The iOS implementation of the cordova-plugin-inappbrowser forwards the callback identifier contained in a WKScriptMessage directly to the Cordova runtime without performing any validation. This oversight allows any web content rendered inside an InAppBrowser window to trigger any pending Cordova callback by sending a crafted message containing a guessed or enumerated callback identifier. Because Cordova callback identifiers follow a predictable pattern—typically the plugin name concatenated with a sequence number—an attacker can enumerate valid identifiers for common plugins such as Camera, Contacts, File, and Geolocation. The consequence is that forged responses can be injected into the host application, potentially providing fake data or unauthorized approval of device resources, thereby enabling data leakage or unauthorized device interaction.

Apache Cordova Plugin InAppBrowser versions from 3.1.0 through 6.0.0 are affected. The issue was fixed in version 6.0.1, which introduces validation of the callback identifier.

The vulnerability carries a CVSS score of 9.5, indicating a critical risk. EPSS data is not available, and the issue is not listed in CISA KEV. An attacker does not need privileged access; they only require control over the content displayed in an InAppBrowser instance, such as via a malicious URL loaded during a redirect or through network interception. The predictability of callback identifiers lowers the barrier to exploitation, making the threat feasible for applications that embed commonly used Cordova plugins.