CVE-2020-4076CWE-501

Context isolation bypass via leaked cross-context objects in Electron

High · published July 7, 2020

CVSS v3.1
7.8
EPSS
0%
Percentile
29.4
In the wild
Unconfirmed
What it is

In Electron before versions 7.2.4, 8.2.4, and 9.0.0-beta21, there is a context isolation bypass. Code running in the main world context in the renderer can reach into the isolated Electron context and perform privileged actions. Apps using contextIsolation are affected. This is fixed in versions 9.0.0-beta.21, 8.2.4 and 7.2.4.

The record
Technical detail
CVSS v3.1
7.8 · HIGH
Vector
CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.00367 · 29.4th percentile
Weakness
CWE-501 · Trust Boundary Violation
Published
2020-07-07T00:05Z
EPSS history
Timeline
  • 07 JUL 00:05Z
    Context isolation bypass via leaked cross-context objects in Electron
    cvelistv5