CVE-2020-15215 Context isolation bypass in Electron

What is CVE-2020-15215?

CVE-2020-15215 is a medium-severity vulnerability in Electronjs Electron, published on 6 Oct 2020. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Electron before versions 11.0.0-beta.6, 10.1.2, 9.3.1 or 8.5.2 is vulnerable to a context isolation bypass. Apps using both `contextIsolation` and `sandbox: true` are affected. Apps using both `contextIsolation` and `nodeIntegrationInSubFrames: true` are affected. This is a context isolation bypass, meaning that code running in the main world context in the renderer can reach into the isolated Electron context and perform privileged actions.

Weakness: CWE-693, CWE-668

Which versions are affected by CVE-2020-15215?

8 open source packages ship an affected version, including electron. It affects 1 product.

Products include Electronjs Electron.

How do I fix CVE-2020-15215?

Upgrade electron to a fixed version for your release line: 10.1.2, 11.0.0-beta.6, 8.5.2 or 9.3.1.

Is CVE-2020-15215 being exploited?

There is no known exploitation of CVE-2020-15215 in the wild and no public exploit code.

Public exploit code: 1 proofs of concept on GitHub.

Other vulnerabilities in Electronjs Electron

• CVE-2017-16151 Chromium Remote Code Execution in electron Critical 9.8
• CVE-2018-1000118 Electron protocol handler browser vulnerable to Command Injection High 8.8
• CVE-2026-34780 Electron: Context Isolation bypass via contextBridge VideoFrame transfer High 8.4
• CVE-2026-102676 Electron: <webview> can enable Node.js integration in Web Workers despite embedder restrictions High 8.3
• CVE-2026-102673 Electron drops inherited HTML sandbox restrictions for popups opened through OpenURLFromTab High 8.2

All Electronjs Electron vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-56pc-6jqp-xqj8.