Executive brief
Electron is a framework used to build cross-platform desktop applications with web technologies. A security flaw allows malicious or compromised code within an application's renderer process to bypass isolation boundaries and access privileged system functions. Applications using Electron's security features contextIsolation and either sandbox or nativeWindowOpen are vulnerable; attackers could escalate privileges or access sensitive functionality depending on application design.
Technical details
This is a context isolation bypass vulnerability (CWE-668, CWE-693) in Electron's renderer process security model. The vulnerability is triggered when an application enables contextIsolation alongside either sandbox: true or nativeWindowOpen: true configuration options. Code executing in the main world context (untrusted renderer code) can reach into the isolated preload context and invoke privileged APIs. The attack requires the vulnerable configuration combination but does not require network access, authentication, or user interaction. An attacker can perform arbitrary privileged actions available through the Electron API. The vulnerability was fixed in versions 8.5.2, 9.3.1, 10.1.2, and 11.0.0-beta.6 and later.
Affected products
- Electron Project Electron 8.0.0-beta.0 to 8.5.1, 9.0.0-beta.0 to 9.3.0, 10.0.0-beta.0 to 10.1.1, 11.0.0-beta.0 to 11.0.0-beta.5
Timeline
- 2020-10-06: disclosed: Advisory published by Electron security team
- 2020-10: patched: Fixed in versions 8.5.2, 9.3.1, 10.1.2, 11.0.0-beta.6