electron
Build cross platform desktop apps with JavaScript, HTML, and CSS
Security Advisories for electron in npm
High
21 days ago
Electron: Mitigation for compromised eMudhra intermediate certificates
npm
electron
Moderate
22 days ago
Electron: SameSite cookie restrictions are not applied to windows opened from links
npm
electron
Moderate
22 days ago
Electron: Pointer lock permission requests can be attributed to the wrong frame
npm
electron
Low
22 days ago
Electron: Extension tabs.query returns tab URLs and titles without the tabs permission
npm
electron
Low
22 days ago
Electron: Off-screen rendering on macOS trusts GPU-supplied frame geometry
npm
electron
Moderate
22 days ago
Electron: openExternal permission requests can be attributed to the wrong origin
npm
electron
Moderate
23 days ago
Electron: HID and USB permission checks can be attributed to the wrong origin
npm
electron
Moderate
about 1 month ago
Electron: Local race condition in Squirrel.Mac update installation on macOS
npm
electron
High
about 1 month ago
Electron drops inherited HTML sandbox restrictions for popups opened through OpenURLFromTab
npm
electron
High
about 1 month ago
Electron: Windows opened from a sandboxed top-level document do not inherit its sandbox restrictions
npm
electron
High
about 1 month ago
Electron: File and HTTP protocol handlers allow cross-origin reads without corsEnabled
npm
electron
High
about 1 month ago
Electron: <webview> can enable Node.js integration in Web Workers despite embedder restrictions
npm
electron
High
about 1 month ago
Electron: Sandboxed preload code cache can be poisoned by a compromised renderer
npm
electron
Moderate
3 months ago
Electron: Sandboxed iframes can launch external protocol handlers
npm
electron
Moderate
3 months ago
Electron: DevTools embedder handler executes arbitrary files via shell open
npm
electron
Moderate
3 months ago
Electron: DevTools JavaScript Injection via Unsanitized Dock State Parameter
npm
electron
High
3 months ago
Electron: Sandboxed iframe can bypass the allow-popups restriction via the OpenURL navigation path
npm
electron
Moderate
3 months ago
Electron: window.open features string controls some window options considered privileged
npm
electron
Moderate
3 months ago
Electron: ProtocolResponse.url reuses the default session cache instead of the registering session
npm
electron
High
3 months ago
Electron: Custom protocol with supportFetchAPI but not corsEnabled allows cross-origin reads
npm
electron
Moderate
3 months ago
Electron: shell.openPath path validation bypass via embedded null byte
npm
electron
High
3 months ago
Electron: Context isolation bypass via Function.prototype.bind hijack
npm
electron
Moderate
3 months ago
Electron: Permission Check Handler Receives Main Frame Origin Instead of Requesting Iframe Origin
npm
electron
Low
3 months ago
Electron: Off-screen rendering trusts GPU-supplied geometry over shared-memory size
npm
electron
Critical
5 months ago
Electron: Buffer performs incorrect byte length calculations resulting in heap buffer under/overflow
npm
electron
Low
7 months ago
Electron: Crash in clipboard.readImage() on malformed clipboard image data
npm
electron
Moderate
7 months ago
Electron: Named window.open targets not scoped to the opener's browsing context
npm
electron
Low
7 months ago
Electron: Use-after-free in offscreen shared texture release() callback
npm
electron
High
7 months ago
Electron: Context Isolation bypass via contextBridge VideoFrame transfer
npm
electron
Moderate
7 months ago
Electron: AppleScript injection in app.moveToApplicationsFolder on macOS
npm
electron
Moderate
7 months ago
Electron: Incorrect origin passed to permission request handler for iframe requests
npm
electron
Moderate
7 months ago
Electron: Out-of-bounds read in second-instance IPC on macOS and Linux
npm
electron
Moderate
7 months ago
Electron: nodeIntegrationInWorker not correctly scoped in shared renderer processes
npm
electron
Moderate
7 months ago
Electron: Registry key path injection in app.setAsDefaultProtocolClient on Windows
npm
electron
High
7 months ago
Electron: Use-after-free in WebContents fullscreen, pointer-lock, and keyboard-lock permission callbacks
npm
electron
High
7 months ago
Electron: Renderer command-line switch injection via undocumented commandLineSwitches webPreference
npm
electron
Low
7 months ago
Electron: Unquoted executable path in app.setLoginItemSettings on Windows
npm
electron
Moderate
7 months ago
Electron: HTTP Response Header Injection in custom protocol handlers and webRequest
npm
electron
Low
7 months ago
Electron: USB device selection not validated against filtered device list
npm
electron
High
about 3 years ago
Electron affected by libvpx's heap buffer overflow in vp8 encoding
npm
electron
High
about 3 years ago
libwebp: OOB write in BuildHuffmanTable
go, nuget, cargo, pypi, npm
github.com/chai2010/webp, magick.net-q8-x64, magick.net-q8-openmp-x64, magick.net-q8-anycpu, magick.net-q16-x64, magick.net-q16-hdri-anycpu, magick.net-q16-anycpu, webp, Pillow, SkiaSharp, electron, libwebp-sys, libwebp-sys2
Moderate
about 3 years ago
Electron vulnerable to out-of-package code execution when launched with arbitrary cwd
npm
electron
Moderate
about 3 years ago
Electron context isolation bypass via nested unserializable return value
npm
electron
High
about 3 years ago
Electron's Content-Secrity-Policy disabling eval not applied consistently in renderers with sandbox disabled
npm
electron
Moderate
about 4 years ago
Exfiltration of hashed SMB credentials on Windows via file:// redirect
npm
electron
Moderate
over 4 years ago
AutoUpdater module fails to validate certain nested components of the bundle
npm
electron
Low
over 4 years ago
Compromised child renderer processes could obtain IPC access without nodeIntegrationInSubFrames being enabled
npm
electron
Low
over 4 years ago
Renderers can obtain access to random bluetooth device without permission in Electron
npm
electron
Moderate
about 5 years ago
Electron's sandboxed renderers can obtain thumbnails of arbitrary files through the nativeImage API
npm
electron
High
over 6 years ago
Context isolation bypass via leaked cross-context objects in Electron
npm
electron
High
about 8 years ago
Electron webPreferences vulnerability can be used to perform remote code execution
npm
electron
High
over 8 years ago
Electron protocol handler browser vulnerable to Command Injection
npm
electron
High
over 8 years ago
Electron Vulnerable to Code Execution by Re-Enabling Node.js Integration
npm
electron