In Electron before versions 7.2.4, 8.2.4, and 9.0.0-beta21, there is a context isolation bypass

Electron: <webview> can enable Node.js integration in Web Workers despite embedder restrictions

Electron: nodeIntegrationInWorker not correctly scoped in shared renderer processes

Electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS

Electron is a framework for writing cross-platform desktop applications using JavaScript (JS), HTML, and CSS

Based on details posted by the ElectronJS team; A remote code execution vulnerability has been discovered in Google Chromium that affects all recent versions of Electron

In Electron before versions 7.2.4, 8.2.4, and 9.0.0-beta21, there is a context isolation bypass

Electron: Sandboxed preload code cache can be poisoned by a compromised renderer

Electron named window.open targets not scoped to the opener's browsing context

Electron: Use-after-free in download save dialog callback

Electron: Use-after-free in WebContents fullscreen, pointer-lock, and keyboard-lock permission callbacks

Electron: Use-after-free in PowerMonitor on Windows and macOS

Electron: Renderer command-line switch injection via undocumented commandLineSwitches webPreference

Github Electron version Electron 1.8.2-beta.4 and earlier contains a Command Injection vulnerability in Protocol Handler that can result in command execute

Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS

Electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS

Electron: Use-after-free in offscreen child window paint callback

GitHub Electron 1.7.15, 1.8.7, 2.0.7, and 3.0.0-beta.6, in certain scenarios involving IFRAME elements and "nativeWindowOpen: true" or "sandbox: true" options, is affected by a…

Electron version 1.7 up to 1.7.12; 1.8 up to 1.8.3 and 2.0.0 up to 2.0.0-beta.3 contains an improper handling of values vulnerability in Webviews that can result in remote code…

Electron: AppleScript injection in app.moveToApplicationsFolder on macOS

Electron: Unquoted executable path in app.setLoginItemSettings on Windows

Electron: Context isolation bypass via Function.prototype.bind hijack

Electron: Registry key path injection in app.setAsDefaultProtocolClient on Windows

In Electron before versions 11.0.0-beta.1, 10.0.1, 9.3.0 or 8.5.1 the `will-navigate` event that apps use to prevent navigations to unexpected destinations as per our security…

In Electron before versions 7.2.4, 8.2.4, and 9.0.0-beta21, arbitrary local file read is possible by defining unsafe window options on a child window opened via window.open

Electron: File and HTTP protocol handlers allow cross-origin reads without corsEnabled

Electron: Custom protocol with supportFetchAPI but not corsEnabled allows cross-origin reads

Electron: Sandboxed iframe can bypass the allow-popups restriction via the OpenURL navigation path

Electron is a framework for writing cross-platform desktop applications using JavaScript (JS), HTML, and CSS

ASAR Integrity bypass via filetype confusion in electron

Electron: DevTools embedder handler executes arbitrary files via shell open

In Electron before versions 6.1.1, 7.2.4, 8.2.4, and 9.0.0-beta21, there is a context isolation bypass, meaning that code running in the main world context in the renderer can…

Electron: Extension tab APIs operate across session boundaries

Electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS

Electron: Service worker can spoof executeJavaScript IPC replies

Electron: HTTP Response Header Injection in custom protocol handlers and webRequest

The Electron framework lets users write cross-platform desktop applications using JavaScript, HTML and CSS

Electron: Parent process code-sign check is spoofable

Electron: Windows opened from a sandboxed top-level document do not inherit its sandbox restrictions

Electron drops inherited HTML sandbox restrictions for popups opened through OpenURLFromTab

Electron: Context Isolation bypass via contextBridge VideoFrame transfer

The Electron framework enables writing cross-platform desktop applications using JavaScript, HTML and CSS

Electron: shell.openPath path validation bypass via embedded null byte

Electron: ProtocolResponse.url reuses the default session cache instead of the registering session

Electron: HTTP redirect followed into local file loader

Electron: Permission Check Handler Receives Main Frame Origin Instead of Requesting Iframe Origin

Electron: DevTools JavaScript Injection via Unsanitized Dock State Parameter

Electron before versions 11.0.0-beta.6, 10.1.2, 9.3.1 or 8.5.2 is vulnerable to a context isolation bypass

Electron has a use-after-free in offscreen shared texture release() callback

Electron: Sandboxed iframes can launch external protocol handlers