Impact IPC messages sent from the main process to a subframe in the renderer process, through webContents.sendToFrame, event.reply or when using the remote module, can in some cases be delivered to the wrong frame.

If your app does ANY of the following, then it is impacted by this issue: - Uses remote - Calls webContents.sendToFrame - Calls event.reply in an IPC message handler

Patches This has been fixed in the following versions:

- 9.4.0 - 10.2.0 - 11.1.0 - 12.0.0-beta.9

Workarounds There are no workarounds for this issue.

For more information If you have any questions or comments about this advisory, email us at security@electronjs.org.

Electron before versions 11.0.0-beta.6, 10.1.2, 9.3.1 or 8.5.2 is vulnerable to a context isolation bypass. Apps using both contextIsolation and sandbox: true are affected. Apps using both contextIsolation and nodeIntegrationInSubFrames: true are affected. This is a context isolation bypass, meaning that code running in the main world context in the renderer can reach into the isolated Electron context and perform privileged actions.