CVE-2020-15174 Unpreventable top-level navigation in Electron
Attackers can bypass navigation security controls in Electron apps via sub-frame top-level navigation, requiring an upgrade or iframe sandboxing.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2020-15174?
CVE-2020-15174 is a high-severity vulnerability in Electronjs Electron, published on 6 Oct 2020. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
In Electron before versions 11.0.0-beta.1, 10.0.1, 9.3.0 or 8.5.1 the `will-navigate` event that apps use to prevent navigations to unexpected destinations as per our security recommendations can be bypassed when a sub-frame performs a top-frame navigation across sites. The issue is patched in versions 11.0.0-beta.1, 10.0.1, 9.3.0 or 8.5.1 As a workaround sandbox all your iframes using the sandbox attribute. This will prevent them creating top-frame navigations and is good practice anyway.
Which versions are affected by CVE-2020-15174?
6 open source packages ship an affected version, including electron. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
electron npm | From 10.0.0-beta.0 | 10.0.1 |
electron npm | From 10.0.0-beta.0 | 10.0.1 |
electron npm | From 8.0.0-beta.0 | 8.5.1 |
electron npm | From 8.0.0-beta.0 | 8.5.1 |
electron npm | From 9.0.0-beta.0 | 9.3.0 |
electron npm | From 9.0.0-beta.0 | 9.3.0 |
Products include Electronjs Electron.
How do I fix CVE-2020-15174?
Upgrade electron to a fixed version for your release line: 10.0.1, 8.5.1 or 9.3.0.
Is CVE-2020-15174 being exploited?
There is no known exploitation of CVE-2020-15174 in the wild and no public exploit code.
Other vulnerabilities in Electronjs Electron
- CVE-2017-16151 Chromium Remote Code Execution in electron
- CVE-2018-1000118 Electron protocol handler browser vulnerable to Command Injection
- CVE-2026-34780 Electron: Context Isolation bypass via contextBridge VideoFrame transfer
- CVE-2026-102676 Electron: <webview> can enable Node.js integration in Web Workers despite embedder restrictions
- CVE-2026-102673 Electron drops inherited HTML sandbox restrictions for popups opened through OpenURLFromTab
Sources
Also known as GHSA-2q4g-w47c-4674.