: Arbitrary Cordova callback IDs can be
dispatched without validation from InAppBrowser WebViews</strong>. Full
details:</p>
+
+<p><em>Severity: important</em></p>
+
+<p>Affected versions:</p>
+
+<ul>
+ <li>Cordova Plugin InAppBrowser (cordova-plugin-inappbrowser) 3.1.0 through
6.0.0</li>
+</ul>
+
+<p>Description:</p>
+
+<h3>Summary</h3>
+
+<p>The iOS implementation of <code>cordova-plugin-inappbrowser</code> passes
the <code>id</code> field from a <code>WKScriptMessage</code> body to
<code>commandDelegate sendPluginResult:callbackId:</code> with no format
validation (<code>CDVWKInAppBrowser.m:560–574</code>). Any web content loaded
inside the InAppBrowser can fire any pending Cordova callback in the host app
by posting a message whose <code>id</code> field is a guessable or enumerated
callback identifier. An attack abusing [...]
+
+<h3>Impact</h3>
+
+<p>An unauthenticated remote attacker who controls content displayed in the
InAppBrowser — via a URL the app opens (OAuth redirect, marketing link,
deep-link target) or a network interception — can call
<code>window.webkit.messageHandlers.cordova_iab.postMessage({id:
'<victim-callback-id>', d: '...'})</code> to fire callbacks belonging to
any other installed Cordova plugin (Camera, Contacts, File, Geolocation).
Cordova callback IDs follow the predictable format <code><PluginName [...]
+
+<p>This issue affects Cordova Plugin InAppBrowser: from 3.1.0 through
6.0.0.</p>
+
+<p>Users are recommended to upgrade to version 6.0.1, which fixes the
issue.</p>
+
+<p>References:</p>
+
+<p>https://www.cve.org/CVERecord?id=CVE-2026-47430</p>
+
+<p>Please report any issues you find on <a
href="http://https://github.com/apache/cordova-plugin-inappbrowser/issues";>GitHub</a>!</p>
+
+</p>
+ <div><a
href="/announcements/2026/06/07/inappbrowser-release-6.0.1.html">More...</a></div>
+
+
+ </section>
+ </li>
+
<li>
<header>
<div class="adorner" blogTime="Sun, 31 May 2026 00:00:00
+0000"></div>
@@ -134,7 +200,7 @@
- by
<span class="author">
- Niklas Merz
+ <a
href="https://w3c.social/@niklasmerz";>Niklas Merz</a>
</span>
</div>
@@ -17345,7 +17411,7 @@ just around the corner (July 19, 2013), and we are
really excited about it!</p>
<script>
window.onload = function(){
setTimeout(function(){
- var lastPostTime = new Date("Sun, 31 May 2026 00:00:00
+0000").getTime();
+ var lastPostTime = new Date("Sun, 07 Jun 2026 00:00:00
+0000").getTime();
setCookie("visitTime", lastPostTime, 365);
}, 2000);
};
diff --git a/downloads/index.html b/downloads/index.html
index f7895be7df..36f3bb9ef6 100644
--- a/downloads/index.html
+++ b/downloads/index.html
@@ -806,7 +806,7 @@
<section class="release-card">
<header class="release-header">
- <h2>[email protected]</h2>
+ <h2>[email protected]</h2>
</header>
<ul class="download-list">
@@ -815,14 +815,44 @@
<li class="download-row">
<span class="download-name">
- <a
href="https://dlcdn.apache.org/cordova/plugins/cordova-plugin-inappbrowser-6.0.0.tgz";>
+ <a
href="https://dlcdn.apache.org/cordova/plugins/cordova-plugin-inappbrowser-source-6.0.1.tar.gz";>
+ source (tar.gz)
+ </a>
+ </span>
+
+ <span class="download-actions">
+ <a
href="https://dlcdn.apache.org/cordova/plugins/cordova-plugin-inappbrowser-source-6.0.1.tar.gz.asc";>ASC</a>
+ <a
href="https://dlcdn.apache.org/cordova/plugins/cordova-plugin-inappbrowser-source-6.0.1.tar.gz.sha512";>SHA512</a>
+ </span>
+ </li>
+
+
+
+ <li class="download-row">
+ <span class="download-name">
+ <a
href="https://dlcdn.apache.org/cordova/plugins/cordova-plugin-inappbrowser-source-6.0.1.zip";>
+ source (zip)
+ </a>
+ </span>
+
+ <span class="download-actions">
+ <a
href="https://dlcdn.apache.org/cordova/plugins/cordova-plugin-inappbrowser-source-6.0.1.zip.asc";>ASC</a>
+ <a
href="https://dlcdn.apache.org/cordova/plugins/cordova-plugin-inappbrowser-source-6.0.1.zip.sha512";>SHA512</a>
+ </span>
+ </li>
+
+
+
+ <li class="download-row">
+ <span class="download-name">
+ <a
href="https://dlcdn.apache.org/cordova/plugins/cordova-plugin-inappbrowser-6.0.1.tgz";>
npm (tgz)
</a>
</span>
<span class="download-actions">
- <a
href="https://dlcdn.apache.org/cordova/plugins/cordova-plugin-inappbrowser-6.0.0.tgz.asc";>ASC</a>
- <a
href="https://dlcdn.apache.org/cordova/plugins/cordova-plugin-inappbrowser-6.0.0.tgz.sha512";>SHA512</a>
+ <a
href="https://dlcdn.apache.org/cordova/plugins/cordova-plugin-inappbrowser-6.0.1.tgz.asc";>ASC</a>
+ <a
href="https://dlcdn.apache.org/cordova/plugins/cordova-plugin-inappbrowser-6.0.1.tgz.sha512";>SHA512</a>
</span>
</li>
diff --git a/feed.xml b/feed.xml
index 0f818f471a..44507ccf52 100644
--- a/feed.xml
+++ b/feed.xml
@@ -6,10 +6,74 @@
</description>
<link>https://cordova.apache.org/</link>
<atom:link href="https://cordova.apache.org/feed.xml"; rel="self"
type="application/rss+xml"/>
- <pubDate>Sun, 31 May 2026 09:08:54 +0000</pubDate>
- <lastBuildDate>Sun, 31 May 2026 09:08:54 +0000</lastBuildDate>
+ <pubDate>Mon, 08 Jun 2026 12:51:38 +0000</pubDate>
+ <lastBuildDate>Mon, 08 Jun 2026 12:51:38 +0000</lastBuildDate>
<generator>Jekyll v4.4.1</generator>
+ <item>
+ <title>Cordova Plugin InAppBrowser 6.0.1 With Fix For CVE-2026-47430
Released!</title>
+ <description><p>We are happy to announce that we have just
released an update to
<code>cordova-plugin-inappbrowser</code>!</p>
+
+<ul>
+ <li><a
href="https://www.npmjs.com/package/cordova-plugin-inappbrowser">[email protected]</a></li>
+</ul>
+
+<h2>Release Highlights</h2>
+
+<p>This is a small patch release that addresses the recently published
vulnerability <strong><a
href="https://www.cve.org/CVERecord?id=CVE-2026-47430">CVE-2026-47430</a>:
Cordova Plugin InAppBrowser: iOS: Arbitrary Cordova callback IDs can be
dispatched without validation from InAppBrowser WebViews</strong>. Full
details:</p>
+
+<p><em>Severity: important</em></p>
+
+<p>Affected versions:</p>
+
+<ul>
+ <li>Cordova Plugin InAppBrowser (cordova-plugin-inappbrowser) 3.1.0
through 6.0.0</li>
+</ul>
+
+<p>Description:</p>
+
+<h3>Summary</h3>
+
+<p>The iOS implementation of
<code>cordova-plugin-inappbrowser</code> passes the
<code>id</code> field from a
<code>WKScriptMessage</code> body to <code>commandDelegate
sendPluginResult:callbackId:</code> with no format validation
(<code>CDVWKInAppBrowser.m:560–574</code>). Any web content loaded
inside the InAppBrowser can fire any pending Cordova callback in the host app
by posting a message whose <code>id</code [...]
+
+<h3>Impact</h3>
+
+<p>An unauthenticated remote attacker who controls content displayed in
the InAppBrowser — via a URL the app opens (OAuth redirect, marketing link,
deep-link target) or a network interception — can call
<code>window.webkit.messageHandlers.cordova_iab.postMessage({id:
'&lt;victim-callback-id&gt;', d: '...'})</code> to fire callbacks
belonging to any other installed Cordova plugin (Camera, Contacts, File,
Geolocation). Cordova callback IDs follow the predictable f [...]
+
+<p>This issue affects Cordova Plugin InAppBrowser: from 3.1.0 through
6.0.0.</p>
+
+<p>Users are recommended to upgrade to version 6.0.1, which fixes the
issue.</p>
+
+<p>References:</p>
+
+<p>https://www.cve.org/CVERecord?id=CVE-2026-47430</p>
+
+<p>Please report any issues you find on <a
href="http://https://github.com/apache/cordova-plugin-inappbrowser/issues">GitHub</a>!</p>
+
+<!--more-->
+<h1>Changes include:</h1>
+
+<ul>
+ <li><a
href="https://github.com/apache/cordova-plugin-inappbrowser/pull/1152">GH-1152</a>
fix(ios): check callbackId with regex</li>
+ <li><a
href="https://github.com/apache/cordova-plugin-inappbrowser/pull/1095">GH-1095</a>
chore: gh-action workflow, license header formatting &amp;
cleanups</li>
+ <li>Fix npm audit issues</li>
+</ul>
+</description>
+ <pubDate>Sun, 07 Jun 2026 00:00:00 +0000</pubDate>
+
<link>https://cordova.apache.org/announcements/2026/06/07/inappbrowser-release-6.0.1.html</link>
+ <guid
isPermaLink="true">https://cordova.apache.org/announcements/2026/06/07/inappbrowser-release-6.0.1.html</guid>
+
+ <category>news</category>
+
+ <category>releases</category>
+
+ <category>plugins</category>
+
+
+ <category>announcements</category>
+
+ </item>
+
<item>
<title>Cordova iOS 8.1.0 is now available!</title>
<description><p>We are happy to announce that we have just
released <code>Cordova iOS 8.1.0</code>! This is one of
Cordova&#39;s supported platforms for building iOS applications.</p>
@@ -1005,50 +1069,6 @@ This resolves numerous issues around CocoaPods,
multi-target projects, and Info.
<category>releases</category>
- <category>announcements</category>
-
- </item>
-
- <item>
- <title>Cordova App Hello World 7.0.0 Released!</title>
- <description><p>We are happy to announce that
<code>[email protected]</code> has been released. This
is the default app template used when creating a new Cordova App project though
Cordova CLI.</p>
-
-<h2>Release Highlights</h2>
-
-<p>The most notable changes in this release were:</p>
-
-<ul>
- <li>Setting the <code>body</code> element&#39;s
<code>box-sizing</code> to <code>border-box</code> to
avoid the <code>safe-area-inset</code> padding that caused
scrolling issues</li>
- <li>Disabled the <code>overscroll</code> behavior of the
root element to remove rubber-banding effects.</li>
- <li>Used modern, unprefixed CSS directives.</li>
- <li>Updated default template&#39;s package ID to
<code>org.apache.cordova.hellocordova</code>.</li>
-</ul>
-
-<!--more-->
-<h1>Changes include:</h1>
-
-<p><strong>Fixes:</strong></p>
-
-<ul>
- <li><a
href="https://github.com/apache/cordova-app-hello-world/pull/98">GH-98</a>
fix(css): Fix extra padding causing scrolling</li>
-</ul>
-
-<p><strong>Chores:</strong></p>
-
-<ul>
- <li><a
href="https://github.com/apache/cordova-app-hello-world/pull/99">GH-99</a>
chore: updated defaults, license headers &amp; added release audit
workflow</li>
- <li><a
href="https://github.com/apache/cordova-app-hello-world/pull/78">GH-78</a>
chore: correct <code>access</code> inline comment</li>
-</ul>
-</description>
- <pubDate>Fri, 29 Aug 2025 00:00:00 +0000</pubDate>
-
<link>https://cordova.apache.org/announcements/2025/08/29/cordova-app-hello-world-7.0.0.html</link>
- <guid
isPermaLink="true">https://cordova.apache.org/announcements/2025/08/29/cordova-app-hello-world-7.0.0.html</guid>
-
- <category>news</category>
-
- <category>releases</category>
-
-
<category>announcements</category>
</item>
diff --git a/sitemap.xml b/sitemap.xml
index 0f50a8af77..e9f052553d 100644
--- a/sitemap.xml
+++ b/sitemap.xml
@@ -3,6 +3,11 @@
<!-- posts -->
+<url>
+
<loc>https://cordova.apache.org/announcements/2026/06/07/inappbrowser-release-6.0.1.html</loc>
+</url>
+
+
<url>
<loc>https://cordova.apache.org/announcements/2026/05/31/cordova-ios-8.1.0.html</loc>
</url>
diff --git a/static/js/index.js b/static/js/index.js
index e3c66ea103..a0fff58d00 100644
--- a/static/js/index.js
+++ b/static/js/index.js
@@ -47,6 +47,7 @@ function checkNotification() {
var dates = [];
if (lastVisit != "") {
+ dates.push('Sun, 07 Jun 2026 00:00:00 +0000');
dates.push('Sun, 31 May 2026 00:00:00 +0000');
dates.push('Sat, 16 May 2026 00:00:00 +0000');
dates.push('Thu, 12 Mar 2026 00:00:00 +0000');
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
