CVE-2020-15215

moderate-risk
Published 2020-10-06

Electron before versions 11.0.0-beta.6, 10.1.2, 9.3.1 or 8.5.2 is vulnerable to a context isolation bypass. Apps using both `contextIsolation` and `sandbox: true` are affected. Apps using both `contextIsolation` and `nodeIntegrationInSubFrames: true` are affected. This is a context isolation bypass, meaning that code running in the main world context in the renderer can reach into the isolated Electron context and perform privileged actions.

Do I need to act?

-
0.28% chance of exploitation
EPSS score — low exploit probability
-
Not on CISA KEV list
No confirmed active exploitation reported to CISA
?
Patch status unknown
Check vendor advisories for fix availability and mitigation guidance
5
CVSS 5.6/10 Medium
NETWORK / HIGH complexity

Affected Products (20)

Affected Vendors

Electronjs

References (2)

Third Party Advisory https://github.com/electron/electron/security/advisories/GHSA-56pc-6jqp-xqj8
Third Party Advisory https://github.com/electron/electron/security/advisories/GHSA-56pc-6jqp-xqj8
49
/ 100
moderate-risk
Severity 18/34 · Moderate
Exploitability 1/34 · Minimal
Exposure 30/34 · Critical