Skip to content
Fencer Vulns
high 7.5

CVE-2020-15174 json

Unpreventable top-level navigation in Electron

published 2020-10-06 6 y ago modified 2026-07-08 4 mo ago also GHSA-2q4g-w47c-4674 , EUVD-2020-1401

cvss
7.5
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
1.3%
EPSS 1.3% chance of exploitation in 30 days, percentile 71%
public exploits
0
none known

Summary

In Electron before versions 11.0.0-beta.1, 10.0.1, 9.3.0 or 8.5.1 the `will-navigate` event that apps use to prevent navigations to unexpected destinations as per our security recommendations can be bypassed when a sub-frame performs a top-frame navigation across sites. The issue is patched in versions 11.0.0-beta.1, 10.0.1, 9.3.0 or 8.5.1 As a workaround sandbox all your iframes using the sandbox attribute. This will prevent them creating top-frame navigations and is good practice anyway.

Patch / fix

  • npm electron 8.5.1, 9.3.0, 10.0.1
  • electronjs electron 8.5.1, 9.3.0, 10.0.1

Exploit prediction

1.35% chance of exploitation in the next 30 days, higher than 71% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 3.1 7.5 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:L
NVD 3.1 7.5 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:L
NVD 2.0 5.8 AV:N/AC:M/Au:N/C:N/I:P/A:P
GitHub 3.1 7.5 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:L

Affected packages

ecosystem package affected fixed in
npm electron
>=8.0.0-beta.0, <8.5.1
>=9.0.0-beta.0, <9.3.0
>=10.0.0-beta.0, <10.0.1
8.5.1
9.3.0
10.0.1

Affected products

  • electron electron

Classification

Weakness
  • CWE-693 Protection Mechanism Failure
  • CWE-20 Improper Input Validation

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.