Executive brief
Electron is a framework for building cross-platform desktop applications using web technologies. A critical remote code execution vulnerability in the underlying Chromium engine affects all Electron applications that load remote content, bypassing sandbox protections. An attacker can exploit this by crafting malicious content that a user's application accesses, gaining complete control over the user's system including stealing sensitive data, modifying files, or installing malware.
Technical details
This vulnerability is a code injection flaw (CWE-94) in Chromium that affects Electron applications. The root cause involves improper handling of remote content processing, allowing an attacker to inject and execute arbitrary code. The vulnerability can be exploited via a network vector with no privileges or user interaction required; even applications with the sandbox option enabled are vulnerable if they access remote content. An attacker can achieve remote code execution with full system access, including confidentiality, integrity, and availability compromise. Patches were released in Electron versions 1.6.14 and 1.7.8 or later to address this issue.
Affected products
- GitHub Electron < 1.6.14, >= 1.7.0 and < 1.7.8
Timeline
- 2017-09-27: disclosed: Vulnerability disclosed and fix announced
- 2018-07-24: advisory: GitHub Security Advisory GHSA-4w88-rjj3-x7wp published
- 2017-09-27: patched: Electron 1.6.14 and 1.7.8 released with fixes