1008 matches found
CVE-2020-15096
In Electron before versions 6.1.1, 7.2.4, 8.2.4, and 9.0.0-beta21, there is a context isolation bypass, meaning that code running in the main world context in the renderer can reach into the isolated Electron context and perform privileged actions. Apps using "contextIsolation" are affected. Ther...
CVE-2020-15096
CVE-2020-15096 affects Electron before versions 6.1.1, 7.2.4, 8.2.4, and 9.0.0-beta21. A context isolation bypass allows code running in the renderer’s main world context to reach into the isolated Electron context and perform privileged actions. The issue impacts apps that enable contextIsolatio...
CVE-2020-4076 Context isolation bypass via leaked cross-context objects in Electron
In Electron before versions 7.2.4, 8.2.4, and 9.0.0-beta21, there is a context isolation bypass. Code running in the main world context in the renderer can reach into the isolated Electron context and perform privileged actions. Apps using contextIsolation are affected. This is fixed in versions...
CVE-2020-4077 Context isolation bypass via contextBridge in Electron
In Electron before versions 7.2.4, 8.2.4, and 9.0.0-beta21, there is a context isolation bypass. Code running in the main world context in the renderer can reach into the isolated Electron context and perform privileged actions. Apps using both contextIsolation and contextBridge are affected. Thi...
CVE-2020-4077
In Electron, a context isolation bypass affects versions prior to 7.2.4, 8.2.4, and 9.0.0-beta21 where code in the main world of a renderer can access the isolated Electron context when both contextIsolation and contextBridge are used. The issue is fixed in 7.2.4, 8.2.4, and 9.0.0-beta.21. Mitiga...
GHSA-H9JC-284H-533G Context isolation bypass via contextBridge in Electron
Impact Apps using both contextIsolation and contextBridge are affected. This is a context isolation bypass, meaning that code running in the main world context in the renderer can reach into the isolated Electron context and perform privileged actions. Workarounds There are no app-side workaround...
CVE-2020-4076: Trust Boundary Violation
In Electron before versions 7.2.4, 8.2.4, and 9.0.0-beta21, there is a context isolation bypass. Code running in the main world context in the renderer can reach into the isolated Electron context and perform privileged actions. Apps using contextIsolation are affected. This is fixed in versions...
CVE-2020-4077: Trust Boundary Violation
In Electron before versions 7.2.4, 8.2.4, and 9.0.0-beta21, there is a context isolation bypass. Code running in the main world context in the renderer can reach into the isolated Electron context and perform privileged actions. Apps using both contextIsolation and contextBridge are affected. Thi...
CVE-2020-15096: Trust Boundary Violation
In Electron before versions 6.1.1, 7.2.4, 8.2.4, and 9.0.0-beta21, there is a context isolation bypass, meaning that code running in the main world context in the renderer can reach into the isolated Electron context and perform privileged actions. Apps using "contextIsolation" are affected. Ther...
CVE-2020-6456: Incorrect Default Permissions
Insufficient validation of untrusted input in clipboard in Google Chrome prior to 81.0.4044.92 allowed a local attacker to bypass site isolation via crafted clipboard contents...
CVE-2020-6425: Improper Input Validation
Insufficient policy enforcement in extensions in Google Chrome prior to 80.0.3987.149 allowed an attacker who convinced a user to install a malicious extension to bypass site isolation via a crafted Chrome Extension...
Vulnerability of the window.global component in the Firefox browser: This component allows a hacker to access confidential data, compromise its integrity, and cause service failures.
The vulnerability of the window.global component in the Firefox browser is related to an error in the Object.getOwnPropertyNameswindow method. This error allows for bypassing the isolated programming environment. Exploiting this vulnerability can enable a remote attacker to gain access to...
DEBIAN-CVE-2020-6385
Insufficient policy enforcement in storage in Google Chrome prior to 80.0.3987.87 allowed a remote attacker to bypass site isolation via a crafted HTML page...
DEBIAN-CVE-2020-6380
Insufficient policy enforcement in extensions in Google Chrome prior to 79.0.3945.130 allowed a remote attacker who had compromised the renderer process to bypass site isolation via a crafted Chrome Extension...
CVE-2020-6385
Insufficient policy enforcement in storage in Google Chrome prior to 80.0.3987.87 allowed a remote attacker to bypass site isolation via a crafted HTML page...
UBUNTU-CVE-2020-6380
Insufficient policy enforcement in extensions in Google Chrome prior to 79.0.3945.130 allowed a remote attacker who had compromised the renderer process to bypass site isolation via a crafted Chrome Extension...
CVE-2020-6385: Improper Check for Unusual or Exceptional Conditions
Insufficient policy enforcement in storage in Google Chrome prior to 80.0.3987.87 allowed a remote attacker to bypass site isolation via a crafted HTML page...
CVE-2020-6380: Incorrect Authorization
Insufficient policy enforcement in extensions in Google Chrome prior to 79.0.3945.130 allowed a remote attacker who had compromised the renderer process to bypass site isolation via a crafted Chrome Extension...