Executive brief
Electron is a framework used to build cross-platform desktop applications with web technologies. Apps that use both context isolation and the contextBridge feature are vulnerable to a bypass that allows untrusted renderer code to access privileged Electron APIs. An attacker with code execution in the renderer process can exploit this to perform actions normally restricted to the main process, potentially leading to unauthorized access to sensitive data or system resources.
Technical details
This is a context isolation bypass vulnerability affecting Electron versions that support both contextIsolation and contextBridge. The vulnerability allows code running in the main world context of the renderer process to escape isolation boundaries and reach into the privileged Electron context, enabling execution of restricted operations. The flaw affects all versions before 7.2.4, versions 8.0.0 through 8.2.3, and beta versions of 9.0.0 up to 9.0.0-beta.20. The attack requires code execution in the renderer process but no user interaction or authentication. Fixes are available in versions 7.2.4, 8.2.4, and 9.0.0-beta.21 or later, and apps must update their Electron dependency to be protected.
Affected products
- OpenJS Foundation Electron <7.2.4, 8.0.0-8.2.3, 9.0.0-beta.0 to 9.0.0-beta.20
Timeline
- 2020-07-07: disclosed
- 2020-07-07: patched: Patches released for versions 7.2.4, 8.2.4, and 9.0.0-beta.21