CVE-2019-0219

Name of the Vulnerable Software and Affected Versions cordova-plugin-inappbrowser versions prior to 3.1.0

Description The issue is related to the Cordova In-App-Browser extension for Android, where a lack of protection for the web page structure can be exploited. This allows a remote attacker to execute arbitrary JavaScript code using a specially crafted URI containing the "gap-iab:" scheme. A website running in the InAppBrowser webview on Android could execute arbitrary JavaScript in the main application's webview.

Recommendations Upgrade to version 3.1.0 or later. As a temporary workaround, consider restricting the use of the gap-iab: scheme in the InAppBrowser webview to minimize the risk of exploitation.