Multiple Critical Vulnerabilities Discovered: VoLTE Flaw and iOS App Security Breach

Jun 8
2 min read

Key Findings

Critical VoLTE flaw in Verizon's core voice network exposes all cellular traffic without encryption
SIP signaling between devices and network completely lacks required IPsec ESP protection per 3GPP standards
On-path attackers can manipulate voice calls, spoof numbers, hijack calls, and misroute emergency services
Verizon has ceased coordinated vulnerability disclosure efforts and provided no evidence of active mitigation
Apache Cordova InAppBrowser plugin vulnerability (CVE-2026-47430) allows malicious web content to execute arbitrary commands in host apps
Cordova flaw affects versions 3.1.0 through 6.0.0 and enables attackers to spoof plugin results and access sensitive phone capabilities

Background

The Verizon IMS vulnerability represents a fundamental breakdown in telecommunications security infrastructure. Researchers discovered that Verizon's voice network completely bypasses industry-mandated cryptographic protections that have been standard for years. Meanwhile, a separate critical flaw in the widely-used Apache Cordova framework threatens mobile applications across iOS devices, potentially affecting millions of users who rely on cross-platform apps.

Missing Security Standards

The VoLTE flaw stems from deliberate non-compliance with established telecom safety standards. According to CERT/CC vulnerability documentation, the 3GPP TS 33.203 and GSMA IR.92 specifications explicitly require SIP signaling between user equipment and the network to use IPsec ESP encryption following proper authentication procedures.

However, Verizon's network consistently fails these requirements. Critical registration requests travel without essential security headers. Security analysts found no encrypted traffic during active voice calls across multiple device types and operating systems. This pattern indicates an intentional infrastructure design choice rather than a temporary glitch.

Real-World Impact of VoLTE Flaw

The consequences of missing cryptographic protection are severe. Without integrity verification, attackers gain direct access to manipulate voice communications. The confirmed attack capabilities include call hijacking, number spoofing, denial-of-service attacks, and misrouting of emergency calls to incorrect locations.

Recent carrier setting updates from Apple in May 2026 do not prove active protection in production networks. Verizon's decision to stop coordinated vulnerability disclosure efforts and withhold mitigation evidence leaves corporate networks unable to verify actual protections exist. Until official verification occurs, cellular traffic should be treated as completely untrusted.

Cordova Plugin Vulnerability Details

The InAppBrowser plugin flaw (CVE-2026-47430) creates a sandbox escape mechanism on iOS devices. The iOS implementation passes unvalidated fields directly into the app's core command system without proper verification. This allows any web content loaded inside the browser component to execute Cordova callbacks within the host application.

Callback identifiers use predictable formats that malicious actors can easily guess. This enables attackers to fabricate plugin results across security boundaries that should remain isolated.

Exploitation Vectors for Mobile Apps

Attackers exploit this vulnerability through multiple realistic attack paths. They might control OAuth redirect links, deep-link targets, or malicious marketing webpages. When victims visit these compromised links, attackers can hijack active connections to access sensitive phone capabilities like camera access and contact lists.

Successful exploitation allows fabricated injection of sensitive data and complete bypass of permission systems. The flaw fundamentally undermines the mobile security model that relies on plugin isolation.

Remediation Requirements

The Cordova vulnerability affects all versions 3.1.0 through 6.0.0. Engineering teams must immediately upgrade to version 6.0.1, which enforces necessary format validation to block unauthorized callback executions. This patch remains the single best defense against mobile supply chain threats until all users have updated their applications.

Sources

https://securityonline.info/verizon-volte-security-flaw/
https://securityonline.info/cordova-vulnerability-inappbrowser-flaw/