shouldiuse.io

New check

Categories

VERDICT

Should I use Cordova (Apache Cordova)?

Open-source framework for building cross-platform mobile apps with HTML, CSS, and JavaScript. - cordova.apache.org

Depends. Worth using only if you maintain an existing Cordova app or need a $0 web-wrapped internal app. For new social or performance-heavy apps, reviewers and 2026 guides steer you to React Native, Ionic, or Capacitor instead.

Confidence

Medium. Based on ~18 relevant public sources; many 'Cordova' search results were unrelated (places, surnames, consumer brands) and were excluded.

Ratings

  • Value for money
  • Ease of use
  • Feature depth
  • Support qualityNo support evidence in sources
  • Security posture

Pricing

$0

Open source

ModelNot disclosed
Monthly feesNot disclosed
HardwareNot disclosed
Free tierYes

Best for

  • Maintaining existing Cordova apps
  • Simple content apps from one web codebase
  • $0-budget internal tools
  • Web teams wrapping a site for iOS/Android

Not for

  • New social-heavy apps — Redditors pick React Native or Ionic instead
  • Games or graphics-intensive apps
  • Teams wanting vendor support or SLAs — there is none
  • Greenfield 2026 projects — momentum is with Capacitor

Gotchas - check before you buy

high

Security is DIY: Google has flagged Cordova apps on Play for vulnerable versions

medium

Plugins vary in quality; some carry their own CVE lists

medium

Migrating later means rebuilding the native layer on Capacitor or native

low

No vendor support — you rely on community forums and self-serve docs

Pros and cons

Pros

  • Free and open source — zero licensing cost
  • Turns one web codebase into iOS and Android apps
  • Large plugin ecosystem on npm and GitHub
  • Capterra reviewers highlight ease of use
  • Mature — over a decade in production apps

Cons

  • Ecosystem momentum moved to Capacitor and React Native
  • Recurring CVEs, including a 2026 InAppBrowser auth bypass
  • Reddit users steer social-heavy apps to competitors
  • CTO migration guides in 2025-26 recommend planning an exit

Sources & method

Analyzed 9/27/2026 - 11 sources - Multiple CVEs on record from 2014 through 2026; latest is an InAppBrowser auth bypass.

official x1review x4security x4news x2
  • CVE-2026-47430 — InAppBrowser auth bypass, Auth bypass flaw in the Cordova InAppBrowser plugin, disclosed June 2026.
  • CVE-2025-65835, Cordova-related vulnerability listed in NVD, December 2025.
  • CVE-2020-11990, Official Apache Cordova security advisory, November 2020.
  • CVE-2015-5256 and earlier, Google published fix guidance after vulnerable Cordova apps appeared on Play.

Key stats

  • Value for money: 5/5

    Rating

  • $0

    Starting price

  • 11

    Sources

  • Analyzed

  • Value for money: 5/5. Free, Apache-licensed, no license fees
  • Ease of use: 4/5. Capterra reviewers call it very easy
  • Feature depth: 3/5. Reddit pushes heavier apps to rivals
  • Support quality. No support evidence in sources
  • Security posture: 2/5. Repeated CVEs across 2014-2026
  • $0 Price Apache 2.0 open source
  • 2009 First released As PhoneGap, later Apache project
  • 5+ Public CVEs found 2014 through 2026
  • 10 G2 alternatives listed 2026 competitor roundup

Pricing

Open source

$0

  • Apache 2.0 license
  • Self-supported, community help

Security

Multiple CVEs on record from 2014 through 2026; latest is an InAppBrowser auth bypass.

  • CVE-2026-47430 — InAppBrowser auth bypassAuth bypass flaw in the Cordova InAppBrowser plugin, disclosed June 2026.⁶
  • CVE-2025-65835Cordova-related vulnerability listed in NVD, December 2025.⁷
  • CVE-2020-11990Official Apache Cordova security advisory, November 2020.⁸
  • CVE-2015-5256 and earlierGoogle published fix guidance after vulnerable Cordova apps appeared on Play.⁹

What users say

G2 and Capterra reviewers generally praise ease of use, while Reddit threads and 2026 migration guides push new apps toward Ionic, Capacitor, or React Native.

Full analysis

Based on ~18 relevant public sources; many 'Cordova' search results were unrelated (places, surnames, consumer brands) and were excluded.

Free, aging hybrid-app framework. Fine for legacy apps; for new builds, Capacitor or React Native are safer bets.

Methodology

Based on ~18 relevant public sources; many 'Cordova' search results were unrelated (places, surnames, consumer brands) and were excluded.

Sources

  1. Apache Cordova Reviews — G2g2.com
    review
  2. Apache Cordova Reviews — Capterracapterra.ca
    review
  3. React Native vs Ionic/Cordova — Redditreddit.com
    review
  4. Signs It's Time to Migrate Your Cordova App — Ionic Blogionic.io
    news
  5. Apache Cordova — Wikipediaen.wikipedia.org
    official
  6. CVE-2026-47430 — SentinelOnesentinelone.com
    security
  7. CVE-2025-65835 — NVDnvd.nist.gov
    security
  8. CVE-2020-11990 — Apache Cordovacordova.apache.org
    security
  9. Fixing Cordova vulnerabilities — Google Play guidancesupport.google.com
    security
  10. Top 10 Apache Cordova Alternatives — G2g2.com
    review
  11. Cordova alternatives 2025 migration guide — Bugseebugsee.com
    news

Rate this review

Anonymous. You can change your vote.

Loading votes…

Comments

One queue. No nested comments. Give a display name first. Limit: 200 words per comment and 7 comments per day. You can edit or delete yours.

Save a name to write a comment.

0 / 200 words

No comments yet.