Executive brief
Electron is a framework used to build desktop applications. A compromised renderer process in an Electron application could gain unauthorized access to inter-process communication (IPC) channels even when the nodeIntegrationInSubFrames setting was disabled. This could allow an attacker to send privileged IPC messages and potentially compromise sensitive application data or functionality.
Technical details
This vulnerability is a privilege escalation in Electron's renderer process isolation. A compromised child renderer process with JavaScript execution capability could create or obtain access to a new renderer process with nodeIntegrationInSubFrames enabled, gaining effective access to ipcRenderer without the protection the parent intended. The attack requires an initial compromised renderer (e.g., via XSS or similar JS execution vulnerability) and depends on the target application exposing IPC message handlers that lack proper senderFrame validation. The vulnerability affects Electron versions before 15.5.5, 16.0.0-16.2.5, 17.0.0-17.1.x, and 18.0.0-beta.1 through beta.5. Patches are available in Electron 15.5.5, 16.2.6, 17.2.0, and 18.0.0-beta.6 or later.
Affected products
- OpenJS Foundation Electron < 15.5.5, >= 16.0.0-beta.1 < 16.2.6, >= 17.0.0-beta.1 < 17.2.0, >= 18.0.0-beta.1 < 18.0.0-beta.6
Timeline
- 2022-06-13: disclosed
- 2022-06-13: patched: Patches released in versions 15.5.5, 16.2.6, 17.2.0, 18.0.0-beta.6