Homepage
About Snyk

electron@28.2.6 vulnerabilities

Build cross platform desktop apps with JavaScript, HTML, and CSS

Go back to all versions of this package
Report a new vulnerability Found a mistake?

Direct Vulnerabilities

Known vulnerabilities in the electron package. This does not include vulnerabilities belonging to this package’s dependencies.

Automatically find and fix vulnerabilities affecting your projects. Snyk scans for vulnerabilities and provides fixes for free.
Fix for free
Vulnerability Vulnerable Version
  • H
Out-of-Bounds

electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS.

Affected versions of this package are vulnerable to Out-of-Bounds memory access in V8 component. This vulnerability allowed a remote attacker to perform arbitrary read/write via a crafted HTML page.

How to fix Out-of-Bounds?

Upgrade electron to version 27.3.10, 28.3.0 or higher.

<27.3.10 >=28.0.0 <28.3.0
  • M
Integer Overflow or Wraparound

electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS.

Affected versions of this package are vulnerable to Integer Overflow or Wraparound when decoding videos with a large frame size. An attacker can cause memory corruption within the AV1 decoder by providing a specially crafted video file.

How to fix Integer Overflow or Wraparound?

Upgrade electron to version 27.3.11, 28.3.1 or higher.

<27.3.11 >=28.0.0 <28.3.1
  • H
Out-of-bounds Write

electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS.

Affected versions of this package are vulnerable to Out-of-bounds Write in the Compositing process. An attacker can potentially perform a sandbox escape by exploiting specific UI gestures. This is only exploitable if the attacker has already compromised the GPU process.

How to fix Out-of-bounds Write?

Upgrade electron to version 27.3.11, 28.3.1, 29.3.1 or higher.

<27.3.11 >=28.0.0 <28.3.1 >=29.0.0 <29.3.1
  • H
Heap-based Buffer Overflow

electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS.

Affected versions of this package are vulnerable to Heap-based Buffer Overflow in the ANGLE component. An attacker can potentially exploit heap corruption through a crafted HTML page.

How to fix Heap-based Buffer Overflow?

Upgrade electron to version 27.3.11, 28.3.1, 29.3.1 or higher.

<27.3.11 >=28.0.0 <28.3.1 >=29.0.0 <29.3.1
  • H
Use After Free

electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS.

Affected versions of this package are vulnerable to Use After Free due to improper handling of objects in memory in the Dawn component. An attacker can cause heap corruption and potentially execute arbitrary code by convincing a user to visit a specially crafted HTML page.

How to fix Use After Free?

Upgrade electron to version 27.3.11, 28.3.1, 29.3.1 or higher.

<27.3.11 >=28.0.0 <28.3.1 >=29.0.0 <29.3.1
  • H
Improper Restriction of Operations within the Bounds of a Memory Buffer

electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS.

Affected versions of this package are vulnerable to Improper Restriction of Operations within the Bounds of a Memory Buffer due to an inappropriate implementation in the V8 engine. An attacker can potentially perform out of bounds memory access by crafting a malicious HTML page.

How to fix Improper Restriction of Operations within the Bounds of a Memory Buffer?

Upgrade electron to version 29.3.0 or higher.

<29.3.0
  • H
Use After Free

electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS.

Affected versions of this package are vulnerable to Use After Free due to improper handling in the WebCodecs component. An attacker can achieve arbitrary read/write access by crafting a malicious HTML page.

How to fix Use After Free?

Upgrade electron to version 27.3.9, 28.2.10, 29.2.0 or higher.

<27.3.9 >=28.0.0-alpha.1 <28.2.10 >=29.0.0-alpha.1 <29.2.0
  • C
Type Confusion

electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS.

Affected versions of this package are vulnerable to Type Confusion due to a flaw in the WebAssembly component. An attacker can execute arbitrary code on the victim's machine by convincing them to visit a maliciously crafted HTML page.

How to fix Type Confusion?

Upgrade electron to version 27.3.9, 28.2.10, 29.2.0 or higher.

<27.3.9 >=28.0.0-alpha.1 <28.2.10 >=29.0.0-alpha.1 <29.2.0
  • C
Use After Free

electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS.

Affected versions of this package are vulnerable to Use After Free due to improper handling of objects in memory in the ANGLE graphics engine. An attacker can cause heap corruption and potentially execute arbitrary code by convincing a user to visit a specially crafted HTML page.

How to fix Use After Free?

Upgrade electron to version 27.3.9, 28.2.10, 29.2.0 or higher.

<27.3.9 >=28.0.0-alpha.1 <28.2.10 >=29.0.0-alpha.1 <29.2.0
  • H
Use After Free

electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS.

Affected versions of this package are vulnerable to Use After Free due to the improper handling of objects in memory in the Dawn component. An attacker can potentially exploit heap corruption through a crafted HTML page.

How to fix Use After Free?

Upgrade electron to version 27.3.9, 28.2.10, 29.2.0 or higher.

<27.3.9 >=28.0.0-alpha.1 <28.2.10 >=29.0.0-alpha.1 <29.2.0
  • H
NULL Pointer Dereference

electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS.

Affected versions of this package are vulnerable to NULL Pointer Dereference in V8, due to an object lifecycle issue involving scope inheritance.

How to fix NULL Pointer Dereference?

Upgrade electron to version 27.3.8, 28.2.9, 29.1.6 or higher.

<27.3.8 >=28.0.0 <28.2.9 >=29.0.0 <29.1.6
  • H
Denial of Service (DoS)

electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS.

Affected versions of this package are vulnerable to Denial of Service (DoS) via an Out of bounds memory access in V8.

How to fix Denial of Service (DoS)?

Upgrade electron to version 27.3.6, 28.2.7, 29.1.2 or higher.

<27.3.6 >=28.0.0-alpha.1 <28.2.7 >=29.0.0-alpha.1 <29.1.2
Go back to all versions of this package