VDB
KO
MEDIUM 5.9

GHSA-xj5x-m3f3-5x3h

Electron: Service worker can spoof executeJavaScript IPC replies

Details

### Impact A service worker running in a session could spoof reply messages on the internal IPC channel used by `webContents.executeJavaScript()` and related methods, causing the main-process promise to resolve with attacker-controlled data.

Apps are only affected if they have service workers registered and use the result of `webContents.executeJavaScript()` (or `webFrameMain.executeJavaScript()`) in security-sensitive decisions.

### Workarounds Do not trust the return value of `webContents.executeJavaScript()` for security decisions. Use dedicated, validated IPC channels for security-relevant communication with renderers.

### Fixed Versions * `41.0.0` * `40.8.1` * `39.8.1` * `38.8.6`

### For more information If there are any questions or comments about this advisory, please email [security@electronjs.org](mailto:security@electronjs.org)

Are you affected?

Enter the version of the package you're using.

Affected packages

npm / electron
Introduced in: 0 Fixed in: 38.8.6
Fix npm install electron@38.8.6
npm / electron
Introduced in: 39.0.0-alpha.1 Fixed in: 39.8.1
Fix npm install electron@39.8.1
npm / electron
Introduced in: 40.0.0-alpha.1 Fixed in: 40.8.1
Fix npm install electron@40.8.1
npm / electron
Introduced in: 41.0.0-alpha.1 Fixed in: 41.0.0
Fix npm install electron@41.0.0

References