electron@32.1.2

electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS.

Affected versions of this package are vulnerable to Exposure of Resource to Wrong Sphere via the window.open() function. An attacker can gain access to or manipulate the browsing context of a window opened by a different renderer by using the same target name, potentially inheriting elevated permissions such as privileged preload scripts or relaxed security settings. This is only exploitable if multiple top-level windows with differing trust levels are opened and setWindowOpenHandler is used to grant elevated webPreferences to child windows.

Upgrade electron to version 39.8.5, 40.8.5, 41.1.0, 42.0.0-alpha.5 or higher.

electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS.

Affected versions of this package are vulnerable to Origin Validation Error in the session.setPermissionRequestHandler function. An attacker can gain unauthorized access to permissions such as fullscreen, pointerLock, keyboardLock, openExternal, or media by embedding malicious iframes that exploit the incorrect origin parameter passed to the handler. This may result in third-party content being granted permissions intended only for trusted origins.

Note:

This is only exploitable if the application grants permissions based on the origin parameter or webContents.getURL() rather than details.requestingUrl.

Upgrade electron to version 38.8.6, 39.8.1, 40.8.1, 41.0.0 or higher.

electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS.

Affected versions of this package are vulnerable to Command Injection in the app.moveToApplicationsFolder function on macOS when handling application bundle paths containing certain characters. An attacker can execute arbitrary AppleScript code by crafting a malicious launch path and convincing a user to accept the move-to-Applications prompt.

Note:

This is only exploitable if the application calls app.moveToApplicationsFolder().

Upgrade electron to version 38.8.6, 39.8.1, 40.8.0, 41.0.0-beta.8 or higher.

electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS.

Affected versions of this package are vulnerable to Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') in the app.setAsDefaultProtocolClient function. An attacker can gain the ability to write to arbitrary registry subkeys by supplying a crafted protocol name derived from untrusted input. This may allow hijacking of existing protocol handlers.

Note:

This is only exploitable if the protocol name passed to app.setAsDefaultProtocolClient is not hardcoded and is instead derived from external or untrusted sources.

Upgrade electron to version 38.8.6, 39.8.1, 40.8.1, 41.0.0 or higher.

electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS.

Affected versions of this package are vulnerable to Use After Free in the powerMonitor function. An attacker can cause memory corruption or application crashes by triggering session-change events on Windows or system shutdown events on macOS after the native object has been garbage-collected, leading to dereferencing of freed memory.

Upgrade electron to version 38.8.6, 39.8.1, 40.8.0, 41.0.0-beta.8 or higher.

electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS.

Affected versions of this package are vulnerable to Use After Free in the download save dialog callback process. An attacker can cause a crash or memory corruption by triggering session destruction while a native save-file dialog is open and then dismissing the dialog.

Note:

This is only exploitable if the application allows downloads and programmatically destroys sessions at runtime.

Upgrade electron to version 38.8.6, 39.8.0, 40.7.0, 41.0.0-beta.7 or higher.

electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS.

Affected versions of this package are vulnerable to Insufficient Verification of Data Authenticity via the webContents.executeJavaScript function. An attacker can manipulate the main-process promise to resolve with attacker-controlled data by spoofing reply messages on the internal IPC channel.

Note:

This is only exploitable if service workers are registered and the result of webContents.executeJavaScript() or webFrameMain.executeJavaScript() is used in security-sensitive decisions.

Upgrade electron to version 38.8.6, 39.8.1, 40.8.1, 41.0.0 or higher.

electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS.

Affected versions of this package are vulnerable to Use After Free via the session.setPermissionRequestHandler process. An attacker can cause a crash or memory corruption by triggering a permission request for fullscreen, pointer-lock, or keyboard-lock, and then navigating the requesting frame or closing the window while the permission handler is pending.

Note:

This is only exploitable if an asynchronous permission request handler is registered and invoked while the request is pending.

Upgrade electron to version 38.8.6, 39.8.0, 40.7.0, 41.0.0-beta.8 or higher.

electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS.

Affected versions of this package are vulnerable to Out-of-bounds Read in the second-instance event handler when parsing a crafted second-instance message via the app.requestSingleInstanceLock process. An attacker can access sensitive memory contents or cause application instability by sending a specially crafted message from another process running as the same user.

Note:

This is only exploitable if the application calls app.requestSingleInstanceLock() and is running on macOS or Linux as the same user.

Upgrade electron to version 38.8.6, 39.8.1, 40.8.1, 41.0.0 or higher.

electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS.

Affected versions of this package are vulnerable to Improper Isolation or Compartmentalization in the handling of the nodeIntegrationInWorker configuration in shared renderer processes. An attacker can gain unauthorized access to Node.js integration by exploiting process-sharing scenarios where workers in frames configured with nodeIntegrationInWorker: false still receive Node.js integration.

Note:

This is only exploitable if nodeIntegrationInWorker is enabled in applications that also open child windows or embed content with differing webPreferences.

Upgrade electron to version 38.8.6, 39.8.4, 40.8.4, 41.0.0 or higher.

electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS.

Affected versions of this package are vulnerable to Unquoted Search Path or Element in the app.setLoginItemSettings function on Windows when the executable path is written to the Run registry key without proper quoting. An attacker can execute arbitrary code at login by placing a malicious executable in an ancestor directory if the application is installed to a path containing spaces and the attacker has write access to that directory.

Note:

This is only exploitable if the application is installed in a non-standard location where ancestor directories are not protected against unauthorized writes.

Upgrade electron to version 38.8.6, 39.8.1, 40.8.0, 41.0.0-beta.8 or higher.

electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS.

Affected versions of this package are vulnerable to Missing Authorization in the select-usb-device event callback, which did not validate the chosen device ID against the filtered list presented to the handler. An attacker can gain unauthorized access to USB devices that do not match the intended filters or are listed in exclusion filters by influencing the handler to select a device ID outside the allowed set.

Note:

This is only exploitable if the application implements unusual device-selection logic that can be manipulated.

Upgrade electron to version 38.8.6, 39.8.0, 40.7.0, 41.0.0-beta.8 or higher.

electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS.

Affected versions of this package are vulnerable to HTTP Response Splitting via the protocol.handle, protocol.registerSchemesAsPrivileged, or webRequest.onHeadersReceived functions. An attacker can manipulate HTTP response headers by injecting attacker-controlled input into a response header name or value, potentially allowing the setting of arbitrary headers that affect cookies, content security policy, or cross-origin access controls.

Note:

This is only exploitable if untrusted external input is reflected into response headers.

Upgrade electron to version 38.8.6, 39.8.3, 40.8.3, 41.0.3 or higher.

electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS.

Affected versions of this package are vulnerable to Use After Free in the offscreen rendering process when a parent WebContents is destroyed while a child window remains open. An attacker can cause memory corruption or application crash by triggering paint frames on the child window that dereference freed memory.

Note:

This is only exploitable if offscreen rendering is enabled (webPreferences.offscreen: true) and the setWindowOpenHandler permits child windows.

Upgrade electron to version 39.8.1, 40.7.0, 41.0.0 or higher.

electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS.

Affected versions of this package are vulnerable to Hidden Functionality via the commandLineSwitches webPreference. An attacker can inject arbitrary command-line switches into the renderer process by supplying untrusted configuration objects, potentially disabling security controls or sandboxing.

Note:

This is only exploitable if external or untrusted input is used to construct webPreferences without an explicit allowlist.

Upgrade electron to version 38.8.6, 39.8.0, 40.7.0, 41.0.0-beta.8 or higher.

electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS.

Affected versions of this package are vulnerable to Arbitrary Code Injection via modification of the resources folder when the embeddedAsarIntegrityValidation and onlyLoadAppFromAsar fuses are enabled. An attacker can execute unauthorized code by altering files within the application directory, bypassing ASAR integrity checks.

Note: This is only exploitable if the application is launched from a filesystem to which the attacker has write access.

Upgrade electron to version 35.7.5, 36.8.1, 37.3.1, 38.0.0-beta.6 or higher.

electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS.

Affected versions of this package are vulnerable to Use After Free via MediaStreamTrackImpl. An attacker can cause heap corruption by enticing a user to visit a specially crafted HTML page.

Upgrade electron to version 37.2.6 or higher.

electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS.

Affected versions of this package are vulnerable to Access of Resource Using Incompatible Type ('Type Confusion') via the lack of limitation on max inlining ids in MaglevGraphBuilder. An attacker can achieve heap corruption and potentially execute arbitrary code by enticing a user to visit a specially crafted HTML page.

Upgrade electron to version 37.2.5 or higher.

electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS.

Affected versions of this package are vulnerable to Access of Resource Using Incompatible Type ('Type Confusion') via lack of support for escapes in PreParserIdentifier V8` process. An attacker can achieve heap corruption by enticing a user to visit a specially crafted HTML page.

Upgrade electron to version 37.2.5 or higher.

electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS.

Affected versions of this package are vulnerable to Use After Free via improper handling of possible socket destruction in P2PSocketTcpBase. An attacker can achieve heap corruption and potentially execute arbitrary code by enticing a user to visit a specially crafted HTML page.

Upgrade electron to version 37.2.4 or higher.

electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS.

Affected versions of this package are vulnerable to Integer Overflow or Wraparound via an incorrect count being passed to InstructionAccurateScope in the V8 engine. An attacker can cause heap corruption by enticing a user to visit a specially crafted HTML page.

Upgrade electron to version 37.2.4 or higher.

electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS.

Affected versions of this package are vulnerable to Incorrect Calculation of Buffer Size via insufficient validation of untrusted input in ANGLE and GPU. An attacker can escape the sandbox by submitting a specially crafted HTML page.

Upgrade electron to version 37.2.4 or higher.

electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS.

Affected versions of this package are vulnerable to Function Call with Incorrectly Specified Arguments via an incorrect handle provided in unspecified circumstances in Mojo. An attacker can reflect a broker-initiated transport back to a broker, which ultimately allows for handle leaks if the reflected transport is later used to deserialize another transport containing handles.

Upgrade electron to version 36.3.0 or higher.

electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS.

Affected versions of this package are vulnerable to Information Exposure via the Loader component. An attacker can leak sensitive cross-origin data by crafting a malicious HTML page.

Upgrade electron to version 36.3.0 or higher.

electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS.

Affected versions of this package are vulnerable to Improper Isolation or Compartmentalization that allows an attacker who can convince a user to follow a malicious link to escape sandbox protections, due to a logic error in the Mojo component. This vulnerability does not enable code execution on its own, but is presumed chainable with another vulnerability to achieve code execution and has been observed in the wild.

Note: This vulnerability is only exploitable on Windows.

Upgrade electron to version 33.4.8, 34.4.1, 35.1.2 or higher.

electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS.

Affected versions of this package are vulnerable to Access of Resource Using Incompatible Type ('Type Confusion') in v8.

Upgrade electron to version 33.4.6, 34.3.4 or higher.

electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS.

Affected versions of this package are vulnerable to Use After Free through the V8 engine.

Upgrade electron to version 32.3.3, 33.4.3 or higher.

electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS.

Affected versions of this package are vulnerable to Heap-based Buffer Overflow in v8, when processing a very large number of parameters.

Upgrade electron to version 32.3.2, 33.4.2 or higher.

electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS.

Affected versions of this package are vulnerable to Use After Free through the V8 engine. An attacker can potentially exploit heap corruption by crafting a malicious HTML page.

Upgrade electron to version 33.4.3 or higher.

electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS.

Affected versions of this package are vulnerable to Out-of-bounds Write through crafted HTML pages. An attacker can exploit heap corruption by sending a specially crafted HTML page to the victim.

Upgrade electron to version 32.3.2, 33.4.2 or higher.

electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS.

Affected versions of this package are vulnerable to Out-of-bounds Write via a crafted HTML page. An attacker can potentially exploit heap corruption by sending a specially crafted HTML page to the victim.

Upgrade electron to version 32.3.2, 33.4.2 or higher.

electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS.

Affected versions of this package are vulnerable to External Control of Assumed-Immutable Web Parameter due to an integer overflow in the Skia component.

Upgrade electron to version 32.3.0, 33.3.2 or higher.

electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS.

Affected versions of this package are vulnerable to Out-of-bounds Read through the Metrics process.

Upgrade electron to version 32.3.0, 33.3.2 or higher.

electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS.

Affected versions of this package are vulnerable to Out-of-bounds Write in V8.

Upgrade electron to version 32.3.0, 33.3.2 or higher.

electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS.

Affected versions of this package are vulnerable to Out-of-bounds Write through a crafted HTML page. An attacker can execute arbitrary code inside a sandbox by crafting malicious HTML content.

Upgrade electron to version 32.3.0 or higher.

electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS.

Affected versions of this package are vulnerable to Access of Resource Using Incompatible Type ('Type Confusion') via a crafted HTML page. An attacker can potentially exploit object corruption by manipulating the HTML content.

Upgrade electron to version 31.7.7, 32.2.8 or higher.

electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS.

Affected versions of this package are vulnerable to Access Restriction Bypass due to an inappropriate implementation in the Extensions feature. An attacker can bypass site isolation.

Upgrade electron to version 31.7.5, 32.2.5, 33.2.1 or higher.

electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS.

Affected versions of this package are vulnerable to Use After Free via the Serial process. An attacker can potentially exploit heap corruption.

Upgrade electron to version 31.7.5, 32.2.5 or higher.

electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS.

Affected versions of this package are vulnerable to Access of Resource Using Incompatible Type ('Type Confusion') via a crafted HTML page. An attacker can potentially exploit heap corruption.

Upgrade electron to version 32.2.3 or higher.

electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS.

Affected versions of this package are vulnerable to Improper Access Control due to an inappropriate implementation in Extensions. An attacker can bypass site isolation.

Upgrade electron to version 31.7.4, 32.2.3 or higher.

electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS.

Affected versions of this package are vulnerable to Access of Resource Using Incompatible Type ('Type Confusion') via a crafted HTML page. An attacker can potentially exploit heap corruption.

Upgrade electron to version 31.7.4, 32.2.3 or higher.

electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS.

Affected versions of this package are vulnerable to Out-of-bounds Write in Dawn.

Upgrade electron to version 31.7.4, 32.2.3 or higher.