Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
7.5

Electron: Unpatched Apps Can Be Redirected to Unwanted Sites

CVE-2020-15174 · published 6 years ago
Summary

Electron apps that don't update to versions 11.0.0-beta.1, 10.0.1, 9.3.0, or 8.5.1 are vulnerable to redirects to unexpected websites. This can happen when a user interacts with a sub-page within the app. To fix this, update to the latest version of Electron or add the sandbox attribute to your iframes to prevent unauthorized redirects.

What to do
  • Update electron-nightly electron to version 8.5.1.
  • Update electron-nightly electron to version 9.3.0.
  • Update electron-nightly electron to version 10.0.1.
Affected software
Ecosystem VendorProductAffected versions
npm electron-nightly electron >= 8.0.0-beta.0, < 8.5.1
>= 9.0.0-beta.0, < 9.3.0
>= 10.0.0-beta.0, < 10.0.1
Fix: upgrade to 8.5.1
– electronjs electron >= 8.0.0, < 8.5.1
>= 9.0.0, < 9.3.0
>= 10.0.0, < 10.0.1
cpe:2.3:a:electronjs:electron:*:*:*:*:*:*:*:*
Original advisory text
In Electron before versions 11.0.0-beta.1, 10.0.1, 9.3.0 or 8.5.1 the `will-navigate` event that apps use to prevent navigations to unexpected destinations as per our security recommendations can b...
In Electron before versions 11.0.0-beta.1, 10.0.1, 9.3.0 or 8.5.1 the `will-navigate` event that apps use to prevent navigations to unexpected destinations as per our security recommendations can be bypassed when a sub-frame performs a top-frame navigation across sites. The issue is patched in versions 11.0.0-beta.1, 10.0.1, 9.3.0 or 8.5.1 As a workaround sandbox all your iframes using the sandbox attribute. This will prevent them creating top-frame navigations and is good practice anyway.
References
Fix within
Internet-facing 14 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically (estimated)
  • Gives an attacker partial control (estimated)
Severity
7.5 High
Exploitation
1% chance of attack within 30 days
Type
CWE-20Improper Input Validation
CWE-693Protection Mechanism Failure
Timeline
Published6 Oct 2020
Updated4 Nov 2026
First seen6 Mar 2026
Sources
GHSA-2q4g-w47c-4674 · GHSA
CVE-2020-15174 · NVD
Track software like this
Free during beta