Critical severity9.8NVD Advisory· Published Oct 30, 2017· Updated Jun 17, 2026
CVE-2014-0073
CVE-2014-0073
Description
The CDVInAppBrowser class in the Apache Cordova In-App-Browser standalone plugin (org.apache.cordova.inappbrowser) before 0.3.2 for iOS and the In-App-Browser plugin for iOS from Cordova 2.6.0 through 2.9.0 does not properly validate callback identifiers, which allows remote attackers to execute arbitrary JavaScript in the host page and consequently gain privileges via a crafted gap-iab: URI.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
3cpe:2.3:a:apache:cordova_in-app-browser:*:*:*:*:*:iphone_os:*:*+ 1 more
- cpe:2.3:a:apache:cordova_in-app-browser:*:*:*:*:*:iphone_os:*:*range: <=0.3.1
- (no CPE)range: <0.3.2
Patches
Vulnerability mechanics
References
7- github.com/apache/cordova-plugin-inappbrowser/commit/26702cb0720c5c394b407c23570136c53171fa55nvdIssue TrackingPatchVendor Advisory
- d3adend.org/blog/nvdIssue TrackingThird Party Advisory
- seclists.org/fulldisclosure/2014/Mar/30nvdMailing ListThird Party Advisory
- www.securityfocus.com/bid/65959nvdThird Party AdvisoryVDB Entry
- exchange.xforce.ibmcloud.com/vulnerabilities/91560nvdIssue TrackingThird Party AdvisoryVDB Entry
- www.securityfocus.com/archive/1/531334/100/0/threadednvd
- mail-archives.apache.org/mod_mbox/cordova-dev/201403.mbox/%3CCAK_TSXLGJag5Q9ATUCbFtkWvMWX9XnC80kKp-HKi25gPcvV4gw%40mail.gmail.com%3Envd
News mentions
0No linked articles in our index yet.