Electronjs Electron

Context isolation bypass via contextBridge in Electron

Based on details posted by the ElectronJS team; A remote code execution vulnerability has been discovered in Google Chromium that affects all recent versions of Electron. Any Electron app that accesses remote content is vulnerable to this exploit, regardless of whether the [sandbox option](https://electron.atom.io/docs/api/sandbox-option) is enabled.

Exposure of Resource to Wrong Sphere in Electron

Content-Secrity-Policy disabling eval not applied consistently in renderers with sandbox disabled in Electron

Electron: <webview> can enable Node.js integration in Web Workers despite embedder restrictions

Electron: nodeIntegrationInWorker not correctly scoped in shared renderer processes

Github Electron version Electron 1.8.2-beta.4 and earlier contains a Command Injection vulnerability in Protocol Handler that can result in command execute. This attack appear to be exploitable via the victim opening an electron protocol handler in their browser. This vulnerability appears to have been fixed in Electron 1.8.2-beta.5. This issue is due to an incomplete fix for CVE-2018-1000006, specifically the black list used was not case insensitive allowing an attacker to potentially bypass it.

Context isolation bypass via leaked cross-context objects in Electron

Electron named window.open targets not scoped to the opener's browsing context

Electron: Renderer command-line switch injection via undocumented commandLineSwitches webPreference

Electron: Use-after-free in WebContents fullscreen, pointer-lock, and keyboard-lock permission callbacks

Electron: Use-after-free in PowerMonitor on Windows and macOS

Electron: Use-after-free in download save dialog callback

Electron: Sandboxed preload code cache can be poisoned by a compromised renderer

Sandboxed renderers can obtain thumbnails of arbitrary files through the nativeImage API

Context isolation bypass via nested unserializable return value in Electron

Electron: Context Isolation bypass via contextBridge VideoFrame transfer

Electron: Windows opened from a sandboxed top-level document do not inherit its sandbox restrictions

Electron drops inherited HTML sandbox restrictions for popups opened through OpenURLFromTab

GitHub Electron 1.7.15, 1.8.7, 2.0.7, and 3.0.0-beta.6, in certain scenarios involving IFRAME elements and "nativeWindowOpen: true" or "sandbox: true" options, is affected by a WebPreferences vulnerability that can be leveraged to perform remote code execution.

Electron version 1.7 up to 1.7.12; 1.8 up to 1.8.3 and 2.0.0 up to 2.0.0-beta.3 contains an improper handling of values vulnerability in Webviews that can result in remote code execution. This attack appear to be exploitable via an app which allows execution of 3rd party code AND disallows node integration AND has not specified if webview is enabled/disabled. This vulnerability appears to have been fixed in 1.7.13, 1.8.4, 2.0.0-beta.4.

Electron: Use-after-free in offscreen child window paint callback

Electron: AppleScript injection in app.moveToApplicationsFolder on macOS

Electron: Unquoted executable path in app.setLoginItemSettings on Windows

Unpreventable top-level navigation in Electron

Arbitrary file read via window-open IPC in Electron

Electron: Context isolation bypass via Function.prototype.bind hijack

Electron: Registry key path injection in app.setAsDefaultProtocolClient on Windows

Electron: Custom protocol with supportFetchAPI but not corsEnabled allows cross-origin reads

Electron: File and HTTP protocol handlers allow cross-origin reads without corsEnabled

Electron's AutoUpdater module fails to validate certain nested components of the bundle

Electron subject to Exfiltration of hashed SMB credentials on Windows via file:// redirect

Electron: Sandboxed iframe can bypass the allow-popups restriction via the OpenURL navigation path

ASAR Integrity bypass via filetype confusion in electron

Electron: DevTools embedder handler executes arbitrary files via shell open

Context isolation bypass via Promise in Electron

Context isolation bypass in Electron

Electron: Out-of-package code execution when launched with arbitrary cwd

Electron: Extension tab APIs operate across session boundaries

Electron vulnerable to ID collision when routing IPC messages to renderers containing OOPIFs