CVE-2022-21718 Renderers can obtain access to random bluetooth device without permission in Electron
Renderers can access random Bluetooth devices without permission if the app lacks a custom device selection handler, exposing sensitive hardware data.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2022-21718?
CVE-2022-21718 is a low-severity missing authorization vulnerability in Electronjs Electron, published on 22 Mar 2022. An attacker needs administrator access to exploit it, and only if a user opens a file or follows a link.
Official description
Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. A vulnerability in versions prior to `17.0.0-alpha.6`, `16.0.6`, `15.3.5`, `14.2.4`, and `13.6.6` allows renderers to obtain access to a bluetooth device via the web bluetooth API if the app has not configured a custom `select-bluetooth-device` event handler. This has been patched and Electron versions `17.0.0-alpha.6`, `16.0.6`, `15.3.5`, `14.2.4`, and `13.6.6` contain the fix. Code from the GitHub Security Advisory can be added to the app to work around the issue.
Which versions are affected by CVE-2022-21718?
10 open source packages ship an affected version, including electron. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
electron npm | All versions | 13.6.6 |
electron npm | All versions | 13.6.6 |
electron npm | From 14.0.0-beta.1 | 14.2.4 |
electron npm | From 14.0.0-beta.1 | 14.2.4 |
electron npm | From 15.0.0-beta.1 | 15.3.5 |
electron npm | From 15.0.0-beta.1 | 15.3.5 |
4 more packages
electron npm | From 16.0.0-beta.1 | 16.0.6 |
electron npm | From 16.0.0-beta.1 | 16.0.6 |
electron npm | From 17.0.0-alpha.1 | 17.0.0-alpha.6 |
electron npm | From 17.0.0-alpha.1 | 17.0.0-alpha.6 |
Products include Electronjs Electron.
How do I fix CVE-2022-21718?
Upgrade electron to a fixed version for your release line: 13.6.6, 14.2.4, 15.3.5 or 16.0.6.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2022-21718 being exploited?
There is no known exploitation of CVE-2022-21718 in the wild and no public exploit code.
Other vulnerabilities in Electronjs Electron
- CVE-2017-16151 Chromium Remote Code Execution in electron
- CVE-2018-1000118 Electron protocol handler browser vulnerable to Command Injection
- CVE-2026-34780 Electron: Context Isolation bypass via contextBridge VideoFrame transfer
- CVE-2026-102676 Electron: <webview> can enable Node.js integration in Web Workers despite embedder restrictions
- CVE-2026-102673 Electron drops inherited HTML sandbox restrictions for popups opened through OpenURLFromTab
Sources
Also known as GHSA-3p22-ghq8-v749.