CVE-2020-15096: Context isolation bypass via Promise in Electron
Summary
CVE-2020-15096: Context isolation bypass via Promise in Electron. Affects electron across 3 version ranges.
< 6.1.11
>= 7.0.0, < 7.2.4
>= 8.0.0, < 8.2.4
Fixed in 6.1.11, 7.2.4 or 8.2.4, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Electron is an open-source framework that allows developers to build cross-platform desktop applications using web technologies such as HTML, CSS, and JavaScript. It provides a runtime environment for creating native-like applications for Windows, macOS, and Linux. Electron applications consist of two main processes: the main process, which runs the application's main logic, and the renderer process, which displays the user interface. The renderer process runs in an isolated context to enhance security and prevent unauthorized access to system resources. However, a vulnerability in Electron's context isolation mechanism allows code running in the renderer process to bypass the isolation and perform privileged actions in the main process.
Vulnerability Detail
The vulnerability, identified as CVE-2020-15096, is a context isolation bypass in Electron. It allows code running in the renderer process to reach into the isolated Electron context and perform privileged actions. This means that an attacker could exploit this vulnerability to execute arbitrary code with elevated privileges, potentially leading to unauthorized access, data leakage, or system compromise. The vulnerability affects Electron versions prior to 6.1.11, 7.2.4, and 8.2.4. It has a CVSS score of 6.8, indicating a medium severity level.
How To Fix
Latest published version: 45.0.0 as of 22 Oct 2026
npm install electron@45.0.0Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 6.1.116.1.11npm install electron@6.1.11 -
>= 7.0.0, < 7.2.47.2.4npm install electron@7.2.4 -
>= 8.0.0, < 8.2.48.2.4npm install electron@8.2.4
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There are no app-side workarounds available for this vulnerability. The only solution is to update the Electron version to a fixed version.
Conclusion
The context isolation bypass vulnerability in Electron allows code in the renderer process to perform privileged actions in the main process, potentially leading to unauthorized access or system compromise. To mitigate this vulnerability, it is crucial to update the Electron version to one of the fixed versions. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for electron →
FAQ
Electron is an open-source framework for building cross-platform desktop applications using web technologies.
Context isolation in Electron is a security feature that separates the renderer process from the main process to prevent unauthorized access to system resources.
The context isolation bypass in Electron allows code running in the renderer process to bypass the isolation and perform privileged actions in the main process.
Exploiting this vulnerability can lead to unauthorized access, data leakage, or system compromise.
To protect your application, update the Electron version to one of the fixed versions: 9.0.0-beta.21, 8.2.4, 7.2.4, or 6.1.11.
Related vulnerabilities
Recent vulnerabilities recorded for electron.
