CVE-2020-15215: Context isolation bypass in Electron
Summary
CVE-2020-15215: Context isolation bypass in Electron. Affects electron across 4 version ranges.
>= 8.0.0-beta.0, < 8.5.2
>= 9.0.0-beta.0, < 9.3.1
>= 10.0.0-beta.0, < 10.1.2
>= 11.0.0-beta.0, < 11.0.0-beta.6
Fixed in 4 releases; the minimum fixed version depends on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Electron is an open-source framework that allows developers to build cross-platform desktop applications using web technologies such as HTML, CSS, and JavaScript. It provides a runtime environment for creating native-like applications for Windows, macOS, and Linux. However, Electron is vulnerable to a context isolation bypass, which can lead to unauthorized access and privileged actions.
Vulnerability Detail
The vulnerability, identified as CVE-2020-15215, affects Electron versions prior to 8.5.2, 9.3.1, 10.1.2, and 11.0.0-beta.6. It specifically impacts apps that use both contextIsolation and either sandbox: true or nativeWindowOpen: true. This context isolation bypass allows code running in the main world context in the renderer to reach into the isolated Electron context and perform privileged actions. The potential impact of this vulnerability is significant as it can lead to unauthorized access, data leakage, and potential code execution.
How To Fix
Latest published version: 45.0.0 as of 22 Oct 2026
npm install electron@45.0.0Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
>= 8.0.0-beta.0, < 8.5.28.5.2npm install electron@8.5.2 -
>= 9.0.0-beta.0, < 9.3.19.3.1npm install electron@9.3.1 -
>= 10.0.0-beta.0, < 10.1.210.1.2npm install electron@10.1.2 -
>= 11.0.0-beta.0, < 11.0.0-beta.611.0.0-beta.6npm install electron@11.0.0-beta.6
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There are no app-side workarounds available for this vulnerability. Updating to the fixed versions is the only recommended solution.
Conclusion
In conclusion, the context isolation bypass vulnerability in Electron can lead to unauthorized access and privileged actions. It is crucial to update to the fixed versions to mitigate this vulnerability. For further support and assistance in vulnerability remediation, you can reach out to [DevNack.com](mailto:DevNack.com).
See every vulnerability recorded for electron →
FAQ
Electron versions prior to 8.5.2, 9.3.1, 10.1.2, and 11.0.0-beta.6 are affected.
The vulnerability allows unauthorized access and privileged actions, potentially leading to data leakage and code execution.
No, there are no app-side workarounds available. Updating to the fixed versions is the recommended solution.
To update your Electron version, you can use package managers like npm or yarn to install the fixed version of Electron.
For more information, you can refer to the official advisory provided by Electron at mailto:security@electronjs.org.
References
Related vulnerabilities
Recent vulnerabilities recorded for electron.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
