Executive brief
Electron is a framework used to build cross-platform desktop applications using web technologies. When an application uses context isolation and context bridge features, code running in the main renderer context can bypass security boundaries and access privileged functionality through malformed object returns or exception handling in exposed APIs. This could allow a local attacker to escalate privileges or access sensitive data within the application.
Technical details
This is a context isolation bypass vulnerability in Electron's contextBridge mechanism. The vulnerability occurs when APIs exposed via contextBridge return objects or arrays containing unserializable JavaScript objects (such as canvas rendering contexts), or when return values throw user-generated exceptions during serialization. Normally these conditions throw an "object could not be cloned" error; however, the improper error handling allows code in the main renderer context to reach into the isolated Electron context and perform privileged actions. The attack requires that an application exposes vulnerable APIs through contextBridge and does not properly validate all return values. Patches are available in versions 22.3.6, 23.2.3, 24.0.1, and 25.0.0-alpha.2 and later.
Affected products
- OpenJS Foundation Electron < 22.3.6, >= 23.0.0-alpha.1 < 23.2.3, >= 24.0.0-alpha.1 < 24.0.1, >= 25.0.0-alpha.1 < 25.0.0-alpha.2
Timeline
- 2023-09-06: disclosed
- 2023-09-06: patched: Patches released for versions 22.3.6, 23.2.3, 24.0.1, and 25.0.0-alpha.2