Packages / electron / Security

CriticalVulnerabilityGHSA-995f-9x5r-2rcjCVE-2022-4135Published 25 Nov 2022

Heap buffer overflow in GPU

Affected releases · electron

  • 19.x19.0.0 – 19.1.7Fixed in 19.1.8

On 19.x, the newest line:

npm install electron@19.1.8
45.x

  1. Not affected

    45.0.0

    1 release, latest

19.x

  1. Affected

    19.0.0 – 19.1.7

    26 releases

  2. Fixed

    19.1.8 – 19.1.9

    2 releases

1131 stable releases of electron, oldest to newest, one row per major.

Is your project affected?

Paste your package.json, or type the range you declare for electron. It is read in your browser and sent nowhere.

What happens

Heap buffer overflow in GPU in Google Chrome prior to 107.0.5304.121 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)