Electronjs Electron

Context isolation bypass via contextBridge in Electron

Based on details posted by the ElectronJS team; A remote code execution vulnerability has been discovered in Google Chromium that affects all recent versions of Electron. Any Electron app that accesses remote content is vulnerable to this exploit, regardless of whether the [sandbox option](https://electron.atom.io/docs/api/sandbox-option) is enabled.

Exposure of Resource to Wrong Sphere in Electron

Content-Secrity-Policy disabling eval not applied consistently in renderers with sandbox disabled in Electron

Electron: nodeIntegrationInWorker not correctly scoped in shared renderer processes

Github Electron version Electron 1.8.2-beta.4 and earlier contains a Command Injection vulnerability in Protocol Handler that can result in command execute. This attack appear to be exploitable via the victim opening an electron protocol handler in their browser. This vulnerability appears to have been fixed in Electron 1.8.2-beta.5. This issue is due to an incomplete fix for CVE-2018-1000006, specifically the black list used was not case insensitive allowing an attacker to potentially bypass it.

Context isolation bypass via leaked cross-context objects in Electron

Electron: Renderer command-line switch injection via undocumented commandLineSwitches webPreference

Electron: Use-after-free in WebContents fullscreen, pointer-lock, and keyboard-lock permission callbacks

Electron named window.open targets not scoped to the opener's browsing context

Electron: Use-after-free in PowerMonitor on Windows and macOS

Electron: Use-after-free in download save dialog callback

Sandboxed renderers can obtain thumbnails of arbitrary files through the nativeImage API

Context isolation bypass via nested unserializable return value in Electron

Electron: Context Isolation bypass via contextBridge VideoFrame transfer

GitHub Electron 1.7.15, 1.8.7, 2.0.7, and 3.0.0-beta.6, in certain scenarios involving IFRAME elements and "nativeWindowOpen: true" or "sandbox: true" options, is affected by a WebPreferences vulnerability that can be leveraged to perform remote code execution.

Electron version 1.7 up to 1.7.12; 1.8 up to 1.8.3 and 2.0.0 up to 2.0.0-beta.3 contains an improper handling of values vulnerability in Webviews that can result in remote code execution. This attack appear to be exploitable via an app which allows execution of 3rd party code AND disallows node integration AND has not specified if webview is enabled/disabled. This vulnerability appears to have been fixed in 1.7.13, 1.8.4, 2.0.0-beta.4.

Electron: Use-after-free in offscreen child window paint callback

Electron: AppleScript injection in app.moveToApplicationsFolder on macOS

Electron: Unquoted executable path in app.setLoginItemSettings on Windows

Unpreventable top-level navigation in Electron

Arbitrary file read via window-open IPC in Electron

Electron: Registry key path injection in app.setAsDefaultProtocolClient on Windows

Electron's AutoUpdater module fails to validate certain nested components of the bundle

Electron subject to Exfiltration of hashed SMB credentials on Windows via file:// redirect

ASAR Integrity bypass via filetype confusion in electron

Context isolation bypass via Promise in Electron

Context isolation bypass in Electron

Electron: Out-of-package code execution when launched with arbitrary cwd

Electron vulnerable to ID collision when routing IPC messages to renderers containing OOPIFs

Electron: HTTP Response Header Injection in custom protocol handlers and webRequest

Electron: Service worker can spoof executeJavaScript IPC replies

Electron has a use-after-free in offscreen shared texture release() callback

Electron: USB device selection not validated against filtered device list

Electron: Incorrect origin passed to permission request handler for iframe requests

Electron: Out-of-bounds read in second-instance IPC on macOS and Linux

Renderers can obtain access to random bluetooth device without permission in Electron

Electron crashes in clipboard.readImage() on malformed clipboard image data