{"id":"CVE-2020-15215","details":"Electron before versions 11.0.0-beta.6, 10.1.2, 9.3.1 or 8.5.2 is vulnerable to a context isolation bypass. Apps using both `contextIsolation` and `sandbox: true` are affected. Apps using both `contextIsolation` and `nodeIntegrationInSubFrames: true` are affected. This is a context isolation bypass, meaning that code running in the main world context in the renderer can reach into the isolated Electron context and perform privileged actions.","aliases":["GHSA-56pc-6jqp-xqj8"],"modified":"2026-08-07T11:31:23.731887370Z","published":"2020-10-06T18:15:14.797Z","database_specific":{"unresolved_ranges":[{"source":"CPE_STRING","vendor_product":"electronjs:electron","cpes":["cpe:2.3:a:electronjs:electron:10.0.0:beta10:*:*:*:*:*:*","cpe:2.3:a:electronjs:electron:10.0.0:beta11:*:*:*:*:*:*","cpe:2.3:a:electronjs:electron:10.0.0:beta12:*:*:*:*:*:*","cpe:2.3:a:electronjs:electron:10.0.0:beta13:*:*:*:*:*:*","cpe:2.3:a:electronjs:electron:10.0.0:beta14:*:*:*:*:*:*","cpe:2.3:a:electronjs:electron:10.0.0:beta15:*:*:*:*:*:*","cpe:2.3:a:electronjs:electron:10.0.0:beta16:*:*:*:*:*:*","cpe:2.3:a:electronjs:electron:10.0.0:beta17:*:*:*:*:*:*","cpe:2.3:a:electronjs:electron:10.0.0:beta18:*:*:*:*:*:*","cpe:2.3:a:electronjs:electron:10.0.0:beta19:*:*:*:*:*:*","cpe:2.3:a:electronjs:electron:10.0.0:beta1:*:*:*:*:*:*","cpe:2.3:a:electronjs:electron:10.0.0:beta20:*:*:*:*:*:*","cpe:2.3:a:electronjs:electron:10.0.0:beta21:*:*:*:*:*:*","cpe:2.3:a:electronjs:electron:10.0.0:beta22:*:*:*:*:*:*","cpe:2.3:a:electronjs:electron:10.0.0:beta23:*:*:*:*:*:*","cpe:2.3:a:electronjs:electron:10.0.0:beta24:*:*:*:*:*:*","cpe:2.3:a:electronjs:electron:10.0.0:beta25:*:*:*:*:*:*","cpe:2.3:a:electronjs:electron:10.0.0:beta2:*:*:*:*:*:*","cpe:2.3:a:electronjs:electron:10.0.0:beta3:*:*:*:*:*:*","cpe:2.3:a:electronjs:electron:10.0.0:beta4:*:*:*:*:*:*","cpe:2.3:a:electronjs:electron:10.0.0:beta5:*:*:*:*:*:*","cpe:2.3:a:electronjs:electron:10.0.0:beta6:*:*:*:*:*:*","cpe:2.3:a:electronjs:electron:10.0.0:beta7:*:*:*:*:*:*","cpe:2.3:a:electronjs:electron:10.0.0:beta8:*:*:*:*:*:*","cpe:2.3:a:electronjs:electron:10.0.0:beta9:*:*:*:*:*:*","cpe:2.3:a:electronjs:electron:11.0.0:beta0:*:*:*:*:*:*","cpe:2.3:a:electronjs:electron:11.0.0:beta1:*:*:*:*:*:*","cpe:2.3:a:electronjs:electron:11.0.0:beta2:*:*:*:*:*:*","cpe:2.3:a:electronjs:electron:11.0.0:beta3:*:*:*:*:*:*","cpe:2.3:a:electronjs:electron:11.0.0:beta4:*:*:*:*:*:*","cpe:2.3:a:electronjs:electron:11.0.0:beta5:*:*:*:*:*:*","cpe:2.3:a:electronjs:electron:8.0.0:beta0:*:*:*:*:*:*","cpe:2.3:a:electronjs:electron:8.0.0:beta1:*:*:*:*:*:*","cpe:2.3:a:electronjs:electron:8.0.0:beta2:*:*:*:*:*:*","cpe:2.3:a:electronjs:electron:8.0.0:beta3:*:*:*:*:*:*","cpe:2.3:a:electronjs:electron:8.0.0:beta4:*:*:*:*:*:*","cpe:2.3:a:electronjs:electron:8.0.0:beta5:*:*:*:*:*:*","cpe:2.3:a:electronjs:electron:8.0.0:beta6:*:*:*:*:*:*","cpe:2.3:a:electronjs:electron:8.0.0:beta7:*:*:*:*:*:*","cpe:2.3:a:electronjs:electron:8.0.0:beta8:*:*:*:*:*:*","cpe:2.3:a:electronjs:electron:8.0.0:beta9:*:*:*:*:*:*","cpe:2.3:a:electronjs:electron:9.0.0:beta0:*:*:*:*:*:*","cpe:2.3:a:electronjs:electron:9.0.0:beta10:*:*:*:*:*:*","cpe:2.3:a:electronjs:electron:9.0.0:beta11:*:*:*:*:*:*","cpe:2.3:a:electronjs:electron:9.0.0:beta12:*:*:*:*:*:*","cpe:2.3:a:electronjs:electron:9.0.0:beta13:*:*:*:*:*:*","cpe:2.3:a:electronjs:electron:9.0.0:beta14:*:*:*:*:*:*","cpe:2.3:a:electronjs:electron:9.0.0:beta15:*:*:*:*:*:*","cpe:2.3:a:electronjs:electron:9.0.0:beta16:*:*:*:*:*:*","cpe:2.3:a:electronjs:electron:9.0.0:beta17:*:*:*:*:*:*","cpe:2.3:a:electronjs:electron:9.0.0:beta18:*:*:*:*:*:*","cpe:2.3:a:electronjs:electron:9.0.0:beta19:*:*:*:*:*:*","cpe:2.3:a:electronjs:electron:9.0.0:beta1:*:*:*:*:*:*","cpe:2.3:a:electronjs:electron:9.0.0:beta20:*:*:*:*:*:*","cpe:2.3:a:electronjs:electron:9.0.0:beta2:*:*:*:*:*:*","cpe:2.3:a:electronjs:electron:9.0.0:beta3:*:*:*:*:*:*","cpe:2.3:a:electronjs:electron:9.0.0:beta4:*:*:*:*:*:*","cpe:2.3:a:electronjs:electron:9.0.0:beta5:*:*:*:*:*:*","cpe:2.3:a:electronjs:electron:9.0.0:beta6:*:*:*:*:*:*","cpe:2.3:a:electronjs:electron:9.0.0:beta7:*:*:*:*:*:*","cpe:2.3:a:electronjs:electron:9.0.0:beta8:*:*:*:*:*:*","cpe:2.3:a:electronjs:electron:9.0.0:beta9:*:*:*:*:*:*"],"extracted_events":[{"introduced":"8.0.0-beta0"},{"last_affected":"8.0.0-beta0"},{"introduced":"8.0.0-beta1"},{"last_affected":"8.0.0-beta1"},{"introduced":"8.0.0-beta2"},{"last_affected":"8.0.0-beta2"},{"introduced":"8.0.0-beta3"},{"last_affected":"8.0.0-beta3"},{"introduced":"8.0.0-beta4"},{"last_affected":"8.0.0-beta4"},{"introduced":"8.0.0-beta5"},{"last_affected":"8.0.0-beta5"},{"introduced":"8.0.0-beta6"},{"last_affected":"8.0.0-beta6"},{"introduced":"8.0.0-beta7"},{"last_affected":"8.0.0-beta7"},{"introduced":"8.0.0-beta8"},{"last_affected":"8.0.0-beta8"},{"introduced":"8.0.0-beta9"},{"last_affected":"8.0.0-beta9"},{"introduced":"9.0.0-beta0"},{"last_affected":"9.0.0-beta0"},{"introduced":"9.0.0-beta1"},{"last_affected":"9.0.0-beta1"},{"introduced":"9.0.0-beta10"},{"last_affected":"9.0.0-beta10"},{"introduced":"9.0.0-beta11"},{"last_affected":"9.0.0-beta11"},{"introduced":"9.0.0-beta12"},{"last_affected":"9.0.0-beta12"},{"introduced":"9.0.0-beta13"},{"last_affected":"9.0.0-beta13"},{"introduced":"9.0.0-beta14"},{"last_affected":"9.0.0-beta14"},{"introduced":"9.0.0-beta15"},{"last_affected":"9.0.0-beta15"},{"introduced":"9.0.0-beta16"},{"last_affected":"9.0.0-beta16"},{"introduced":"9.0.0-beta17"},{"last_affected":"9.0.0-beta17"},{"introduced":"9.0.0-beta18"},{"last_affected":"9.0.0-beta18"},{"introduced":"9.0.0-beta19"},{"last_affected":"9.0.0-beta19"},{"introduced":"9.0.0-beta2"},{"last_affected":"9.0.0-beta2"},{"introduced":"9.0.0-beta20"},{"last_affected":"9.0.0-beta20"},{"introduced":"9.0.0-beta3"},{"last_affected":"9.0.0-beta3"},{"introduced":"9.0.0-beta4"},{"last_affected":"9.0.0-beta4"},{"introduced":"9.0.0-beta5"},{"last_affected":"9.0.0-beta5"},{"introduced":"9.0.0-beta6"},{"last_affected":"9.0.0-beta6"},{"introduced":"9.0.0-beta7"},{"last_affected":"9.0.0-beta7"},{"introduced":"9.0.0-beta8"},{"last_affected":"9.0.0-beta8"},{"introduced":"9.0.0-beta9"},{"last_affected":"9.0.0-beta9"},{"introduced":"10.0.0-beta1"},{"last_affected":"10.0.0-beta1"},{"introduced":"10.0.0-beta10"},{"last_affected":"10.0.0-beta10"},{"introduced":"10.0.0-beta11"},{"last_affected":"10.0.0-beta11"},{"introduced":"10.0.0-beta12"},{"last_affected":"10.0.0-beta12"},{"introduced":"10.0.0-beta13"},{"last_affected":"10.0.0-beta13"},{"introduced":"10.0.0-beta14"},{"last_affected":"10.0.0-beta14"},{"introduced":"10.0.0-beta15"},{"last_affected":"10.0.0-beta15"},{"introduced":"10.0.0-beta16"},{"last_affected":"10.0.0-beta16"},{"introduced":"10.0.0-beta17"},{"last_affected":"10.0.0-beta17"},{"introduced":"10.0.0-beta18"},{"last_affected":"10.0.0-beta18"},{"introduced":"10.0.0-beta19"},{"last_affected":"10.0.0-beta19"},{"introduced":"10.0.0-beta2"},{"last_affected":"10.0.0-beta2"},{"introduced":"10.0.0-beta20"},{"last_affected":"10.0.0-beta20"},{"introduced":"10.0.0-beta21"},{"last_affected":"10.0.0-beta21"},{"introduced":"10.0.0-beta22"},{"last_affected":"10.0.0-beta22"},{"introduced":"10.0.0-beta23"},{"last_affected":"10.0.0-beta23"},{"introduced":"10.0.0-beta24"},{"last_affected":"10.0.0-beta24"},{"introduced":"10.0.0-beta25"},{"last_affected":"10.0.0-beta25"},{"introduced":"10.0.0-beta3"},{"last_affected":"10.0.0-beta3"},{"introduced":"10.0.0-beta4"},{"last_affected":"10.0.0-beta4"},{"introduced":"10.0.0-beta5"},{"last_affected":"10.0.0-beta5"},{"introduced":"10.0.0-beta6"},{"last_affected":"10.0.0-beta6"},{"introduced":"10.0.0-beta7"},{"last_affected":"10.0.0-beta7"},{"introduced":"10.0.0-beta8"},{"last_affected":"10.0.0-beta8"},{"introduced":"10.0.0-beta9"},{"last_affected":"10.0.0-beta9"},{"introduced":"11.0.0-beta0"},{"last_affected":"11.0.0-beta0"},{"introduced":"11.0.0-beta1"},{"last_affected":"11.0.0-beta1"},{"introduced":"11.0.0-beta2"},{"last_affected":"11.0.0-beta2"},{"introduced":"11.0.0-beta3"},{"last_affected":"11.0.0-beta3"},{"introduced":"11.0.0-beta4"},{"last_affected":"11.0.0-beta4"},{"introduced":"11.0.0-beta5"},{"last_affected":"11.0.0-beta5"}]}]},"references":[{"type":"ADVISORY","url":"https://github.com/electron/electron/security/advisories/GHSA-56pc-6jqp-xqj8"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/electron/electron","events":[{"introduced":"1af3a71fdbb3130fd581b12d8f5a7440e7a04fc6"},{"last_affected":"34a246e3ce4643699346ddcd2ee81000e08fa35c"}],"database_specific":{"extracted_events":[{"introduced":"8.0.0-NA"},{"last_affected":"8.0.0-NA"},{"introduced":"8.0.1-NA"},{"last_affected":"8.0.1-NA"},{"introduced":"8.0.2-NA"},{"last_affected":"8.0.2-NA"},{"introduced":"8.0.3-NA"},{"last_affected":"8.0.3-NA"},{"introduced":"8.1.0-NA"},{"last_affected":"8.1.0-NA"},{"introduced":"8.1.1-NA"},{"last_affected":"8.1.1-NA"},{"introduced":"8.2.0-NA"},{"last_affected":"8.2.0-NA"},{"introduced":"8.2.1-NA"},{"last_affected":"8.2.1-NA"},{"introduced":"8.2.2-NA"},{"last_affected":"8.2.2-NA"},{"introduced":"8.2.3-NA"},{"last_affected":"8.2.3-NA"},{"introduced":"8.2.4-NA"},{"last_affected":"8.2.4-NA"},{"introduced":"8.2.5-NA"},{"last_affected":"8.2.5-NA"},{"introduced":"8.3.0-NA"},{"last_affected":"8.3.0-NA"},{"introduced":"8.3.1-NA"},{"last_affected":"8.3.1-NA"},{"introduced":"8.3.2-NA"},{"last_affected":"8.3.2-NA"},{"introduced":"8.3.3-NA"},{"last_affected":"8.3.3-NA"},{"introduced":"8.3.4-NA"},{"last_affected":"8.3.4-NA"},{"introduced":"8.4.0-NA"},{"last_affected":"8.4.0-NA"},{"introduced":"8.4.1-NA"},{"last_affected":"8.4.1-NA"},{"introduced":"8.5.0-NA"},{"last_affected":"8.5.0-NA"},{"introduced":"8.5.1-NA"},{"last_affected":"8.5.1-NA"},{"introduced":"9.0.0-NA"},{"last_affected":"9.0.0-NA"},{"introduced":"9.0.1-NA"},{"last_affected":"9.0.1-NA"},{"introduced":"9.0.2-NA"},{"last_affected":"9.0.2-NA"},{"introduced":"9.0.3-NA"},{"last_affected":"9.0.3-NA"},{"introduced":"9.0.4-NA"},{"last_affected":"9.0.4-NA"},{"introduced":"9.0.5-NA"},{"last_affected":"9.0.5-NA"},{"introduced":"9.0.6-NA"},{"last_affected":"9.0.6-NA"},{"introduced":"9.1.0-NA"},{"last_affected":"9.1.0-NA"},{"introduced":"9.1.1-NA"},{"last_affected":"9.1.1-NA"},{"introduced":"9.1.2-NA"},{"last_affected":"9.1.2-NA"},{"introduced":"9.2.0-NA"},{"last_affected":"9.2.0-NA"},{"introduced":"9.2.1-NA"},{"last_affected":"9.2.1-NA"},{"introduced":"9.3.0-NA"},{"last_affected":"9.3.0-NA"},{"introduced":"10.0.0-NA"},{"last_affected":"10.0.0-NA"},{"introduced":"10.0.1-NA"},{"last_affected":"10.0.1-NA"},{"introduced":"10.1.0-NA"},{"last_affected":"10.1.0-NA"},{"introduced":"10.1.1-NA"},{"last_affected":"10.1.1-NA"}],"source":"CPE_STRING","cpe":["cpe:2.3:a:electronjs:electron:8.0.0:-:*:*:*:*:*:*","cpe:2.3:a:electronjs:electron:8.0.1:-:*:*:*:*:*:*","cpe:2.3:a:electronjs:electron:8.0.2:-:*:*:*:*:*:*","cpe:2.3:a:electronjs:electron:8.0.3:-:*:*:*:*:*:*","cpe:2.3:a:electronjs:electron:8.1.0:-:*:*:*:*:*:*","cpe:2.3:a:electronjs:electron:8.1.1:-:*:*:*:*:*:*","cpe:2.3:a:electronjs:electron:8.2.0:-:*:*:*:*:*:*","cpe:2.3:a:electronjs:electron:8.2.1:-:*:*:*:*:*:*","cpe:2.3:a:electronjs:electron:8.2.2:-:*:*:*:*:*:*","cpe:2.3:a:electronjs:electron:8.2.3:-:*:*:*:*:*:*","cpe:2.3:a:electronjs:electron:8.2.4:-:*:*:*:*:*:*","cpe:2.3:a:electronjs:electron:8.2.5:-:*:*:*:*:*:*","cpe:2.3:a:electronjs:electron:8.3.0:-:*:*:*:*:*:*","cpe:2.3:a:electronjs:electron:8.3.1:-:*:*:*:*:*:*","cpe:2.3:a:electronjs:electron:8.3.2:-:*:*:*:*:*:*","cpe:2.3:a:electronjs:electron:8.3.3:-:*:*:*:*:*:*","cpe:2.3:a:electronjs:electron:8.3.4:-:*:*:*:*:*:*","cpe:2.3:a:electronjs:electron:8.4.0:-:*:*:*:*:*:*","cpe:2.3:a:electronjs:electron:8.4.1:-:*:*:*:*:*:*","cpe:2.3:a:electronjs:electron:8.5.0:-:*:*:*:*:*:*","cpe:2.3:a:electronjs:electron:8.5.1:-:*:*:*:*:*:*","cpe:2.3:a:electronjs:electron:9.0.0:-:*:*:*:*:*:*","cpe:2.3:a:electronjs:electron:9.0.1:-:*:*:*:*:*:*","cpe:2.3:a:electronjs:electron:9.0.2:-:*:*:*:*:*:*","cpe:2.3:a:electronjs:electron:9.0.3:-:*:*:*:*:*:*","cpe:2.3:a:electronjs:electron:9.0.4:-:*:*:*:*:*:*","cpe:2.3:a:electronjs:electron:9.0.5:-:*:*:*:*:*:*","cpe:2.3:a:electronjs:electron:9.0.6:-:*:*:*:*:*:*","cpe:2.3:a:electronjs:electron:9.1.0:-:*:*:*:*:*:*","cpe:2.3:a:electronjs:electron:9.1.1:-:*:*:*:*:*:*","cpe:2.3:a:electronjs:electron:9.1.2:-:*:*:*:*:*:*","cpe:2.3:a:electronjs:electron:9.2.0:-:*:*:*:*:*:*","cpe:2.3:a:electronjs:electron:9.2.1:-:*:*:*:*:*:*","cpe:2.3:a:electronjs:electron:9.3.0:-:*:*:*:*:*:*","cpe:2.3:a:electronjs:electron:10.0.0:-:*:*:*:*:*:*","cpe:2.3:a:electronjs:electron:10.0.1:-:*:*:*:*:*:*","cpe:2.3:a:electronjs:electron:10.1.0:-:*:*:*:*:*:*","cpe:2.3:a:electronjs:electron:10.1.1:-:*:*:*:*:*:*"]}}],"versions":["10.0.0-NA","10.0.1-NA","10.1.0-NA","10.1.1-NA","8.0.0-NA","8.0.1-NA","8.0.2-NA","8.0.3-NA","8.1.0-NA","8.1.1-NA","8.2.0-NA","8.2.1-NA","8.2.2-NA","8.2.3-NA","8.2.4-NA","8.2.5-NA","8.3.0-NA","8.3.1-NA","8.3.2-NA","8.3.3-NA","8.3.4-NA","8.4.0-NA","8.4.1-NA","8.5.0-NA","8.5.1-NA","9.0.0-NA","9.0.1-NA","9.0.2-NA","9.0.3-NA","9.0.4-NA","9.0.5-NA","9.0.6-NA","9.1.0-NA","9.1.1-NA","9.1.2-NA","9.2.0-NA","9.2.1-NA","9.3.0-NA"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2020-15215.json"}}],"schema_version":"1.8.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L"}]}