Recent Vulnerabilities Research Posts Trends Blog About Contact

Published: 07/07/2020 Updated: 13/07/2020

CVSS v2 Base Score: 6.5 | Impact Score: 6.4 | Exploitability Score: 8

CVSS v3 Base Score: 9.9 | Impact Score: 6 | Exploitability Score: 3.1

VMScore: 578

Vector: AV:N/AC:L/Au:S/C:P/I:P/A:P

In Electron prior to 7.2.4, 8.2.4, and 9.0.0-beta21, there is a context isolation bypass. Code running in the main world context in the renderer can reach into the isolated Electron context and perform privileged actions. Apps using both `contextIsolation` and `contextBridge` are affected. This is fixed in versions 9.0.0-beta.21, 8.2.4 and 7.2.4.

Vulnerable Product	Search on Vulmon	Subscribe to Product
electronjs electron
electronjs electron 9.0.0

NVD-CWE-Other https://www.electronjs.org/releases/stable?page=3#release-notes-for-v824 https://github.com/electron/electron/security/advisories/GHSA-h9jc-284h-533g https://nvd.nist.gov

Get Started

Vulmon Search is a vulnerability search engine. It gives comprehensive vulnerability information through a very simple user interface.

Home Recent Vulnerabilities Research Posts Trends Blog About Contact

Vulmon Search Vulmon Research Vulmon Alerts Vulmap

Twitter Reddit Linkedin Facebook

CVE-2020-4077

Vulnerability Summary

Vulnerability Trend

References

Vulmon Search

About

Products

Connect