GHSA-m55f-7gqj-fr98
Suggest an improvement- Source
- https://github.com/advisories/GHSA-m55f-7gqj-fr98
- Import Source
- https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/08/GHSA-m55f-7gqj-fr98/GHSA-m55f-7gqj-fr98.json
- JSON Data
- https://api.osv.dev/v1/vulns/GHSA-m55f-7gqj-fr98
- Aliases
- Published
- 2026-08-05T15:57:11Z
- Modified
- 2026-08-05T16:11:06Z
- Severity
-
- 6.6 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:L/A:N CVSS Calculator
- Summary
- Electron: Extension tab APIs operate across session boundaries
- Details
-
Impact
Extension tab and scripting APIs were not scoped to the extension's own
session. A malicious or compromised extension loaded into one session could navigate, script, and read from windows belonging to a different session.Apps are only affected if they load Chrome extensions via
session.loadExtensionand rely on separate sessions to isolate that extension from other content. Apps that do not load extensions, or that use a single session, are not affected.Workarounds
Only load extensions from sources you trust; do not rely on session separation alone to contain an extension.
Fixed Versions
42.0.0-beta.341.2.140.9.039.8.8
For more information
If you have any questions or comments about this advisory, email Electron at security@electronjs.org
- Database specific
{ "cwe_ids": [ "CWE-284" ], "github_reviewed": true, "github_reviewed_at": "2026-08-05T15:57:11Z", "nvd_published_at": null, "severity": "MODERATE" }- References
Affected packages
npm / electron
Package
- Name
- electron
- View open source insights on deps.dev
- Purl
- pkg:npm/electron
npm / electron
Package
- Name
- electron
- View open source insights on deps.dev
- Purl
- pkg:npm/electron
npm / electron
Package
- Name
- electron
- View open source insights on deps.dev
- Purl
- pkg:npm/electron
npm / electron
Package
- Name
- electron
- View open source insights on deps.dev
- Purl
- pkg:npm/electron