CVE-2022-29247: Exposure of Resource to Wrong Sphere in Electron

Severity: critical (CVSS 9.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.0% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2022-06-13 · updated 2026-06-17
Weakness: CWE-668

Description

Electron is a framework for writing cross-platform desktop applications using JavaScript (JS), HTML, and CSS. A vulnerability in versions prior to 18.0.0-beta.6, 17.2.0, 16.2.6, and 15.5.5 allows a renderer with JS execution to obtain access to a new renderer process with `nodeIntegrationInSubFrames` enabled which in turn allows effective access to `ipcRenderer`. The `nodeIntegrationInSubFrames` option does not implicitly grant Node.js access. Rather, it depends on the existing sandbox setting. If an application is sandboxed, then `nodeIntegrationInSubFrames` just gives access to the sandboxed renderer APIs, which include `ipcRenderer`. If the application then additionally exposes IPC messages without IPC `senderFrame` validation that perform privileged actions or return confidential data this access to `ipcRenderer` can in turn compromise your application / user even with the sandbox enabled. Electron versions 18.0.0-beta.6, 17.2.0, 16.2.6, and 15.5.5 contain a fix for this issue. As a workaround, ensure that all IPC message handlers appropriately validate `senderFrame`.

Affected products

electron: before 15.5.5; from 16.0.1 before 16.2.6; from 17.0.1 before 17.2.0; 16.0.0-beta1, 16.0.0-beta2, 16.0.0-beta3, 16.0.0-beta4, 16.0.0-beta5, 16.0.0-beta6 (+17) — fixed in 15.5.5, 16.2.6, 17.2.0

How to fix

Upgrade to a fixed version: electron 15.5.5, 16.2.6, 17.2.0. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2022-29247 or the next vulnerability affects your stack