GHSA-98mx-cjp9-gchm: Low severity npm/electron vulnerability
Impact chrome.tabs.query() returned each tab's url and title to extensions that held neither the tabs permission nor matching host permissions, so any loaded extension could read the URL and title of every webContents in its session.
Apps are only affected if they load extensions (session.extensions.loadExtension) that they do not fully trust. Apps that load no extensions, or only trusted ones, are not affected.
Workarounds Do not load untrusted or unvalidated extensions. In general you should only load trusted extensions.
Fixed Versions 45.0.0-alpha.4 44.1.1 43.5.1 42.11.1
For more information If you have any questions or comments about this advisory, email us at security@electronjs.org
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
npm/electronto a version that resolves this vulnerability.Fixed in 42.11.1 - Upgrade
Upgrade
npm/electronto a version that resolves this vulnerability.Fixed in 43.5.1 - Upgrade
Upgrade
npm/electronto a version that resolves this vulnerability.Fixed in 44.1.1 - Upgrade
Upgrade
npm/electronto a version that resolves this vulnerability.Fixed in 45.0.0-alpha.4 - Upgrade
Upgrade
Electronto a version that resolves this vulnerability.Fixed in 42.11.1 - Upgrade
Upgrade
Electronto a version that resolves this vulnerability.Fixed in 43.5.1 - Upgrade
Upgrade
Electronto a version that resolves this vulnerability.Fixed in 44.1.1 - Upgrade
Upgrade
Electronto a version that resolves this vulnerability.Fixed in 45.0.0-alpha.4 - Compensating control
Do not load untrusted or unvalidated extensions; load only extensions that are fully trusted.
Event History
Frequently Asked Questions
Which applications are actually exposed to this issue?
Only Electron applications that load extensions they do not fully trust through session.extensions.loadExtension are affected. Applications that load no extensions, or load only trusted extensions, are not affected.
What could an untrusted extension access?
An extension without the tabs permission or matching host permissions could obtain the URL and title of every webContents in its session by calling chrome.tabs.query().
What is the practical mitigation if an update cannot be deployed immediately?
Do not load untrusted or unvalidated extensions. Restrict extension loading to extensions that are trusted and fully reviewed.
Which Electron releases contain fixes?
Fixed releases are 45.0.0-alpha.4, 44.1.1, 43.5.1, and 42.11.1.