Executive brief
Electron is a framework used to build cross-platform desktop applications (including Slack, Discord, and VS Code). A vulnerability in how Electron handles security settings (webPreferences) for embedded web content allows an attacker to bypass sandbox protections and execute arbitrary code on a user's computer. Applications built with affected Electron versions are vulnerable if they use certain web content loading features.
Technical details
The vulnerability exists in Electron's webPreferences configuration handling, specifically in how security settings are inherited when IFRAME elements are used in conjunction with "nativeWindowOpen: true" or "sandbox: true" options. An attacker can craft malicious HTML or JavaScript that exploits the improper inheritance of webPreferences sub-properties to escape the sandbox and execute arbitrary code with the privileges of the Electron application. The attack requires no user authentication and can be triggered over the network if the application loads untrusted web content. Patches are available in Electron 1.7.16, 1.8.8, 2.0.8, and 3.0.0-beta.7 or later.
Affected products
- OpenJS Foundation Electron 1.7.0-1.7.15, 1.8.0-1.8.7, 2.0.0-2.0.7, 3.0.0-beta.1 to 3.0.0-beta.6
Timeline
- 2018-08-23: disclosed
- 2018-08: patched: Fixes available in Electron 1.7.16, 1.8.8, 2.0.8, and 3.0.0-beta.7