1130 matches found
CVE-2020-4077 Context isolation bypass via contextBridge in Electron
In Electron before versions 7.2.4, 8.2.4, and 9.0.0-beta21, there is a context isolation bypass. Code running in the main world context in the renderer can reach into the isolated Electron context and perform privileged actions. Apps using both contextIsolation and contextBridge are affected. Thi...
CVE-2020-4077
In Electron before versions 7.2.4, 8.2.4, and 9.0.0-beta21, there is a context isolation bypass. Code running in the main world context in the renderer can reach into the isolated Electron context and perform privileged actions. Apps using both "contextIsolation" and "contextBridge" are affected...
CVE-2020-4077
In Electron, a context isolation bypass affects versions prior to 7.2.4, 8.2.4, and 9.0.0-beta21 where code in the main world of a renderer can access the isolated Electron context when both contextIsolation and contextBridge are used. The issue is fixed in 7.2.4, 8.2.4, and 9.0.0-beta.21. Mitiga...
GHSA-H9JC-284H-533G Context isolation bypass via contextBridge in Electron
Impact Apps using both contextIsolation and contextBridge are affected. This is a context isolation bypass, meaning that code running in the main world context in the renderer can reach into the isolated Electron context and perform privileged actions. Workarounds There are no app-side workaround...
PT-2020-17865
Name of the Vulnerable Software and Affected Versions Electron versions prior to 7.2.4 Electron versions prior to 8.2.4 Electron versions prior to 9.0.0-beta21 Description The issue is a context isolation bypass, allowing code running in the main world context in the renderer to reach into the...
PT-2020-17866
Name of the Vulnerable Software and Affected Versions Electron versions prior to 7.2.4 Electron versions prior to 8.2.4 Electron versions prior to 9.0.0-beta21 Description The issue is a context isolation bypass, allowing code running in the main world context in the renderer to reach into the...
CVE-2020-15096: Trust Boundary Violation
In Electron before versions 6.1.1, 7.2.4, 8.2.4, and 9.0.0-beta21, there is a context isolation bypass, meaning that code running in the main world context in the renderer can reach into the isolated Electron context and perform privileged actions. Apps using "contextIsolation" are affected. Ther...
CVE-2020-4077: Trust Boundary Violation
In Electron before versions 7.2.4, 8.2.4, and 9.0.0-beta21, there is a context isolation bypass. Code running in the main world context in the renderer can reach into the isolated Electron context and perform privileged actions. Apps using both contextIsolation and contextBridge are affected. Thi...
PT-2020-14181
Name of the Vulnerable Software and Affected Versions Electron versions prior to 6.1.1 Electron versions prior to 7.2.4 Electron versions prior to 8.2.4 Electron versions prior to 9.0.0-beta21 Description The issue is a context isolation bypass, meaning that code running in the main world context...
CVE-2020-4076: Trust Boundary Violation
In Electron before versions 7.2.4, 8.2.4, and 9.0.0-beta21, there is a context isolation bypass. Code running in the main world context in the renderer can reach into the isolated Electron context and perform privileged actions. Apps using contextIsolation are affected. This is fixed in versions...
PT-2020-6530
Name of the Vulnerable Software and Affected Versions Google Chrome on Android versions prior to 83.0.4103.106 Description The issue is related to insufficient policy enforcement in the WebView component, allowing a remote attacker to bypass site isolation. This can be achieved via a crafted HTML...
CVE-2020-6456: Incorrect Default Permissions
Insufficient validation of untrusted input in clipboard in Google Chrome prior to 81.0.4044.92 allowed a local attacker to bypass site isolation via crafted clipboard contents...
PT-2020-3420
Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 81.0.4044.92 Description The issue is related to insufficient validation of untrusted input in the clipboard, which can be exploited by a local attacker to bypass site isolation. This can potentially allow a...
CVE-2020-6425
Insufficient policy enforcement in extensions in Google Chrome prior to 80.0.3987.149 allowed an attacker who convinced a user to install a malicious extension to bypass site isolation via a crafted Chrome Extension...
CVE-2020-6425: Improper Input Validation
Insufficient policy enforcement in extensions in Google Chrome prior to 80.0.3987.149 allowed an attacker who convinced a user to install a malicious extension to bypass site isolation via a crafted Chrome Extension...
PT-2020-2080
Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 80.0.3987.149 Description The issue is related to insufficient policy enforcement in extensions, allowing an attacker to bypass site isolation via a crafted Chrome Extension if a user installs a malicious...
Vulnerability of the window.global component in the Firefox browser: This component allows a hacker to access confidential data, compromise its integrity, and cause service failures.
The vulnerability of the window.global component in the Firefox browser is related to an error in the Object.getOwnPropertyNameswindow method. This error allows for bypassing the isolated programming environment. Exploiting this vulnerability can enable a remote attacker to gain access to...
DEBIAN-CVE-2020-6380
Insufficient policy enforcement in extensions in Google Chrome prior to 79.0.3945.130 allowed a remote attacker who had compromised the renderer process to bypass site isolation via a crafted Chrome Extension...
