electron@44.1.0

electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS.

Affected versions of this package are vulnerable to Out-of-bounds Read via the OnFrameCaptured function in shell/browser/api/frame_subscriber.cc, when processing a captured video frame whose content_rect and coded_size fields are not validated against the actual shared-memory mapping size before pixel data is read. An attacker with code execution in the GPU process can supply a malformed frame layout over Mojo, causing the renderer to read memory outside the shared-memory region and potentially disclose contents or crash the renderer process.

Note: This is only exploitable if the app uses webContents.beginFrameSubscription and an attacker has separately gained code execution in the GPU process.

Upgrade electron to version 45.0.0-alpha.9, 44.4.3, 43.7.3, 42.11.6 or higher.

electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS.

Affected versions of this package are vulnerable to Missing Authorization in TabsQueryFunction::Run in shell/browser/extensions/api/tabs/tabs_api.cc, where the tabs.query API populates the privileged url and title tab properties unconditionally, regardless of whether the calling extension holds the tabs permission or has host access to the tab's origin. An extension without those permissions can call tabs.query to read the URL and title of any open tab, leaking information that should be gated behind the tabs permission or host access. The tabs.get and tabs.update APIs already enforced this check correctly; only tabs.query was missing the guard.

Note: Apps are only affected if they load extensions via session.extensions.loadExtension that they do not fully trust.

Upgrade electron to version 42.11.1, 43.5.1, 44.1.1, 45.0.0-alpha.4 or higher.

electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS.

Affected versions of this package are vulnerable to Origin Validation Error via incorrect attribution of the requesting origin in HandleExternalProtocolInUI when handling openExternal permission requests. When a navigation to an external protocol involves a detached initiator frame or a server-side redirect, the requestingUrl reported to the permission manager is taken from the navigating WebContents' committed URL rather than the actual initiating or redirecting origin. An attacker who controls untrusted content can trigger an openExternal navigation such that the permission check is evaluated against a trusted origin the attacker does not control, bypassing origin-based openExternal restrictions.

Note: Apps are only affected if they grant openExternal based on the requesting origin and allow untrusted content to open or navigate windows.

Upgrade electron to version 45.0.0-alpha.5, 44.3.0, 43.7.0, 42.11.3 or higher.

electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS.

Affected versions of this package are vulnerable to Origin Validation Error via misattribution of pointerLock permission requests from in-process iframes. When a same-site, cross-origin iframe calls Element.requestPointerLock(), the permission request handler receives the local root's URL and isMainFrame value instead of the requesting iframe's, because the request is routed through the widget of the local root rather than the actual requesting frame. An attacker controlling a cross-origin iframe can thereby impersonate the parent frame's origin in the app's setPermissionRequestHandler, bypassing origin-based permission checks for pointer lock.

Note: This is only exploitable if the app embeds untrusted content in iframes and decides pointerLock requests by origin in setPermissionRequestHandler.

Upgrade electron to version 42.11.9, 43.7.6, 44.5.0, 45.0.0-alpha.13 or higher.

electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS.

Affected versions of this package are vulnerable to Out-of-bounds Read via the OnFrameCaptured function in shell/browser/api/frame_subscriber.cc, where a captured video frame's layout metadata (content_rect and coded_size) is not validated against the actual shared memory mapping size before constructing an SkBitmap over it. An attacker with code execution in the GPU process can supply a frame whose content_rect exceeds the bounds of the shared memory region, causing an out-of-bounds read when the bitmap pixels are accessed.

Note: This is only exploitable when the application uses offscreen rendering (webPreferences.offscreen) on macOS and an attacker has separately gained code execution in the GPU process.

Upgrade electron to version 45.0.0-alpha.9, 44.4.3, 43.7.3, 42.11.6 or higher.

electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS.

Affected versions of this package are vulnerable to Cross-site Request Forgery (CSRF) via the OpenURLFromTab handler, which fails to route modifier-click and middle-click link navigations (and target-form-post popups) through the window-open policy. A <webview> tag without allowpopups is supposed to block popup creation, but because these link-triggered navigations bypass the CanCreateWindow check that window.open() already passes through, an attacker-controlled page loaded in such a <webview> can open new windows that should have been blocked. Additionally, the new window starts its navigation from a fresh browser-initiated loadURL rather than from the original OpenURLParams, causing incorrect attribution of the initiator origin, Sec-Fetch-Site, SameSite cookies, and external protocol handling.

Note: This is only exploitable if the application loads untrusted content and allows it to open new windows.

Upgrade electron to version 42.11.3, 43.7.0, 44.3.0, 45.0.0-alpha.6 or higher.

electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS.

Affected versions of this package are vulnerable to Origin Validation Error via ElectronHidDelegate and ElectronUsbDelegate, which performed HID and USB permission checks with a null frame and the top-level document's origin instead of the requesting subframe's origin. When a cross-origin iframe requests a HID or USB device, session.setPermissionCheckHandler receives the top-level origin, no requestingUrl, isMainFrame: false, and a null webContents, causing origin-based permission logic to evaluate the wrong principal. An attacker controlling a cross-origin subframe embedded in a page that grants HID or USB access can bypass the intended per-frame permission check and gain device access that should be denied.

Note: This is only exploitable if setPermissionCheckHandler is used with origin-based logic for hid or usb and cross-origin iframes are embedded with allow="hid" or allow="usb".

Upgrade electron to version 42.11.3, 43.7.0, 44.3.0, 45.0.0-alpha.5 or higher.