CVE-2017-16151

Severity: critical (CVSS 9.8 v3.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 2.7% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2018-06-07 · updated 2026-06-17
Weakness: CWE-94

Description

Based on details posted by the ElectronJS team; A remote code execution vulnerability has been discovered in Google Chromium that affects all recent versions of Electron. Any Electron app that accesses remote content is vulnerable to this exploit, regardless of whether the [sandbox option](https://electron.atom.io/docs/api/sandbox-option) is enabled.

Affected products

electron: before 1.7.8 — fixed in 1.7.8

How to fix

Upgrade to a fixed version: electron 1.7.8. Check the vendor advisory for mitigations.

References

https://electron.atom.io/blog/2017/09/27/chromium-rce-vulnerability-fix
https://nodesecurity.io/advisories/539
https://electron.atom.io/blog/2017/09/27/chromium-rce-vulnerability-fix
https://nodesecurity.io/advisories/539

Get alerted when CVE-2017-16151 or the next vulnerability affects your stack