CVE-2018-15685: Electron webPreferences vulnerability can be used to perform remote code execution
Summary
CVE-2018-15685: Electron webPreferences vulnerability can be used to perform remote code execution. Affects electron across 4 version ranges.
>= 1.7.0, < 1.7.16
>= 1.8.0, < 1.8.8
>= 2.0.0, < 2.0.8
>= 3.0.0-beta.1, < 3.0.0-beta.7
Fixed in 4 releases; the minimum fixed version depends on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Electron is an open-source framework that allows developers to build cross-platform desktop applications using web technologies such as HTML, CSS, and JavaScript. It provides a runtime environment for creating native-like applications for Windows, macOS, and Linux. Electron applications are built using a combination of Chromium and Node.js, which allows for the integration of web technologies with native desktop features. However, certain versions of Electron are affected by a webPreferences vulnerability that can be exploited to perform remote code execution.
Vulnerability Detail
The vulnerability in Electron versions 1.7.15, 1.8.7, 2.0.7, and 3.0.0-beta.6 arises in specific scenarios involving IFRAME elements and the 'nativeWindowOpen: true' or 'sandbox: true' options. This vulnerability can be leveraged by an attacker to execute arbitrary code remotely. The impact of this vulnerability can be severe, as it allows an attacker to gain control over the affected system and potentially perform malicious actions.
How To Fix
Latest published version: 45.0.0 as of 22 Oct 2026
npm install electron@45.0.0Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
>= 1.7.0, < 1.7.161.7.16npm install electron@1.7.16 -
>= 1.8.0, < 1.8.81.8.8npm install electron@1.8.8 -
>= 2.0.0, < 2.0.82.0.8npm install electron@2.0.8 -
>= 3.0.0-beta.1, < 3.0.0-beta.73.0.0-beta.7npm install electron@3.0.0-beta.7
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. The recommended approach is to upgrade to the fixed versions of Electron.
Conclusion
The Electron webPreferences vulnerability can be exploited to perform remote code execution. It is crucial for developers to upgrade to the fixed versions of Electron to mitigate the risk of exploitation. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for electron →
FAQ
Electron is an open-source framework that allows developers to build cross-platform desktop applications using web technologies such as HTML, CSS, and JavaScript.
The vulnerability allows an attacker to perform remote code execution, potentially gaining control over the affected system and performing malicious actions.
To fix this vulnerability, it is recommended to upgrade Electron to version >=3.0.0-beta.7, >=2.0.8, >=1.8.8, or >=1.7.16.
There are no specific workarounds mentioned for this vulnerability. The recommended approach is to upgrade to the fixed versions of Electron.
More information about this vulnerability can be found on the Electron blog: https://electronjs.org/blog/web-preferences-fix
References
Related vulnerabilities
Recent vulnerabilities recorded for electron.
