Lack of isolation methods In electron
Description
Electron: nodeIntegrationInWorker not correctly scoped in shared renderer processes
Impact
The nodeIntegrationInWorker webPreference was not correctly scoped in all configurations. In certain process-sharing scenarios, workers spawned in frames configured with nodeIntegrationInWorker: false could still receive Node.js integration.
Apps are only affected if they enable nodeIntegrationInWorker. Apps that do not use nodeIntegrationInWorker are not affected.
Workarounds
Avoid enabling nodeIntegrationInWorker in apps that also open child windows or embed content with differing webPreferences.
Fixed Versions
41.0.0
40.8.4
39.8.4
38.8.6
For more information
If there are any questions or comments about this advisory, please email [email protected]
Mitigation
Update Impact
Minimal update. May introduce new vulnerabilities or breaking changes.
Ecosystem | Package | Affected version | Patched versions |
|---|---|---|---|
 npm | 38.8.6, 39.8.4, 40.8.4, 41.0.0 |
Aliases
References