CVE-2020-4077: Context isolation bypass via contextBridge in Electron
In Electron before versions 7.2.4, 8.2.4, and 9.0.0-beta21, there is a context isolation bypass. Code running in the main world context in the renderer can reach into the isolated Electron context and perform privileged actions. Apps using both contextIsolation and contextBridge are affected. This is fixed in versions 9.0.0-beta.21, 8.2.4 and 7.2.4.
Affected Software
Event History
Frequently Asked Questions
What is CVE-2020-4077?
CVE-2020-4077 is a vulnerability in Electron before versions 7.2.4, 8.2.4, and 9.0.0-beta21 that allows code running in the main world context in the renderer to reach into the isolated Electron context and perform privileged actions.
What is the severity of CVE-2020-4077?
The severity of CVE-2020-4077 is critical with a CVSS score of 9.9.
Which software versions are affected by CVE-2020-4077?
The affected software versions are Electron before versions 7.2.4, 8.2.4, and 9.0.0-beta21.
How can I fix CVE-2020-4077?
To fix CVE-2020-4077, you should update Electron to version 7.2.4, 8.2.4, or 9.0.0-beta21 or later.
Where can I find more information about CVE-2020-4077?
You can find more information about CVE-2020-4077 on the Electron GitHub Security Advisory page and the Electron release notes page.