This problem only occurs on iOS 6.
On iOS 6, changing the main HTML page after the InAppBrowser has been closed results in that new page picking up the User-Agent (UA) of the InAppBrowser, not the original one. This seems to suggest in iOS 6, on a new webpage load, it re-reads the UserAgent property of NSUserDefaults again (and sets navigator.userAgent anew), when on iOS 5 it does not. On iOS 5, it is set once on UIWebView instantiation.
The problem lies in our XmlHttpRequest (xhr) bridge communication. We append the User-Agent with a value that is tied to the current Cordova view controller (CDVViewController), that is read by the CDVURLProtocol which determines whether we handle the Cordova exec call.
The workaround suggested is to re-set the UA back to what is expected, and this was tried. The expected UA is successfully set on InAppBrowser exit, but now, when you navigate to a new HTML page, all exec xhr requests just disappear without reaching the native layer. Poof. Removing the code that sets the expected UA makes the communication work again.
Setting the bridge mode to iframe makes it work again, and this does not require the UA fix:
var exec = cordova.require('cordova/exec');
If you have a multi-page app, and you use InAppBrowser, and you use iOS 6, you must use iframe bridge mode.