Get Demo
Apache Cordova Android before 3.5.1 allows remote attackers to change the start page via a crafted intent URL.