TI-2020-11946 Aliases CVE-2020-15174 GHSA-2q4g-w47c-4674

Unpreventable top-level navigation in Electron

LOW 36CWE-20Published 2020-10-06 · Updated 2024-08-04

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: High
Impact type: Security bypass
Confidentiality · integrity · availability: None · High · Low
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-693.

Summary

In Electron before versions 11.0.0-beta.1, 10.0.1, 9.3.0 or 8.5.1 the `will-navigate` event that apps use to prevent navigations to unexpected destinations as per our security recommendations can be bypassed when a sub-frame performs a top-frame navigation across sites. The issue is patched in versions 11.0.0-beta.1, 10.0.1, 9.3.0 or 8.5.1 As a workaround sandbox all your iframes using the sandbox attribute. This will prevent them creating top-frame navigations and is good practice anyway.

Why it matters now

EPSS 0.01346 71st percentileScored 2026-11-07

Fix Fixed electron (electron): 8.5.1, 9.3.0, 10.0.1electron (npm): 8.5.1, 9.3.0, 10.0.1

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
electron	electron	8.0.0-beta.0 to before 8.5.1; 9.0.0-beta.0 to before 9.3.0; 10.0.0-beta.0 to before 10.0.1	8.5.1, 9.3.0, 10.0.1	Patch available	CNA
—	electron (npm)	8.0.0-beta.0 to before 8.5.1	8.5.1	Patch available	GHSA-2q4g-w47c-4674
—	electron (npm)	9.0.0-beta.0 to before 9.3.0	9.3.0	Patch available	GHSA-2q4g-w47c-4674
—	electron (npm)	10.0.0-beta.0 to before 10.0.1	10.0.1	Patch available	GHSA-2q4g-w47c-4674

electron Vendorelectron Affected 8.0.0-beta.0 to before 8.5.1; 9.0.0-beta.0 to before 9.3.0; 10.0.0-beta.0 to before 10.0.1 Fixed in 8.5.1, 9.3.0, 10.0.1 Patch available CNA
electron (npm) Vendor— Affected 8.0.0-beta.0 to before 8.5.1 Fixed in 8.5.1 Patch available GHSA-2q4g-w47c-4674
electron (npm) Vendor— Affected 9.0.0-beta.0 to before 9.3.0 Fixed in 9.3.0 Patch available GHSA-2q4g-w47c-4674
electron (npm) Vendor— Affected 10.0.0-beta.0 to before 10.0.1 Fixed in 10.0.1 Patch available GHSA-2q4g-w47c-4674

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:electronjs:electron::::::::	8.0.0 to before 8.5.1; 9.0.0 to before 9.3.0; 10.0.0 to before 10.0.1	Vulnerable	Electronjs

cpe:2.3:a:electronjs:electron:*:*:*:*:*:*:*:* Versions 8.0.0 to before 8.5.1; 9.0.0 to before 9.3.0; 10.0.0 to before 10.0.1 Vulnerable ·Electronjs

Remediation

Fix · CNA electron (electron) Fixed in 8.5.1, 9.3.0, 10.0.1
Fix · GHSA-2q4g-w47c-4674 electron (npm) Fixed in 8.5.1 Advisory →
Fix · GHSA-2q4g-w47c-4674 electron (npm) Fixed in 9.3.0 Advisory →
Fix · GHSA-2q4g-w47c-4674 electron (npm) Fixed in 10.0.1 Advisory →

Timeline

2026-10-02 Threatist record created from CVE-2020-15174
2026-10-03 Alias added: GHSA-2q4g-w47c-4674

References

Patch 1

https://github.com/electron/electron/commit/18613925610ba319da7f497b6deed85ad712c59b

Advisory 2

Other 1

https://github.com/electron/electron

TI-2026-39496 Information disclosure in electron-builder CVSS 4.0HIGH 8.2
TI-2024-26621 Code Signing Bypass on Windows in electron-updater < 6.3.0-alpha.6 CVSS 3.1HIGH 7.5
TI-2023-09452 Content-Secrity-Policy disabling eval not applied consistently in renderers with sandbox disabled in Electron CVSS 3.1CRITICAL 9.8
TI-2026-39157 Electron: Buffer performs incorrect byte length calculations resulting in heap buffer under/overflow CVSS 4.0CRITICAL 9.3
TI-2017-09308 GitHub Electron before 1.6.8 allows remote command execution because of a nodeIntegration… CVSS 3.0HIGH 8.1
TI-2022-11788 Exposure of Resource to Wrong Sphere in Electron CVSS 3.1CRITICAL 9.8

See all 74 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences