CVE-2020-15215

EUVD-2020-1409 · Published Oct 6, 2020

Context isolation bypass in Electron

Impact

Apps using both contextIsolation and sandbox: true are affected.
Apps using both contextIsolation and nativeWindowOpen: true are affected.

This is a context isolation bypass, meaning that code running in the main world context in the renderer can reach into the isolated Electron context and perform privileged actions.

Workarounds

There are no app-side workarounds, you must update your Electron version to be protected.

Fixed Versions

11.0.0-beta.6
10.1.2
9.3.1
8.5.2

For more information

If you have any questions or comments about this advisory:

Email us at security@electronjs.org

Technologies

Electronjs ElectronElectron Electron

Weaknesses

CWE-668CWE-693

CVSS scores

v3.15.6CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L

MITRE ATT&CK

Inferred

Where this vulnerability fits in an attack

ReconImpact

Initial Access Execution Privilege Escalation Stealth Credential Access Discovery Impact

T1190Exploit Public-Facing Application T1040Network Sniffing T1083File and Directory Discovery T1565.002Transmitted Data Manipulation T1574.005Executable Installer File Permissions Weakness T1574.010Services File Permissions Weakness T1611Escape to Host

References

Potentially impacted assets

See if this affects your attack surface