The Electron framework lets users write cross-platform desktop applications using JavaScript, HTML and CSS. In versions of Electron IPC prior to 9.4.0, 10.2.0, 11.1.0, and 12.0.0-beta.9, messages sent from the main process to a subframe in the renderer process, through webContents.sendToFrame, event.reply or when using the remote module, can in some cases be delivered to the wrong frame. If your app uses remote, calls webContents.sendToFrame, or calls event.reply in an IPC message handler then it is impacted by this issue. This has been fixed in versions 9.4.0, 10.2.0, 11.1.0, and 12.0.0-beta.9. There are no known workarounds for this issue.
[
{
"signature_version": "v1",
"source": "https://github.com/electron/electron/commit/0bbd268eb4caf35604443df5ff196980dd49e208",
"signature_type": "Line",
"target": {
"file": "shell/common/api/remote/remote_callback_freer.h"
},
"id": "CVE-2020-26272-04e82f0c",
"digest": {
"line_hashes": [
"313032440630604907223703712367315031497",
"83197735551558352911174960639675331891",
"262455343727397153432625609602267453818",
"147742664690478424494676506633580142686",
"117244084029845088249232771183968328361",
"103401991121920233803149889087050468015",
"183123773462621202266894728999170444351",
"147742664690478424494676506633580142686",
"185174950397666370123716889882210309977",
"110054631361664851758590526695117882308",
"88369396556858057782605083516530217270",
"83554369435245901066597023302882475732"
],
"threshold": 0.9
},
"deprecated": false
},
{
"signature_version": "v1",
"source": "https://github.com/electron/electron/commit/5c8e7e8b7f485ceafa8b271086d7b87e1de9dedd",
"signature_type": "Line",
"target": {
"file": "shell/common/api/remote/remote_callback_freer.h"
},
"id": "CVE-2020-26272-0841a569",
"digest": {
"line_hashes": [
"313032440630604907223703712367315031497",
"83197735551558352911174960639675331891",
"262455343727397153432625609602267453818",
"147742664690478424494676506633580142686",
"117244084029845088249232771183968328361",
"103401991121920233803149889087050468015",
"183123773462621202266894728999170444351",
"147742664690478424494676506633580142686",
"185174950397666370123716889882210309977",
"110054631361664851758590526695117882308",
"88369396556858057782605083516530217270",
"83554369435245901066597023302882475732"
],
"threshold": 0.9
},
"deprecated": false
},
{
"signature_version": "v1",
"source": "https://github.com/electron/electron/commit/07a1c2a3e5845901f7e2eda9506695be58edc73c",
"signature_type": "Line",
"target": {
"file": "shell/common/gin_helper/event_emitter.cc"
},
"id": "CVE-2020-26272-14cbf949",
"digest": {
"line_hashes": [
"245984452434646337200063399336997769655",
"132475682388429538998910461779838567299",
"181795265450562538829351116307706265918",
"183474686773543786798413565345237138256",
"65061730555892512890488248059829659862",
"179966689541382938445925330339670496392",
"104157118008051671957768437988763371346"
],
"threshold": 0.9
},
"deprecated": false
},
{
"signature_version": "v1",
"source": "https://github.com/electron/electron/commit/5c8e7e8b7f485ceafa8b271086d7b87e1de9dedd",
"signature_type": "Line",
"target": {
"file": "shell/browser/api/electron_api_web_contents.cc"
},
"id": "CVE-2020-26272-1838074a",
"digest": {
"line_hashes": [
"287205841254502126395013713886078832934",
"142898809094716955430341410026077155259",
"15439720782795250393735098077939218399",
"182950242858280576171103341694523513130",
"5876225114195792717144737006117293343",
"223290068118242090994011858547218091545",
"236632885221594991751031321296683685587",
"206214436811680868532001440442209278227",
"178641189899975236565140470433134671115",
"2508836763789185739556126658258170977",
"246033333725504385989276433967000175798",
"102290467538447217642659619127202112389",
"318062980058434488377787339922332087419",
"296451280269323490138728269617060190838",
"256060359665179448562459742671970585680",
"295845677708379514334721721017657725002",
"301725277742181896432511116192743128019"
],
"threshold": 0.9
},
"deprecated": false
},
{
"signature_version": "v1",
"source": "https://github.com/electron/electron/commit/0bbd268eb4caf35604443df5ff196980dd49e208",
"signature_type": "Line",
"target": {
"file": "shell/browser/api/electron_api_web_contents.h"
},
"id": "CVE-2020-26272-19cf83ae",
"digest": {
"line_hashes": [
"259626012671428820934679576571791564272",
"190888827895443283507189164906074420513",
"140114056141223143105956523774720280216",
"323984724206437864177961710133179841237"
],
"threshold": 0.9
},
"deprecated": false
},
{
"signature_version": "v1",
"source": "https://github.com/electron/electron/commit/0bbd268eb4caf35604443df5ff196980dd49e208",
"signature_type": "Line",
"target": {
"file": "shell/common/api/remote/remote_callback_freer.cc"
},
"id": "CVE-2020-26272-24e86639",
"digest": {
"line_hashes": [
"286546095561722849304899761614243606370",
"18594053933147830935146762621454189881",
"231744994441500991232230753212301907421",
"147742664690478424494676506633580142686",
"225478983946948299042794069263406854697",
"155908254062235301081122339545368807131",
"113263493416511065577179012511659304799",
"33770344712824465416138643710495897284",
"65467732814744102592409384208054786610",
"50465836792174489854299633506672120570",
"156228786641059252339118863713545955313",
"58034794325934109090949819898393575455",
"147742664690478424494676506633580142686",
"62473832892499251564086550250572886934",
"268875754937602499414675415335897911256",
"82413767142776151616339699397539184835",
"326328112980054107830867134204970401986",
"337799738599541814054532293596149286346",
"332440534599940154327226532152897528635",
"132554946538616583053448283770668316321",
"219414745585961351299723657212182395995",
"121202287163674045107233119935464359180",
"78589303759395228020773884345992410259",
"276741656170477293699742489778032574516",
"232976832141171976369752706427772500095",
"293955162568213765605321527794583283599",
"127370560358776926474583449499664163330",
"254610680437732091224903217537865617309",
"20363517208715894320276692211536556011",
"236238828480783366741635939204395195924",
"184631512299303109827892524831286415373"
],
"threshold": 0.9
},
"deprecated": false
},
{
"signature_version": "v1",
"source": "https://github.com/electron/electron/commit/36c695ce2a7e22c07fe1e30c61c00d20371daee2",
"signature_type": "Line",
"target": {
"file": "shell/browser/api/electron_api_web_contents.h"
},
"id": "CVE-2020-26272-28568229",
"digest": {
"line_hashes": [
"259626012671428820934679576571791564272",
"190888827895443283507189164906074420513",
"140114056141223143105956523774720280216",
"323984724206437864177961710133179841237"
],
"threshold": 0.9
},
"deprecated": false
},
{
"signature_version": "v1",
"source": "https://github.com/electron/electron/commit/5c8e7e8b7f485ceafa8b271086d7b87e1de9dedd",
"signature_type": "Line",
"target": {
"file": "shell/common/gin_helper/event_emitter.cc"
},
"id": "CVE-2020-26272-30546e15",
"digest": {
"line_hashes": [
"245984452434646337200063399336997769655",
"132475682388429538998910461779838567299",
"181795265450562538829351116307706265918",
"183474686773543786798413565345237138256",
"65061730555892512890488248059829659862",
"179966689541382938445925330339670496392",
"104157118008051671957768437988763371346"
],
"threshold": 0.9
},
"deprecated": false
},
{
"signature_version": "v1",
"source": "https://github.com/electron/electron/commit/429400040ecb16a21d19936658579e65a797e4cc",
"signature_type": "Line",
"target": {
"file": "shell/browser/api/electron_api_web_contents.h"
},
"id": "CVE-2020-26272-5c372b63",
"digest": {
"line_hashes": [
"259626012671428820934679576571791564272",
"190888827895443283507189164906074420513",
"140114056141223143105956523774720280216",
"323984724206437864177961710133179841237"
],
"threshold": 0.9
},
"deprecated": false
},
{
"signature_version": "v1",
"source": "https://github.com/electron/electron/commit/0bbd268eb4caf35604443df5ff196980dd49e208",
"signature_type": "Function",
"target": {
"function": "RemoteCallbackFreer::RunDestructor",
"file": "shell/common/api/remote/remote_callback_freer.cc"
},
"id": "CVE-2020-26272-77e39721",
"digest": {
"length": 576.0,
"function_hash": "213465454861229333496615410510581771599"
},
"deprecated": false
},
{
"signature_version": "v1",
"source": "https://github.com/electron/electron/commit/429400040ecb16a21d19936658579e65a797e4cc",
"signature_type": "Line",
"target": {
"file": "shell/common/gin_helper/event_emitter.cc"
},
"id": "CVE-2020-26272-8487b6c8",
"digest": {
"line_hashes": [
"245984452434646337200063399336997769655",
"132475682388429538998910461779838567299",
"181795265450562538829351116307706265918",
"183474686773543786798413565345237138256",
"65061730555892512890488248059829659862",
"179966689541382938445925330339670496392",
"104157118008051671957768437988763371346"
],
"threshold": 0.9
},
"deprecated": false
},
{
"signature_version": "v1",
"source": "https://github.com/electron/electron/commit/5c8e7e8b7f485ceafa8b271086d7b87e1de9dedd",
"signature_type": "Line",
"target": {
"file": "shell/common/api/remote/remote_callback_freer.cc"
},
"id": "CVE-2020-26272-88bc5f8d",
"digest": {
"line_hashes": [
"286546095561722849304899761614243606370",
"18594053933147830935146762621454189881",
"231744994441500991232230753212301907421",
"147742664690478424494676506633580142686",
"225478983946948299042794069263406854697",
"155908254062235301081122339545368807131",
"113263493416511065577179012511659304799",
"33770344712824465416138643710495897284",
"65467732814744102592409384208054786610",
"50465836792174489854299633506672120570",
"156228786641059252339118863713545955313",
"58034794325934109090949819898393575455",
"147742664690478424494676506633580142686",
"62473832892499251564086550250572886934",
"268875754937602499414675415335897911256",
"82413767142776151616339699397539184835",
"326328112980054107830867134204970401986",
"337799738599541814054532293596149286346",
"332440534599940154327226532152897528635",
"132554946538616583053448283770668316321",
"219414745585961351299723657212182395995",
"121202287163674045107233119935464359180",
"78589303759395228020773884345992410259",
"276741656170477293699742489778032574516",
"232976832141171976369752706427772500095",
"293955162568213765605321527794583283599",
"127370560358776926474583449499664163330",
"254610680437732091224903217537865617309",
"20363517208715894320276692211536556011",
"236238828480783366741635939204395195924",
"184631512299303109827892524831286415373"
],
"threshold": 0.9
},
"deprecated": false
},
{
"signature_version": "v1",
"source": "https://github.com/electron/electron/commit/07a1c2a3e5845901f7e2eda9506695be58edc73c",
"signature_type": "Line",
"target": {
"file": "shell/browser/api/electron_api_web_contents.h"
},
"id": "CVE-2020-26272-a1de8ade",
"digest": {
"line_hashes": [
"16023040936284061033740414276037819986",
"261015332494660348124059935672633569702",
"252396433010161011977279938552784780172",
"323984724206437864177961710133179841237"
],
"threshold": 0.9
},
"deprecated": false
},
{
"signature_version": "v1",
"source": "https://github.com/electron/electron/commit/0bbd268eb4caf35604443df5ff196980dd49e208",
"signature_type": "Line",
"target": {
"file": "shell/browser/api/electron_api_web_contents.cc"
},
"id": "CVE-2020-26272-a55e3956",
"digest": {
"line_hashes": [
"287205841254502126395013713886078832934",
"142898809094716955430341410026077155259",
"15439720782795250393735098077939218399",
"182950242858280576171103341694523513130",
"5876225114195792717144737006117293343",
"223290068118242090994011858547218091545",
"236632885221594991751031321296683685587",
"206214436811680868532001440442209278227",
"178641189899975236565140470433134671115",
"2508836763789185739556126658258170977",
"246033333725504385989276433967000175798",
"102290467538447217642659619127202112389",
"318062980058434488377787339922332087419",
"296451280269323490138728269617060190838",
"256060359665179448562459742671970585680",
"295845677708379514334721721017657725002",
"301725277742181896432511116192743128019"
],
"threshold": 0.9
},
"deprecated": false
},
{
"signature_version": "v1",
"source": "https://github.com/electron/electron/commit/0bbd268eb4caf35604443df5ff196980dd49e208",
"signature_type": "Line",
"target": {
"file": "shell/common/gin_helper/event_emitter.cc"
},
"id": "CVE-2020-26272-acb847cf",
"digest": {
"line_hashes": [
"245984452434646337200063399336997769655",
"132475682388429538998910461779838567299",
"181795265450562538829351116307706265918",
"183474686773543786798413565345237138256",
"65061730555892512890488248059829659862",
"179966689541382938445925330339670496392",
"104157118008051671957768437988763371346"
],
"threshold": 0.9
},
"deprecated": false
},
{
"signature_version": "v1",
"source": "https://github.com/electron/electron/commit/5c8e7e8b7f485ceafa8b271086d7b87e1de9dedd",
"signature_type": "Function",
"target": {
"function": "RemoteCallbackFreer::RunDestructor",
"file": "shell/common/api/remote/remote_callback_freer.cc"
},
"id": "CVE-2020-26272-bb1a7427",
"digest": {
"length": 576.0,
"function_hash": "213465454861229333496615410510581771599"
},
"deprecated": false
},
{
"signature_version": "v1",
"source": "https://github.com/electron/electron/commit/36c695ce2a7e22c07fe1e30c61c00d20371daee2",
"signature_type": "Line",
"target": {
"file": "shell/common/gin_helper/event_emitter.cc"
},
"id": "CVE-2020-26272-bd0a0966",
"digest": {
"line_hashes": [
"245984452434646337200063399336997769655",
"132475682388429538998910461779838567299",
"181795265450562538829351116307706265918",
"183474686773543786798413565345237138256",
"65061730555892512890488248059829659862",
"179966689541382938445925330339670496392",
"104157118008051671957768437988763371346"
],
"threshold": 0.9
},
"deprecated": false
},
{
"signature_version": "v1",
"source": "https://github.com/electron/electron/commit/36c695ce2a7e22c07fe1e30c61c00d20371daee2",
"signature_type": "Line",
"target": {
"file": "shell/browser/api/electron_api_web_contents.cc"
},
"id": "CVE-2020-26272-d814d793",
"digest": {
"line_hashes": [
"287205841254502126395013713886078832934",
"142898809094716955430341410026077155259",
"15439720782795250393735098077939218399",
"153759453852004843131803498537909663200",
"219031189397780464877209732934955614333",
"223290068118242090994011858547218091545",
"236632885221594991751031321296683685587",
"206214436811680868532001440442209278227",
"178641189899975236565140470433134671115",
"2508836763789185739556126658258170977",
"246033333725504385989276433967000175798",
"102290467538447217642659619127202112389",
"318062980058434488377787339922332087419",
"296451280269323490138728269617060190838",
"256060359665179448562459742671970585680",
"295845677708379514334721721017657725002",
"301725277742181896432511116192743128019"
],
"threshold": 0.9
},
"deprecated": false
},
{
"signature_version": "v1",
"source": "https://github.com/electron/electron/commit/5c8e7e8b7f485ceafa8b271086d7b87e1de9dedd",
"signature_type": "Line",
"target": {
"file": "shell/browser/api/electron_api_web_contents.h"
},
"id": "CVE-2020-26272-e0c806e8",
"digest": {
"line_hashes": [
"259626012671428820934679576571791564272",
"190888827895443283507189164906074420513",
"140114056141223143105956523774720280216",
"323984724206437864177961710133179841237"
],
"threshold": 0.9
},
"deprecated": false
},
{
"signature_version": "v1",
"source": "https://github.com/electron/electron/commit/07a1c2a3e5845901f7e2eda9506695be58edc73c",
"signature_type": "Line",
"target": {
"file": "shell/browser/api/electron_api_web_contents.cc"
},
"id": "CVE-2020-26272-e21c650f",
"digest": {
"line_hashes": [
"106505602959973383940994886937260803597",
"235996486376174733981178229482520875689",
"173302040137704966800277636069628800380",
"153759453852004843131803498537909663200",
"219031189397780464877209732934955614333",
"223290068118242090994011858547218091545",
"236632885221594991751031321296683685587",
"206214436811680868532001440442209278227",
"178641189899975236565140470433134671115",
"2508836763789185739556126658258170977",
"246033333725504385989276433967000175798",
"102290467538447217642659619127202112389",
"318062980058434488377787339922332087419",
"296451280269323490138728269617060190838",
"55404362077133348940758015694065464844",
"204093587208131812488658372570920700381",
"247419182561815150224337625135513180335"
],
"threshold": 0.9
},
"deprecated": false
},
{
"signature_version": "v1",
"source": "https://github.com/electron/electron/commit/429400040ecb16a21d19936658579e65a797e4cc",
"signature_type": "Line",
"target": {
"file": "shell/browser/api/electron_api_web_contents.cc"
},
"id": "CVE-2020-26272-ec7ded07",
"digest": {
"line_hashes": [
"287205841254502126395013713886078832934",
"142898809094716955430341410026077155259",
"15439720782795250393735098077939218399",
"153759453852004843131803498537909663200",
"219031189397780464877209732934955614333",
"223290068118242090994011858547218091545",
"236632885221594991751031321296683685587",
"206214436811680868532001440442209278227",
"178641189899975236565140470433134671115",
"2508836763789185739556126658258170977",
"246033333725504385989276433967000175798",
"102290467538447217642659619127202112389",
"318062980058434488377787339922332087419",
"296451280269323490138728269617060190838",
"256060359665179448562459742671970585680",
"295845677708379514334721721017657725002",
"301725277742181896432511116192743128019"
],
"threshold": 0.9
},
"deprecated": false
}
]