Executive brief
Electron is a framework for building cross-platform desktop applications using web technologies. Applications using Electron's context isolation feature—a security boundary designed to prevent untrusted renderer code from accessing privileged APIs—are vulnerable to a bypass that allows malicious script to reach into the isolated context and execute privileged operations. This could result in complete compromise of the application and access to sensitive data.
Technical details
This vulnerability is a context isolation bypass (CWE-501) in Electron that allows code running in the main world context of the renderer process to leak cross-context objects and reach into the isolated Electron context. The root cause is improper handling of object references across security boundaries; an attacker can exploit leaked objects to perform privileged actions normally restricted to the isolated context. The attack is local to the renderer process and does not require user interaction or elevated privileges. Apps using contextIsolation (a key security feature) are affected. Patches are available in Electron 7.2.4, 8.2.4, and 9.0.0-beta.21; all earlier versions are vulnerable.
Affected products
- Electron Electron 7.x before 7.2.4, 8.0.0 through 8.2.3, 9.0.0-beta.0 through 9.0.0-beta.20
Timeline
- 2020-07-07: disclosed: Advisory published
- 2020-07-07: patched: Patches released for versions 7.2.4, 8.2.4, and 9.0.0-beta.21