electron 44.4.2

Direct Vulnerabilities

Known vulnerabilities in the electron package. This does not include vulnerabilities belonging to this package’s dependencies.

Fix vulnerabilities automatically

Snyk's AI Trust Platform automatically finds the best upgrade path and integrates with your development workflows. Secure your code at zero cost.

Fix for free

Vulnerability	Vulnerable Version
C Improper Check for Certificate Revocation electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS. Affected versions of this package are vulnerable to Improper Check for Certificate Revocation via the Node.js TLS stack in the main and utility processes, which lacked an equivalent of Chromium's compiled-in SubjectPublicKeyInfo (SPKI) blocklist. A certificate chain containing a blocked SPKI hash that would be rejected in a renderer process is accepted by Node's `tls`, `https`, and `fetch` APIs, allowing a MitM attacker to present a chain built on a revoked or distrusted public key and have it verified successfully. How to fix Improper Check for Certificate Revocation? Upgrade `electron` to version 42.11.16, 43.8.1, 44.9.1, 45.0.0-beta.6 or higher.	<42.11.16>=43.0.0-alpha.1 <43.8.1>=44.0.0-alpha.1 <44.9.1>=45.0.0-alpha.1 <45.0.0-beta.6
L Out-of-bounds Read electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS. Affected versions of this package are vulnerable to Out-of-bounds Read via the `OnFrameCaptured` function in `shell/browser/api/frame_subscriber.cc`, when processing a captured video frame whose `content_rect` and `coded_size` fields are not validated against the actual shared-memory mapping size before pixel data is read. An attacker with code execution in the GPU process can supply a malformed frame layout over Mojo, causing the renderer to read memory outside the shared-memory region and potentially disclose contents or crash the renderer process. Note: This is only exploitable if the app uses `webContents.beginFrameSubscription` and an attacker has separately gained code execution in the GPU process. How to fix Out-of-bounds Read? Upgrade `electron` to version 45.0.0-alpha.9, 44.4.3, 43.7.3, 42.11.6 or higher.	>=45.0.0-alpha.1 <45.0.0-alpha.9>=44.0.0-alpha.1 <44.4.3>=43.0.0-alpha.1 <43.7.3<42.11.6
M Origin Validation Error electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS. Affected versions of this package are vulnerable to Origin Validation Error via misattribution of `pointerLock` permission requests from in-process iframes. When a same-site, cross-origin iframe calls `Element.requestPointerLock()`, the permission request handler receives the local root's URL and `isMainFrame` value instead of the requesting iframe's, because the request is routed through the widget of the local root rather than the actual requesting frame. An attacker controlling a cross-origin iframe can thereby impersonate the parent frame's origin in the app's `setPermissionRequestHandler`, bypassing origin-based permission checks for pointer lock. Note: This is only exploitable if the app embeds untrusted content in iframes and decides `pointerLock` requests by origin in `setPermissionRequestHandler`. How to fix Origin Validation Error? Upgrade `electron` to version 42.11.9, 43.7.6, 44.5.0, 45.0.0-alpha.13 or higher.	<42.11.9>=43.0.0-alpha.1 <43.7.6>=44.0.0-alpha.1 <44.5.0>=45.0.0-alpha.1 <45.0.0-alpha.13
L Out-of-bounds Read electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS. Affected versions of this package are vulnerable to Out-of-bounds Read via the `OnFrameCaptured` function in `shell/browser/api/frame_subscriber.cc`, where a captured video frame's layout metadata (`content_rect` and `coded_size`) is not validated against the actual shared memory mapping size before constructing an `SkBitmap` over it. An attacker with code execution in the GPU process can supply a frame whose `content_rect` exceeds the bounds of the shared memory region, causing an out-of-bounds read when the bitmap pixels are accessed. Note: This is only exploitable when the application uses offscreen rendering (`webPreferences.offscreen`) on macOS and an attacker has separately gained code execution in the GPU process. How to fix Out-of-bounds Read? Upgrade `electron` to version 45.0.0-alpha.9, 44.4.3, 43.7.3, 42.11.6 or higher.	>=45.0.0-alpha.1 <45.0.0-alpha.9>=44.0.0-alpha.1 <44.4.3>=43.0.0-alpha.1 <43.7.3<42.11.6
H Origin Validation Error electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS. Affected versions of this package are vulnerable to Origin Validation Error via the `OpenURLFromTab` navigation path, when a sandboxed iframe with `allow-popups` but without `allow-popups-to-escape-sandbox` opens a new window. The initiating frame's sandbox restrictions are not resolved on this code path because `params.frame_tree_node_id` is unset for non-`CURRENT_TAB` dispositions, causing the sandbox check to never run. As a result, the newly created window receives full origin authority instead of inheriting the opener frame's sandbox flags, allowing a sandboxed frame to escape its confinement. Note: This is only exploitable if the app embeds untrusted content in iframes sandboxed with `allow-scripts allow-popups`. How to fix Origin Validation Error? Upgrade `electron` to version 41.10.4, 43.0.0, 42.5.2, 45.0.0-alpha.10 or higher.	<41.10.4>=43.0.0-alpha.1 <43.0.0>=42.0.0-alpha.1 <42.5.2>=44.0.0-alpha.1 <45.0.0-alpha.10

Vulnerability

Vulnerable Version

Improper Check for Certificate Revocation

electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS.

Affected versions of this package are vulnerable to Improper Check for Certificate Revocation via the Node.js TLS stack in the main and utility processes, which lacked an equivalent of Chromium's compiled-in SubjectPublicKeyInfo (SPKI) blocklist. A certificate chain containing a blocked SPKI hash that would be rejected in a renderer process is accepted by Node's tls, https, and fetch APIs, allowing a MitM attacker to present a chain built on a revoked or distrusted public key and have it verified successfully.

How to fix Improper Check for Certificate Revocation?

Upgrade electron to version 42.11.16, 43.8.1, 44.9.1, 45.0.0-beta.6 or higher.

<42.11.16>=43.0.0-alpha.1 <43.8.1>=44.0.0-alpha.1 <44.9.1>=45.0.0-alpha.1 <45.0.0-beta.6

Out-of-bounds Read

electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS.

Affected versions of this package are vulnerable to Out-of-bounds Read via the OnFrameCaptured function in shell/browser/api/frame_subscriber.cc, when processing a captured video frame whose content_rect and coded_size fields are not validated against the actual shared-memory mapping size before pixel data is read. An attacker with code execution in the GPU process can supply a malformed frame layout over Mojo, causing the renderer to read memory outside the shared-memory region and potentially disclose contents or crash the renderer process.

Note: This is only exploitable if the app uses webContents.beginFrameSubscription and an attacker has separately gained code execution in the GPU process.

How to fix Out-of-bounds Read?

Upgrade electron to version 45.0.0-alpha.9, 44.4.3, 43.7.3, 42.11.6 or higher.

>=45.0.0-alpha.1 <45.0.0-alpha.9>=44.0.0-alpha.1 <44.4.3>=43.0.0-alpha.1 <43.7.3<42.11.6

Origin Validation Error

electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS.

Affected versions of this package are vulnerable to Origin Validation Error via misattribution of pointerLock permission requests from in-process iframes. When a same-site, cross-origin iframe calls Element.requestPointerLock(), the permission request handler receives the local root's URL and isMainFrame value instead of the requesting iframe's, because the request is routed through the widget of the local root rather than the actual requesting frame. An attacker controlling a cross-origin iframe can thereby impersonate the parent frame's origin in the app's setPermissionRequestHandler, bypassing origin-based permission checks for pointer lock.

Note: This is only exploitable if the app embeds untrusted content in iframes and decides pointerLock requests by origin in setPermissionRequestHandler.

How to fix Origin Validation Error?

Upgrade electron to version 42.11.9, 43.7.6, 44.5.0, 45.0.0-alpha.13 or higher.

<42.11.9>=43.0.0-alpha.1 <43.7.6>=44.0.0-alpha.1 <44.5.0>=45.0.0-alpha.1 <45.0.0-alpha.13

Out-of-bounds Read

electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS.

Affected versions of this package are vulnerable to Out-of-bounds Read via the OnFrameCaptured function in shell/browser/api/frame_subscriber.cc, where a captured video frame's layout metadata (content_rect and coded_size) is not validated against the actual shared memory mapping size before constructing an SkBitmap over it. An attacker with code execution in the GPU process can supply a frame whose content_rect exceeds the bounds of the shared memory region, causing an out-of-bounds read when the bitmap pixels are accessed.

Note: This is only exploitable when the application uses offscreen rendering (webPreferences.offscreen) on macOS and an attacker has separately gained code execution in the GPU process.

How to fix Out-of-bounds Read?

Upgrade electron to version 45.0.0-alpha.9, 44.4.3, 43.7.3, 42.11.6 or higher.

>=45.0.0-alpha.1 <45.0.0-alpha.9>=44.0.0-alpha.1 <44.4.3>=43.0.0-alpha.1 <43.7.3<42.11.6

Origin Validation Error

electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS.

Affected versions of this package are vulnerable to Origin Validation Error via the OpenURLFromTab navigation path, when a sandboxed iframe with allow-popups but without allow-popups-to-escape-sandbox opens a new window. The initiating frame's sandbox restrictions are not resolved on this code path because params.frame_tree_node_id is unset for non-CURRENT_TAB dispositions, causing the sandbox check to never run. As a result, the newly created window receives full origin authority instead of inheriting the opener frame's sandbox flags, allowing a sandboxed frame to escape its confinement.

Note: This is only exploitable if the app embeds untrusted content in iframes sandboxed with allow-scripts allow-popups.

How to fix Origin Validation Error?

Upgrade electron to version 41.10.4, 43.0.0, 42.5.2, 45.0.0-alpha.10 or higher.

<41.10.4>=43.0.0-alpha.1 <43.0.0>=42.0.0-alpha.1 <42.5.2>=44.0.0-alpha.1 <45.0.0-alpha.10

electron@44.4.2

Build cross platform desktop apps with JavaScript, HTML, and CSS

latest version

latest non vulnerable version

first published

latest version published

licenses detected

Direct Vulnerabilities

Fix vulnerabilities automatically