{"id":"CVE-2020-4077","details":"In Electron before versions 7.2.4, 8.2.4, and 9.0.0-beta21, there is a context isolation bypass. Code running in the main world context in the renderer can reach into the isolated Electron context and perform privileged actions. Apps using both `contextIsolation` and `contextBridge` are affected. This is fixed in versions 9.0.0-beta.21, 8.2.4 and 7.2.4.","aliases":["GHSA-h9jc-284h-533g"],"modified":"2026-08-07T11:30:59.967073773Z","published":"2020-07-07T00:15:10.700Z","database_specific":{"unresolved_ranges":[{"source":"CPE_STRING","vendor_product":"electronjs:electron","cpes":["cpe:2.3:a:electronjs:electron:9.0.0:beta10:*:*:*:*:*:*","cpe:2.3:a:electronjs:electron:9.0.0:beta11:*:*:*:*:*:*","cpe:2.3:a:electronjs:electron:9.0.0:beta12:*:*:*:*:*:*","cpe:2.3:a:electronjs:electron:9.0.0:beta13:*:*:*:*:*:*","cpe:2.3:a:electronjs:electron:9.0.0:beta14:*:*:*:*:*:*","cpe:2.3:a:electronjs:electron:9.0.0:beta15:*:*:*:*:*:*","cpe:2.3:a:electronjs:electron:9.0.0:beta16:*:*:*:*:*:*","cpe:2.3:a:electronjs:electron:9.0.0:beta17:*:*:*:*:*:*","cpe:2.3:a:electronjs:electron:9.0.0:beta18:*:*:*:*:*:*","cpe:2.3:a:electronjs:electron:9.0.0:beta19:*:*:*:*:*:*","cpe:2.3:a:electronjs:electron:9.0.0:beta1:*:*:*:*:*:*","cpe:2.3:a:electronjs:electron:9.0.0:beta20:*:*:*:*:*:*","cpe:2.3:a:electronjs:electron:9.0.0:beta2:*:*:*:*:*:*","cpe:2.3:a:electronjs:electron:9.0.0:beta3:*:*:*:*:*:*","cpe:2.3:a:electronjs:electron:9.0.0:beta4:*:*:*:*:*:*","cpe:2.3:a:electronjs:electron:9.0.0:beta5:*:*:*:*:*:*","cpe:2.3:a:electronjs:electron:9.0.0:beta6:*:*:*:*:*:*","cpe:2.3:a:electronjs:electron:9.0.0:beta7:*:*:*:*:*:*","cpe:2.3:a:electronjs:electron:9.0.0:beta8:*:*:*:*:*:*","cpe:2.3:a:electronjs:electron:9.0.0:beta9:*:*:*:*:*:*"],"extracted_events":[{"introduced":"9.0.0-beta1"},{"last_affected":"9.0.0-beta1"},{"introduced":"9.0.0-beta10"},{"last_affected":"9.0.0-beta10"},{"introduced":"9.0.0-beta11"},{"last_affected":"9.0.0-beta11"},{"introduced":"9.0.0-beta12"},{"last_affected":"9.0.0-beta12"},{"introduced":"9.0.0-beta13"},{"last_affected":"9.0.0-beta13"},{"introduced":"9.0.0-beta14"},{"last_affected":"9.0.0-beta14"},{"introduced":"9.0.0-beta15"},{"last_affected":"9.0.0-beta15"},{"introduced":"9.0.0-beta16"},{"last_affected":"9.0.0-beta16"},{"introduced":"9.0.0-beta17"},{"last_affected":"9.0.0-beta17"},{"introduced":"9.0.0-beta18"},{"last_affected":"9.0.0-beta18"},{"introduced":"9.0.0-beta19"},{"last_affected":"9.0.0-beta19"},{"introduced":"9.0.0-beta2"},{"last_affected":"9.0.0-beta2"},{"introduced":"9.0.0-beta20"},{"last_affected":"9.0.0-beta20"},{"introduced":"9.0.0-beta3"},{"last_affected":"9.0.0-beta3"},{"introduced":"9.0.0-beta4"},{"last_affected":"9.0.0-beta4"},{"introduced":"9.0.0-beta5"},{"last_affected":"9.0.0-beta5"},{"introduced":"9.0.0-beta6"},{"last_affected":"9.0.0-beta6"},{"introduced":"9.0.0-beta7"},{"last_affected":"9.0.0-beta7"},{"introduced":"9.0.0-beta8"},{"last_affected":"9.0.0-beta8"},{"introduced":"9.0.0-beta9"},{"last_affected":"9.0.0-beta9"}]}]},"references":[{"type":"ADVISORY","url":"https://github.com/electron/electron/security/advisories/GHSA-h9jc-284h-533g"},{"type":"ADVISORY","url":"https://www.electronjs.org/releases/stable?page=3#release-notes-for-v824"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/electron/electron","events":[{"introduced":"3083693e67632720b8d12b32d3811be0f4336318"},{"fixed":"0552e0d5de46ffa3b481d741f1db5c779e201565"},{"introduced":"1af3a71fdbb3130fd581b12d8f5a7440e7a04fc6"},{"fixed":"d8f90444aa654f886016a22cb771df99c3616178"},{"introduced":"4da01641ce50cf5a8b6f39717e4c447f89455dfa"},{"last_affected":"4da01641ce50cf5a8b6f39717e4c447f89455dfa"}],"database_specific":{"cpe":["cpe:2.3:a:electronjs:electron:*:*:*:*:*:*:*:*","cpe:2.3:a:electronjs:electron:9.0.0:-:*:*:*:*:*:*"],"extracted_events":[{"introduced":"7.0.0"},{"fixed":"7.2.4"},{"introduced":"8.0.0"},{"fixed":"8.2.4"},{"introduced":"9.0.0-NA"},{"last_affected":"9.0.0-NA"}],"source":["CPE_RANGE","CPE_STRING"]}}],"versions":["9.0.0-NA","v9.0.0","v7.2.3","v8.2.3","v8.2.2","v7.2.2","v8.2.1","v7.2.1","v8.2.0","v7.2.0","v8.1.1","v8.1.0","v8.0.3","v7.1.14","v8.0.2","v7.1.13","v8.0.1","v7.1.12","v8.0.0","v7.1.11","v7.1.10","v7.1.9","v7.1.8","v7.1.7","v7.1.6","v7.1.5","v7.1.4","v7.1.3","v7.1.2","v7.1.1","v7.1.0","v7.0.1","v7.0.0"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2020-4077.json"}}],"schema_version":"1.8.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H"}]}