CVE-2020-15215: Context isolation bypass in Electron

Severity: medium (CVSS 5.6 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.7% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2020-10-06 · updated 2026-06-17
Weakness: CWE-668

Description

Electron before versions 11.0.0-beta.6, 10.1.2, 9.3.1 or 8.5.2 is vulnerable to a context isolation bypass. Apps using both `contextIsolation` and `sandbox: true` are affected. Apps using both `contextIsolation` and `nodeIntegrationInSubFrames: true` are affected. This is a context isolation bypass, meaning that code running in the main world context in the renderer can reach into the isolated Electron context and perform privileged actions.

Affected products

electron: 8.0.0, 8.0.0-beta0, 8.0.0-beta1, 8.0.0-beta2, 8.0.0-beta3, 8.0.0-beta4 (+94)

References

https://github.com/electron/electron/security/advisories/GHSA-56pc-6jqp-xqj8
https://github.com/electron/electron/security/advisories/GHSA-56pc-6jqp-xqj8

Get alerted when CVE-2020-15215 or the next vulnerability affects your stack