Cordova In-App- Extension Arbitrary JavaScript Execution

The vulnerability of the Cordova In-App-Browser extension for Android relates to the lack of measures taken to protect the web page structure. Exploiting this vulnerability allows a malicious actor to execute arbitrary JavaScript code using a specially crafted URI containing the “gap-iab:“ scheme...

CVE-2019-0219

A website running in the InAppBrowser webview on Android could execute arbitrary JavaScript in the main application's webview using a specially crafted gap-iab: URI...

EUVD-2020-0969

A website running in the InAppBrowser webview on Android could execute arbitrary JavaScript in the main application's webview using a specially crafted gap-iab: URI...

CVE-2019-0219

A website running in the InAppBrowser webview on Android could execute arbitrary JavaScript in the main application's webview using a specially crafted gap-iab: URI...

CVE-2019-0219: Undefined Security Weakness

A website running in the InAppBrowser webview on Android could execute arbitrary JavaScript in the main application's webview using a specially crafted gap-iab: URI...

PT-2019-5794

Name of the Vulnerable Software and Affected Versions cordova-plugin-inappbrowser versions prior to 3.1.0 Description The issue is related to the Cordova In-App-Browser extension for Android, where a lack of protection for the web page structure can be exploited. This allows a remote attacker to...

CVE-2014-0073

The CDVInAppBrowser class in the Apache Cordova In-App-Browser standalone plugin org.apache.cordova.inappbrowser before 0.3.2 for iOS and the In-App-Browser plugin for iOS from Cordova 2.6.0 through 2.9.0 does not properly validate callback identifiers, which allows remote attackers to execute...

CVE-2014-0073: Undefined Security Weakness

The CDVInAppBrowser class in the Apache Cordova In-App-Browser standalone plugin org.apache.cordova.inappbrowser before 0.3.2 for iOS and the In-App-Browser plugin for iOS from Cordova 2.6.0 through 2.9.0 does not properly validate callback identifiers, which allows remote attackers to execute...

PT-2014-1992

Name of the Vulnerable Software and Affected Versions Apache Cordova In-App-Browser standalone plugin versions prior to 0.3.2 In-App-Browser plugin for iOS from Cordova versions 2.6.0 through 2.9.0 Description The issue is related to the CDVInAppBrowser class, which does not properly validate...