Packages / electron / Security

ModerateVulnerabilityGHSA-hvf8-h2qh-37m9CVE-2020-26272Published 28 Jan 2021

IPC messages delivered to the wrong frame in Electron

Affected releases · electron

  • 11.x11.0.0 – 11.0.5Fixed in 11.1.0
  • 10.x10.0.0 – 10.1.7Fixed in 10.2.0
  • 9.x9.0.0 – 9.3.5Fixed in 9.4.0
  • 8.x and older0.1.0 – 8.5.5No fix, no longer updated

On 11.x, the newest line:

npm install electron@11.1.0
45.x

  1. Not affected

    45.0.0

    1 release, latest

11.x

  1. Affected

    11.0.0 – 11.0.5

    6 releases

  2. Fixed

    11.1.0 – 11.5.0

    21 releases

10.x

  1. Affected

    10.0.0 – 10.1.7

    10 releases

  2. Fixed

    10.2.0 – 10.4.7

    12 releases

9.x

  1. Affected

    9.0.0 – 9.3.5

    17 releases

  2. Fixed

    9.4.0 – 9.4.4

    5 releases

8.x

  1. Affected

    8.0.0 – 8.5.5

    25 releases

7.x

  1. Affected

    7.0.0 – 7.3.3

    26 releases

6.x

  1. Affected

    6.0.0 – 6.1.12

    26 releases

5.x

  1. Affected

    5.0.0 – 5.0.13

    14 releases

4.x

  1. Affected

    4.0.0 – 4.2.12

    28 releases

3.x

  1. Affected

    3.0.0 – 3.1.13

    31 releases

2.x

  1. Affected

    2.0.0 – 2.0.18

    19 releases

1.x

  1. Affected

    1.3.1 – 1.8.8

    79 releases

0.x

  1. Affected

    0.1.0 – 0.4.1

    8 releases

1131 stable releases of electron, oldest to newest, one row per major.

Is your project affected?

Paste your package.json, or type the range you declare for electron. It is read in your browser and sent nowhere.

What happens

Impact

IPC messages sent from the main process to a subframe in the renderer process, through webContents.sendToFrame, event.reply or when using the remote module, can in some cases be delivered to the wrong frame.

If your app does ANY of the following, then it is impacted by this issue:

  • Uses remote

  • Calls webContents.sendToFrame

  • Calls event.reply in an IPC message handler

Patches

This has been fixed in the following versions:

  • 9.4.0

  • 10.2.0

  • 11.1.0

  • 12.0.0-beta.9

Workarounds

There are no workarounds for this issue.

For more information

If you have any questions or comments about this advisory, email us at security@electronjs.org.