CVE-2020-15096

MediumCVSS 6.8/10Last modified Jun 17, 2026

Description

In Electron before versions 6.1.1, 7.2.4, 8.2.4, and 9.0.0-beta21, there is a context isolation bypass, meaning that code running in the main world context in the renderer can reach into the isolated Electron context and perform privileged actions. Apps using "contextIsolation" are affected. There are no app-side workarounds, you must update your Electron version to be protected. This is fixed in versions 6.1.1, 7.2.4, 8.2.4, and 9.0.0-beta21.

Metrics

CVSS 3.1 6.8/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:H/A:N

Weakness enumeration

CWE-501

Affected software

Vendor	Product	Versions
electron	electron	< 6.1.1; >= 7.0.0, < 7.2.4; >= 8.0.0, < 8.2.4; >=9.0.0-beta.0, < 9.0.0-beta.21

References

https://github.com/electron/electron/security/advisories/GHSA-6vrv-94jv-crrgThird Party Advisory
https://www.electronjs.org/releases/stable?page=3#release-notes-for-v824Release Notes, Vendor Advisory
https://github.com/electron/electron/security/advisories/GHSA-6vrv-94jv-crrgThird Party Advisory
https://www.electronjs.org/releases/stable?page=3#release-notes-for-v824Release Notes, Vendor Advisory

Timeline

Published: Jul 7, 2020
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2020

CVE-2020-150979.1loklak is an open-source server application which is able to collect messages from various sources, including twitter. The server contains a CVE-2020-150988.8In TYPO3 CMS greater than or equal to 9.0.0 and less than 9.5.20, and greater than or equal to 10.0.0 and less than 10.4.6, it has been disc CVE-2020-150998.1In TYPO3 CMS greater than or equal to 9.0.0 and less than 9.5.20, and greater than or equal to 10.0.0 and less than 10.4.6, in a case where CVE-2020-15105.5An information disclosure vulnerability exists when the win32k component improperly provides kernel information. An attacker who successfull CVE-2020-151003.3In freewvs before 0.1.1, a user could create a large file that freewvs will try to read, which will terminate a scan process. This has been CVE-2020-151013.3In freewvs before 0.1.1, a directory structure of more than 1000 nested directories can interrupt a freewvs scan due to Python's recursion l CVE-2020-151026.5In PrestaShop Dashboard Productions before version 2.1.0, there is improper authorization which enables an attacker to change the configurat CVE-2020-151033.5In FreeRDP less than or equal to 2.1.2, an integer overflow exists due to missing input sanitation in rdpegfx channel. All FreeRDP clients a CVE-2020-151045.4In Envoy before versions 1.12.6, 1.13.4, 1.14.4, and 1.15.0 when validating TLS certificates, Envoy would incorrectly allow a wildcard DNS S CVE-2020-151055.4Django Two-Factor Authentication before 1.12, stores the user's password in clear text in the user session (base64-encoded). The password is CVE-2020-151066.5In etcd before versions 3.3.23 and 3.4.10, a large slice causes panic in decodeRecord method. The size of a record is stored in the length f CVE-2020-151075.3In openenclave before 0.10.0, enclaves that use x87 FPU operations are vulnerable to tampering by a malicious host application. By violating