CVE-2020-26272: IPC messages delivered to the wrong frame in Electron
Summary
CVE-2020-26272: IPC messages delivered to the wrong frame in Electron. Affects electron across 3 version ranges.
< 9.4.0
>= 10.0.0, < 10.2.0
>= 11.0.0, < 11.1.0
Fixed in 9.4.0, 10.2.0 or 11.1.0, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Electron is an open-source framework that allows developers to build cross-platform desktop applications using web technologies such as HTML, CSS, and JavaScript. It provides a runtime environment for creating native-like applications for Windows, macOS, and Linux. Electron applications consist of two main processes: the main process and the renderer process. The main process manages the lifecycle of the application and interacts with the operating system, while the renderer process displays the user interface and handles user interactions. This vulnerability in Electron allows IPC messages sent from the main process to a subframe in the renderer process to be delivered to the wrong frame, potentially leading to security issues.
Vulnerability Detail
The vulnerability arises when IPC messages sent from the main process to a subframe in the renderer process, through webContents.sendToFrame, event.reply, or when using the remote module, are delivered to the wrong frame. This can occur if the application uses the remote module, calls webContents.sendToFrame, or calls event.reply in an IPC message handler. The impact of this vulnerability is that sensitive information or commands intended for a specific frame can be mistakenly delivered to a different frame, potentially leading to unauthorized access, data leakage, or other security issues.
How To Fix
Latest published version: 45.0.0 as of 22 Oct 2026
npm install electron@45.0.0Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 9.4.09.4.0npm install electron@9.4.0 -
>= 10.0.0, < 10.2.010.2.0npm install electron@10.2.0 -
>= 11.0.0, < 11.1.011.1.0npm install electron@11.1.0
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There are no known workarounds for this vulnerability. It is recommended to update Electron to the fixed versions mentioned above.
Conclusion
The vulnerability in Electron allows IPC messages to be delivered to the wrong frame, potentially leading to security issues such as unauthorized access and data leakage. To mitigate this vulnerability, developers should update Electron to the fixed versions mentioned in this advisory. There are no known workarounds for this issue. For further support or assistance, contact DevNack.com.
See every vulnerability recorded for electron →
FAQ
You can use the Vulert Playground at Vulert Scanner to check if your application is affected by this vulnerability. Simply upload your package-lock.json file and Vulert will analyze it to identify any vulnerable dependencies.
The consequences of this vulnerability include unauthorized access to sensitive information, data leakage, and potential security breaches. It is important to update Electron to the fixed versions to mitigate these risks.
There are no known exploits for this vulnerability at the time of this advisory. However, it is recommended to update Electron to the fixed versions to prevent any potential exploits in the future.
No, updating Electron to the fixed versions is the recommended solution for this vulnerability. There are no known manual fixes or workarounds.
For further support or assistance regarding this vulnerability, you can contact info@devnack.com. They can provide guidance on vulnerability remediation and answer any additional questions you may have.
References
Related vulnerabilities
Recent vulnerabilities recorded for electron.
