| Gói / sản phẩm | Phiên bản bị ảnh hưởng | Phiên bản đã vá |
|---|---|---|
| electron | ≥ 43.0.0-alpha.1, < 43.7.6≥ 44.0.0-alpha.1, < 44.5.0≥ 45.0.0-alpha.1, < 45.0.0-alpha.13< 42.11.9 | 43.7.644.5.045.0.0-alpha.1342.11.9 |
For pointerLock permission requests made from some cross-origin iframes, session.setPermissionRequestHandler() was given the top-level frame's requestingUrl and isMainFrame instead of the requesting frame's. Apps that grant pointer lock based on the requesting origin could grant it to embedded content under the top-level page's identity.
Apps are only affected if they embed untrusted content in iframes and decide pointerLock requests by origin in setPermissionRequestHandler. Apps that do not embed untrusted content, or that deny pointerLock for it, are not affected.
Deny the pointerLock permission for web contents that embed untrusted frames.
45.0.0-alpha.1344.5.043.7.642.11.9If you have any questions or comments about this advisory, email us at [email protected]
Bạn đang dùng một trong các sản phẩm này? Quét site để biết có đang lộ phiên bản có lỗ hổng không.
Quét site miễn phí