CVE-2020-15215: Context isolation bypass in Electron
Electron before versions 11.0.0-beta.6, 10.1.2, 9.3.1 or 8.5.2 is vulnerable to a context isolation bypass. Apps using both contextIsolation and sandbox: true are affected. Apps using both contextIsolation and nodeIntegrationInSubFrames: true are affected. This is a context isolation bypass, meaning that code running in the main world context in the renderer can reach into the isolated Electron context and perform privileged actions.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Electronto a version that resolves this vulnerability.Fixed in 11.0.0-beta.6 - Upgrade
Upgrade
Electronto a version that resolves this vulnerability.Fixed in 10.1.2 - Upgrade
Upgrade
Electronto a version that resolves this vulnerability.Fixed in 9.3.1 - Upgrade
Upgrade
Electronto a version that resolves this vulnerability.Fixed in 8.5.2
Event History
Frequently Asked Questions
What is the severity of CVE-2020-15215?
The severity of CVE-2020-15215 is assessed as high due to its potential for context isolation bypass.
How do I fix CVE-2020-15215?
To fix CVE-2020-15215, upgrade to Electron version 11.0.0-beta.6, 10.1.2, 9.3.1, or 8.5.2 or later.
Which versions of Electron are affected by CVE-2020-15215?
CVE-2020-15215 affects Electron versions prior to 11.0.0-beta.6, 10.1.2, 9.3.1, and 8.5.2.
What impact does CVE-2020-15215 have on applications?
CVE-2020-15215 can lead to context isolation bypass in applications that enable contextIsolation and use sandboxing.
How is CVE-2020-15215 exploited?
CVE-2020-15215 may be exploited by malicious web content that can access Node.js APIs when context isolation is bypassed.