Skip to content

IPC messages delivered to the wrong frame in Electron

Moderate severity GitHub Reviewed Published Jan 26, 2021 in electron/electron • Updated Feb 1, 2023

Package

npm electron (npm)

Affected versions

< 9.4.0
>= 10.0.0, < 10.2.0
>= 11.0.0, < 11.1.0

Patched versions

9.4.0
10.2.0
11.1.0

Description

Impact

IPC messages sent from the main process to a subframe in the renderer process, through webContents.sendToFrame, event.reply or when using the remote module, can in some cases be delivered to the wrong frame.

If your app does ANY of the following, then it is impacted by this issue:

  • Uses remote
  • Calls webContents.sendToFrame
  • Calls event.reply in an IPC message handler

Patches

This has been fixed in the following versions:

  • 9.4.0
  • 10.2.0
  • 11.1.0
  • 12.0.0-beta.9

Workarounds

There are no workarounds for this issue.

For more information

If you have any questions or comments about this advisory, email us at security@electronjs.org.

References

@MarshallOfSound MarshallOfSound published to electron/electron Jan 26, 2021
Reviewed Jan 28, 2021
Published to the GitHub Advisory Database Jan 28, 2021
Published by the National Vulnerability Database Jan 28, 2021
Last updated Feb 1, 2023

Severity

Moderate
5.4
/ 10

CVSS base metrics

Attack vector
Network
Attack complexity
High
Privileges required
None
User interaction
None
Scope
Changed
Confidentiality
Low
Integrity
Low
Availability
None
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N

Weaknesses

CVE ID

CVE-2020-26272

GHSA ID

GHSA-hvf8-h2qh-37m9

Source code

No known source code

Credits

Checking history
See something to contribute? Suggest improvements for this vulnerability.