# CVE-2020-15174: Electron navigation bypass via cross-site sub-frame navigation

Source: https://junglewise.ai/threats/cve-2020-15174-electron-navigation-bypass-via-cross-site-sub-frame-navigation  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2020-10-06. Updated: 2026-05-14  
License: CC BY 4.0 with a link back

CVE-2020-15174 · Severity: low · CVSS 3.1 · Published 2020-10-06

Electron is a framework used to build desktop applications like Slack, Discord, and VS Code. A security flaw allowed embedded content (like an advertisement or a third-party widget) to force the entire application to navigate to a different, potentially malicious website, bypassing the app's built-in security filters. This could be used to redirect users to phishing sites or unauthorized external content.

## Quick answers

**Is CVE-2020-15174 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2020-15174 being exploited in the wild.

**How severe is CVE-2020-15174?** Low severity, with a CVSS score of 3.1, published 6 October 2020.

**Which products and versions are affected?** ElectronJS Electron >= 8.0.0, < 8.5.1; >= 9.0.0, < 9.3.0; >= 10.0.0, < 10.0.1.

**Is there a fix for CVE-2020-15174?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2020-15174 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2020-15174?** Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A vulnerability in Electron's navigation handling allowed sub-frames to bypass the 'will-navigate' event when performing a cross-site top-frame navigation. The 'will-navigate' event is the primary mechanism developers use to intercept and cancel unexpected navigation requests. By triggering a navigation from a sub-frame to the top-level frame across different origins, an attacker could circumvent these programmatic security checks. The fix involved refactoring the 'will-navigate' logic to use a navigation throttle within the browser process. Developers are advised to upgrade to patched versions or use the 'sandbox' attribute on all iframes as a workaround.

## Affected products

- ElectronJS Electron >= 8.0.0, < 8.5.1; >= 9.0.0, < 9.3.0; >= 10.0.0, < 10.0.1

## Identifiers

- CVE-2020-15174
- GHSA-2q4g-w47c-4674

## Timeline

- 2020-10-05: advisory: GitHub Advisory published
- 2020-10-06: disclosed: NVD publication date

## References

- [https://github.com/electron/electron/security/advisories/GHSA-2q4g-w47c-4674](https://github.com/electron/electron/security/advisories/GHSA-2q4g-w47c-4674)
- [https://github.com/electron/electron/commit/18613925610ba319da7f497b6deed85ad712c59b](https://github.com/electron/electron/commit/18613925610ba319da7f497b6deed85ad712c59b)
- [https://github.com/electron/electron](https://github.com/electron/electron)