The Cordova Plugin InAppBrowser for iOS forwards the callback identifier contained in a WKScriptMessage body directly to the Cordova runtime without any validation. This omission allows any web content rendered within an InAppBrowser window to trigger any pending Cordova callback by posting a message whose id field is a guessed or enumerated callback identifier. Callback identifiers follow a predictable pattern, the plugin name followed by a sequential integer, so an attacker can enumerate valid identifiers for commonly used plugins such as Camera, Contacts, File, and Geolocation. Successful exploitation enables the attacker to inject forged plugin responses across trust boundaries— for example, by spoofing camera approvals, fabricating contact lists, or producing false file‑read data—effectively bypassing the host application's intent and access controls.

Apache Cordova Plugin InAppBrowser versions 3.1.0 through 6.0.0 are vulnerable because they lack validation of the callback identifier. The issue was remedied in version 6.0.1, which introduces proper verification before dispatching plugin results.

The reported CVSS score of 9.5 indicates a critical severity. The EPSS score of 0.00723 (~0.7%) suggests that, while exploitation probability is low, it is not negligible and could be realized by a determined attacker. The vulnerability is not yet listed in CISA's KEV catalog. An attacker needs only control over content displayed in an InAppBrowser instance—either by directing the app to load a malicious URL (such as during an OAuth redirect) or by intercepting network traffic—and can then enumerate callback identifiers to fire arbitrary Cordova callbacks, making the attack feasible for applications that embed common Cordova plugins.