CVE-2020-15215: Context isolation bypass in Electron

Published Oct 6, 2020

Updated

Electron before versions 11.0.0-beta.6, 10.1.2, 9.3.1 or 8.5.2 is vulnerable to a context isolation bypass. Apps using both contextIsolation and sandbox: true are affected. Apps using both contextIsolation and nodeIntegrationInSubFrames: true are affected. This is a context isolation bypass, meaning that code running in the main world context in the renderer can reach into the isolated Electron context and perform privileged actions.

Affected Software

100 affected components

electronjs Electron=8.0.0

electronjs Electron=8.0.0-beta0

electronjs Electron=8.0.0-beta1

electronjs Electron=8.0.0-beta2

electronjs Electron=8.0.0-beta3

electronjs Electron=8.0.0-beta4

electronjs Electron=8.0.0-beta5

electronjs Electron=8.0.0-beta6

electronjs Electron=8.0.0-beta7

electronjs Electron=8.0.0-beta8

electronjs Electron=8.0.0-beta9

electronjs Electron=8.0.1

electronjs Electron=8.0.2

electronjs Electron=8.0.3

electronjs Electron=8.1.0

electronjs Electron=8.1.1

electronjs Electron=8.2.0

electronjs Electron=8.2.1

electronjs Electron=8.2.2

electronjs Electron=8.2.3

electronjs Electron=8.2.4

electronjs Electron=8.2.5

electronjs Electron=8.3.0

electronjs Electron=8.3.1

electronjs Electron=8.3.2

electronjs Electron=8.3.3

electronjs Electron=8.3.4

electronjs Electron=8.4.0

electronjs Electron=8.4.1

electronjs Electron=8.5.0

electronjs Electron=8.5.1

electronjs Electron=9.0.0

electronjs Electron=9.0.0-beta0

electronjs Electron=9.0.0-beta1

electronjs Electron=9.0.0-beta10

electronjs Electron=9.0.0-beta11

electronjs Electron=9.0.0-beta12

electronjs Electron=9.0.0-beta13

electronjs Electron=9.0.0-beta14

electronjs Electron=9.0.0-beta15

electronjs Electron=9.0.0-beta16

electronjs Electron=9.0.0-beta17

electronjs Electron=9.0.0-beta18

electronjs Electron=9.0.0-beta19

electronjs Electron=9.0.0-beta2

electronjs Electron=9.0.0-beta20

electronjs Electron=9.0.0-beta3

electronjs Electron=9.0.0-beta4

electronjs Electron=9.0.0-beta5

electronjs Electron=9.0.0-beta6

electronjs Electron=9.0.0-beta7

electronjs Electron=9.0.0-beta8

electronjs Electron=9.0.0-beta9

electronjs Electron=9.0.1

electronjs Electron=9.0.2

electronjs Electron=9.0.3

electronjs Electron=9.0.4

electronjs Electron=9.0.5

electronjs Electron=9.0.6

electronjs Electron=9.1.0

electronjs Electron=9.1.1

electronjs Electron=9.1.2

electronjs Electron=9.2.0

electronjs Electron=9.2.1

electronjs Electron=9.3.0

electronjs Electron=10.0.0

electronjs Electron=10.0.0-beta1

electronjs Electron=10.0.0-beta10

electronjs Electron=10.0.0-beta11

electronjs Electron=10.0.0-beta12

electronjs Electron=10.0.0-beta13

electronjs Electron=10.0.0-beta14

electronjs Electron=10.0.0-beta15

electronjs Electron=10.0.0-beta16

electronjs Electron=10.0.0-beta17

electronjs Electron=10.0.0-beta18

electronjs Electron=10.0.0-beta19

electronjs Electron=10.0.0-beta2

electronjs Electron=10.0.0-beta20

electronjs Electron=10.0.0-beta21

electronjs Electron=10.0.0-beta22

electronjs Electron=10.0.0-beta23

electronjs Electron=10.0.0-beta24

electronjs Electron=10.0.0-beta25

electronjs Electron=10.0.0-beta3

electronjs Electron=10.0.0-beta4

electronjs Electron=10.0.0-beta5

electronjs Electron=10.0.0-beta6

electronjs Electron=10.0.0-beta7

electronjs Electron=10.0.0-beta8

electronjs Electron=10.0.0-beta9

electronjs Electron=10.0.1

electronjs Electron=10.1.0

electronjs Electron=10.1.1

electronjs Electron=11.0.0-beta0

electronjs Electron=11.0.0-beta1

electronjs Electron=11.0.0-beta2

electronjs Electron=11.0.0-beta3

electronjs Electron=11.0.0-beta4

electronjs Electron=11.0.0-beta5

Event History

Oct 6, 2020

CVE Published

via MITRE·06:00 PM

Data Sourced

via MITRE·06:00 PM

DescriptionSeverityWeakness

Frequently Asked Questions

What is the severity of CVE-2020-15215?

The severity of CVE-2020-15215 is assessed as high due to its potential for context isolation bypass.

How do I fix CVE-2020-15215?

To fix CVE-2020-15215, upgrade to Electron version 11.0.0-beta.6, 10.1.2, 9.3.1, or 8.5.2 or later.

Which versions of Electron are affected by CVE-2020-15215?

CVE-2020-15215 affects Electron versions prior to 11.0.0-beta.6, 10.1.2, 9.3.1, and 8.5.2.

What impact does CVE-2020-15215 have on applications?

CVE-2020-15215 can lead to context isolation bypass in applications that enable contextIsolation and use sandboxing.

How is CVE-2020-15215 exploited?

CVE-2020-15215 may be exploited by malicious web content that can access Node.js APIs when context isolation is bypassed.