GHSA-x8rc-wpg4-grpf: Low severity npm/electron vulnerability
Impact The native autofill popup could be positioned by a cross-origin iframe outside that iframe's bounds, over the embedding page's UI, enabling clickjacking or spoofing of trusted UI.
Apps are only affected if they embed untrusted content in iframes within windows that also display trusted UI. Apps that do not embed untrusted third-party content are not affected.
Workarounds Do not embed untrusted content in iframes inside windows that display trusted UI.
Fixed Versions 42.0.0-beta.3 41.2.1 40.9.0 39.8.8
For more information If you have any questions or comments about this advisory, email Electron at security@electronjs.org
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
npm/electronto a version that resolves this vulnerability.Fixed in 42.0.0-beta.3 - Upgrade
Upgrade
npm/electronto a version that resolves this vulnerability.Fixed in 41.2.1 - Upgrade
Upgrade
npm/electronto a version that resolves this vulnerability.Fixed in 40.9.1 - Upgrade
Upgrade
npm/electronto a version that resolves this vulnerability.Fixed in 39.8.8 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 39.8.8 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 40.9.0 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 41.2.1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 42.0.0-beta.3 - Configuration
Do not embed untrusted third-party content in iframes inside windows that also display trusted UI (mitigates native autofill popup positioning over trusted UI via cross-origin iframes).
Apps using Electron iframes iframe embedding of untrusted third-party content inside windows that display trusted UI = Do not embed untrusted third-party content