Overview
IPC messages sent from the main process to a subframe in the renderer process, through webContents.sendToFrame
, event.reply
or when using the remote module, can in some cases be delivered to the wrong frame.
If your app does ANY of the following, then it is impacted by this issue:
- Uses
remote
- Calls
webContents.sendToFrame
- Calls
event.reply
in an IPC message handler
Remediation
Upgrade to a fixed version or later: 9.4.0, 10.2.0, 11.1.0, or 12.0.0-beta.9
Resources
Have content suggestions? Visit npmjs.com/support.
Advisory timeline
published
Advisory PublishedFeb 22nd, 2021reported
Reported by AnonymousFeb 22nd, 2021