| Package | Affected versions | Patched versions |
|---|---|---|
| electron | = 44.0.0≥ 42.0.0, < 42.9.2≥ 43.0.0, < 43.4.1< 41.10.6 | 42.9.243.4.141.10.6 |
| electron | ≥ 42.0.0-alpha.1, < 42.9.2≥ 43.0.0-alpha.1, < 43.4.1≥ 44.0.0-alpha.1, < 44.0.0-beta.5< 41.10.6 | 42.9.243.4.144.0.0-beta.541.10.6 |
Windows opened from a sandboxed top-level document did not inherit that document's HTML sandbox restrictions, so content that was meant to run sandboxed could open a window with the app's full origin. GHSA-hq2x-r82h-9wj4 covers the same issue for sandboxed iframes.
Apps are only affected if they render untrusted content in a sandboxed top-level document that allows popups. Apps that deny popups from untrusted content with setWindowOpenHandler are not affected.
Return { action: 'deny' } from setWindowOpenHandler for windows opened by untrusted content.
44.0.0-beta.543.4.142.9.241.10.6If you have any questions or comments about this advisory, email us at [email protected]
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free