Executive brief
Electron is a framework used to build desktop applications like Slack, Discord, and VS Code. A security flaw allowed embedded content (like an advertisement or a third-party widget) to force the entire application to navigate to a different, potentially malicious website, bypassing the app's built-in security filters. This could be used to redirect users to phishing sites or unauthorized external content.
Technical details
A vulnerability in Electron's navigation handling allowed sub-frames to bypass the 'will-navigate' event when performing a cross-site top-frame navigation. The 'will-navigate' event is the primary mechanism developers use to intercept and cancel unexpected navigation requests. By triggering a navigation from a sub-frame to the top-level frame across different origins, an attacker could circumvent these programmatic security checks. The fix involved refactoring the 'will-navigate' logic to use a navigation throttle within the browser process. Developers are advised to upgrade to patched versions or use the 'sandbox' attribute on all iframes as a workaround.
Affected products
- ElectronJS Electron >= 8.0.0, < 8.5.1; >= 9.0.0, < 9.3.0; >= 10.0.0, < 10.0.1
Timeline
- 2020-10-05: advisory: GitHub Advisory published
- 2020-10-06: disclosed: NVD publication date