CVE-2020-4077CWE-501

Context isolation bypass via contextBridge in Electron

High · published July 7, 2020

CVSS v3.1
7.7
EPSS
1%
Percentile
62.6
In the wild
Unconfirmed
What it is

In Electron before versions 7.2.4, 8.2.4, and 9.0.0-beta21, there is a context isolation bypass. Code running in the main world context in the renderer can reach into the isolated Electron context and perform privileged actions. Apps using both `contextIsolation` and `contextBridge` are affected. This is fixed in versions 9.0.0-beta.21, 8.2.4 and 7.2.4.

The record
Technical detail
CVSS v3.1
7.7 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.01003 · 62.6th percentile
Weakness
CWE-501 · Trust Boundary Violation
Published
2020-07-07T00:05Z
EPSS history
Timeline
  • 07 JUL 00:05Z
    Context isolation bypass via contextBridge in Electron
    cvelistv5