Vulnerability	Vulnerable Version
M Improper Restriction of Rendered UI Layers or Frames electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS. Affected versions of this package are vulnerable to Improper Restriction of Rendered UI Layers or Frames in the `OpenURL` navigation path, which allows a sandboxed iframe without the `allow-popups` keyword to open a new window or trigger `setWindowOpenHandler` without user interaction. An attacker can circumvent intended popup restrictions by embedding untrusted content in a sandboxed iframe and leveraging this navigation path. Note: This is only exploitable if applications rely solely on the absence of `allow-popups` in the iframe sandbox to prevent window creation. How to fix Improper Restriction of Rendered UI Layers or Frames? Upgrade `electron` to version 39.8.10, 41.10.3, 42.0.1 or higher.	<39.8.10>=40.0.0-alpha.2 <41.10.3>=42.0.0-alpha.1 <42.0.1

Improper Restriction of Rendered UI Layers or Frames

electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS.

Affected versions of this package are vulnerable to Improper Restriction of Rendered UI Layers or Frames in the OpenURL navigation path, which allows a sandboxed iframe without the allow-popups keyword to open a new window or trigger setWindowOpenHandler without user interaction. An attacker can circumvent intended popup restrictions by embedding untrusted content in a sandboxed iframe and leveraging this navigation path.

Note: This is only exploitable if applications rely solely on the absence of allow-popups in the iframe sandbox to prevent window creation.

How to fix Improper Restriction of Rendered UI Layers or Frames?

Upgrade electron to version 39.8.10, 41.10.3, 42.0.1 or higher.

<39.8.10>=40.0.0-alpha.2 <41.10.3>=42.0.0-alpha.1 <42.0.1

Go back to all versions of this package