GHSA-h3v5-h239-pg29: Low severity npm/electron vulnerability
Impact In offscreen rendering mode on macOS, frame data received from the GPU process was not fully validated by the main process. A compromised GPU process could cause the main process to read out-of-bounds memory while producing paint event images, disclosing memory or crashing the app. GHSA-pfmc-3mgc-p6fp covers the same issue on the other capture paths.
Apps are only affected if they use offscreen rendering (webPreferences.offscreen) on macOS and an attacker has separately gained code execution in the GPU process. Apps that do not use offscreen rendering are not affected.
Workarounds There are no app side workarounds, you must update to a patched version of Electron.
Fixed Versions 45.0.0-alpha.9 44.4.3 43.7.3 42.11.6
For more information If you have any questions or comments about this advisory, email us at security@electronjs.org
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
npm/electronto a version that resolves this vulnerability.Fixed in 45.0.0-alpha.9 - Upgrade
Upgrade
npm/electronto a version that resolves this vulnerability.Fixed in 44.4.3 - Upgrade
Upgrade
npm/electronto a version that resolves this vulnerability.Fixed in 43.7.3 - Upgrade
Upgrade
npm/electronto a version that resolves this vulnerability.Fixed in 42.11.6 - Upgrade
Upgrade
Electronto a version that resolves this vulnerability.Fixed in 42.11.6 - Upgrade
Upgrade
Electronto a version that resolves this vulnerability.Fixed in 43.7.3 - Upgrade
Upgrade
Electronto a version that resolves this vulnerability.Fixed in 44.4.3 - Upgrade
Upgrade
Electronto a version that resolves this vulnerability.Fixed in 45.0.0-alpha.9
Event History
Frequently Asked Questions
Which Electron applications are affected?
Only applications running on macOS that enable offscreen rendering through webPreferences.offscreen are affected. Applications that do not use offscreen rendering are not affected.
What access does an attacker need to exploit this issue?
The attacker must first obtain code execution in Electron's GPU process. A compromised GPU process can then send insufficiently validated frame data that causes an out-of-bounds read in the main process during paint event image generation.
What could exploitation cause?
Exploitation may disclose memory read by the main process or crash the application. The issue affects paint event images produced in offscreen rendering mode.
Is there a mitigation if an Electron update cannot be deployed immediately?
No application-side workaround is available; updating Electron is required. Fixed versions are 42.11.6, 43.7.3, 44.4.3, and 45.0.0-alpha.9.