CVE-2020-26272 json
Electron vulnerable to ID collision when routing IPC messages to renderers containing OOPIFs
published 2021-01-28 5 y ago modified 2026-09-10 1 mo ago also GHSA-hvf8-h2qh-37m9 , EUVD-2021-0507
- cvss
- 5.4
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 1.7%
- EPSS 1.7% chance of exploitation in 30 days, percentile 77%
- public exploits
- 0
- none known
Summary
The Electron framework lets users write cross-platform desktop applications using JavaScript, HTML and CSS. In versions of Electron IPC prior to 9.4.0, 10.2.0, 11.1.0, and 12.0.0-beta.9, messages sent from the main process to a subframe in the renderer process, through webContents.sendToFrame, event.reply or when using the remote module, can in some cases be delivered to the wrong frame. If your app uses remote, calls webContents.sendToFrame, or calls event.reply in an IPC message handler then it is impacted by this issue. This has been fixed in versions 9.4.0, 10.2.0, 11.1.0, and 12.0.0-beta.9. There are no known workarounds for this issue.
Patch / fix
- npm electron 9.4.0, 10.2.0, 11.1.0
- electronjs electron 9.4.0, 10.2.0, 11.1.0
- electron Arch Linux 11.1.0-1
arch linux advisories AVG-1503
- github.com/electron/electron@07a1c2a commit
- github.com/electron/electron@0bbd268 commit
- github.com/electron/electron@36c695c commit
- github.com/electron/electron@4294000 commit
- github.com/electron/electron@5c8e7e8 commit
- github.com/electron/electron#26875 pull request
- github.com/electron/electron/releases/tag/v9.4.0 release
Exploit prediction
1.75% chance of exploitation in the next 30 days, higher than 77% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 5.4 | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N |
| NVD | 3.1 | 6.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N |
| NVD | 2.0 | 6.4 | AV:N/AC:L/Au:N/C:P/I:P/A:N |
| GitHub | 3.1 | 5.4 | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| npm | electron | <9.4.0 >=10.0.0, <10.2.0 >=11.0.0, <11.1.0 |
9.4.0 10.2.0 11.1.0 |
Affected products
- electron electron
Classification
- Weakness
-
- CWE-668 Exposure of Resource to Wrong Sphere
References
-
github.com
/electron/electron/pull/26875
web, third-party-advisory
-
github.com
/electron/electron/commit/07a1c2a3e5845901f7e2eda9506695be58edc73c
web, patch, third-party-advisory
-
github.com
/electron/electron/commit/0bbd268eb4caf35604443df5ff196980dd49e208
web
-
github.com
/electron/electron/commit/36c695ce2a7e22c07fe1e30c61c00d20371daee2
web
-
github.com
/electron/electron/commit/429400040ecb16a21d19936658579e65a797e4cc
web
-
github.com
/electron/electron/commit/5c8e7e8b7f485ceafa8b271086d7b87e1de9dedd
web
-
electronjs.org
/releases/stable?version=9#9.4.0
web, release-notes, vendor-advisory
-
github.com
/electron/electron/security/advisories/GHSA-hvf8-h2qh-37m9
web, third-party-advisory
-
github.com
/electron/electron/releases/tag/v9.4.0
web, release-notes, third-party-advisory
-
nvd.nist.gov
/vuln/detail/CVE-2020-26272
advisory
Sources
- CVE List CVE-2020-26272
- GitHub Advisory GHSA-hvf8-h2qh-37m9
- NVD CVE-2020-26272
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.