The Electron framework lets users write cross-platform desktop applications using JavaScript, HTML and CSS. In versions of Electron IPC prior to 9.4.0, 10.2.0, 11.1.0, and 12.0.0-beta.9, messages sent from the main process to a subframe in the renderer process, through webContents.sendToFrame, event.reply or when using the remote module, can in some cases be delivered to the wrong frame. If your app uses remote, calls webContents.sendToFrame, or calls event.reply in an IPC message handler then it is impacted by this issue. This has been fixed in versions 9.4.0, 10.2.0, 11.1.0, and 12.0.0-beta.9. There are no known workarounds for this issue.
[
    {
        "id": "CVE-2020-26272-04e82f0c",
        "deprecated": false,
        "signature_version": "v1",
        "signature_type": "Line",
        "digest": {
            "line_hashes": [
                "313032440630604907223703712367315031497",
                "83197735551558352911174960639675331891",
                "262455343727397153432625609602267453818",
                "147742664690478424494676506633580142686",
                "117244084029845088249232771183968328361",
                "103401991121920233803149889087050468015",
                "183123773462621202266894728999170444351",
                "147742664690478424494676506633580142686",
                "185174950397666370123716889882210309977",
                "110054631361664851758590526695117882308",
                "88369396556858057782605083516530217270",
                "83554369435245901066597023302882475732"
            ],
            "threshold": 0.9
        },
        "target": {
            "file": "shell/common/api/remote/remote_callback_freer.h"
        },
        "source": "https://github.com/electron/electron/commit/0bbd268eb4caf35604443df5ff196980dd49e208"
    },
    {
        "id": "CVE-2020-26272-0841a569",
        "deprecated": false,
        "signature_version": "v1",
        "signature_type": "Line",
        "digest": {
            "line_hashes": [
                "313032440630604907223703712367315031497",
                "83197735551558352911174960639675331891",
                "262455343727397153432625609602267453818",
                "147742664690478424494676506633580142686",
                "117244084029845088249232771183968328361",
                "103401991121920233803149889087050468015",
                "183123773462621202266894728999170444351",
                "147742664690478424494676506633580142686",
                "185174950397666370123716889882210309977",
                "110054631361664851758590526695117882308",
                "88369396556858057782605083516530217270",
                "83554369435245901066597023302882475732"
            ],
            "threshold": 0.9
        },
        "target": {
            "file": "shell/common/api/remote/remote_callback_freer.h"
        },
        "source": "https://github.com/electron/electron/commit/5c8e7e8b7f485ceafa8b271086d7b87e1de9dedd"
    },
    {
        "id": "CVE-2020-26272-14cbf949",
        "deprecated": false,
        "signature_version": "v1",
        "signature_type": "Line",
        "digest": {
            "line_hashes": [
                "245984452434646337200063399336997769655",
                "132475682388429538998910461779838567299",
                "181795265450562538829351116307706265918",
                "183474686773543786798413565345237138256",
                "65061730555892512890488248059829659862",
                "179966689541382938445925330339670496392",
                "104157118008051671957768437988763371346"
            ],
            "threshold": 0.9
        },
        "target": {
            "file": "shell/common/gin_helper/event_emitter.cc"
        },
        "source": "https://github.com/electron/electron/commit/07a1c2a3e5845901f7e2eda9506695be58edc73c"
    },
    {
        "id": "CVE-2020-26272-1838074a",
        "deprecated": false,
        "signature_version": "v1",
        "signature_type": "Line",
        "digest": {
            "line_hashes": [
                "287205841254502126395013713886078832934",
                "142898809094716955430341410026077155259",
                "15439720782795250393735098077939218399",
                "182950242858280576171103341694523513130",
                "5876225114195792717144737006117293343",
                "223290068118242090994011858547218091545",
                "236632885221594991751031321296683685587",
                "206214436811680868532001440442209278227",
                "178641189899975236565140470433134671115",
                "2508836763789185739556126658258170977",
                "246033333725504385989276433967000175798",
                "102290467538447217642659619127202112389",
                "318062980058434488377787339922332087419",
                "296451280269323490138728269617060190838",
                "256060359665179448562459742671970585680",
                "295845677708379514334721721017657725002",
                "301725277742181896432511116192743128019"
            ],
            "threshold": 0.9
        },
        "target": {
            "file": "shell/browser/api/electron_api_web_contents.cc"
        },
        "source": "https://github.com/electron/electron/commit/5c8e7e8b7f485ceafa8b271086d7b87e1de9dedd"
    },
    {
        "id": "CVE-2020-26272-19cf83ae",
        "deprecated": false,
        "signature_version": "v1",
        "signature_type": "Line",
        "digest": {
            "line_hashes": [
                "259626012671428820934679576571791564272",
                "190888827895443283507189164906074420513",
                "140114056141223143105956523774720280216",
                "323984724206437864177961710133179841237"
            ],
            "threshold": 0.9
        },
        "target": {
            "file": "shell/browser/api/electron_api_web_contents.h"
        },
        "source": "https://github.com/electron/electron/commit/0bbd268eb4caf35604443df5ff196980dd49e208"
    },
    {
        "id": "CVE-2020-26272-24e86639",
        "deprecated": false,
        "signature_version": "v1",
        "signature_type": "Line",
        "digest": {
            "line_hashes": [
                "286546095561722849304899761614243606370",
                "18594053933147830935146762621454189881",
                "231744994441500991232230753212301907421",
                "147742664690478424494676506633580142686",
                "225478983946948299042794069263406854697",
                "155908254062235301081122339545368807131",
                "113263493416511065577179012511659304799",
                "33770344712824465416138643710495897284",
                "65467732814744102592409384208054786610",
                "50465836792174489854299633506672120570",
                "156228786641059252339118863713545955313",
                "58034794325934109090949819898393575455",
                "147742664690478424494676506633580142686",
                "62473832892499251564086550250572886934",
                "268875754937602499414675415335897911256",
                "82413767142776151616339699397539184835",
                "326328112980054107830867134204970401986",
                "337799738599541814054532293596149286346",
                "332440534599940154327226532152897528635",
                "132554946538616583053448283770668316321",
                "219414745585961351299723657212182395995",
                "121202287163674045107233119935464359180",
                "78589303759395228020773884345992410259",
                "276741656170477293699742489778032574516",
                "232976832141171976369752706427772500095",
                "293955162568213765605321527794583283599",
                "127370560358776926474583449499664163330",
                "254610680437732091224903217537865617309",
                "20363517208715894320276692211536556011",
                "236238828480783366741635939204395195924",
                "184631512299303109827892524831286415373"
            ],
            "threshold": 0.9
        },
        "target": {
            "file": "shell/common/api/remote/remote_callback_freer.cc"
        },
        "source": "https://github.com/electron/electron/commit/0bbd268eb4caf35604443df5ff196980dd49e208"
    },
    {
        "id": "CVE-2020-26272-28568229",
        "deprecated": false,
        "signature_version": "v1",
        "signature_type": "Line",
        "digest": {
            "line_hashes": [
                "259626012671428820934679576571791564272",
                "190888827895443283507189164906074420513",
                "140114056141223143105956523774720280216",
                "323984724206437864177961710133179841237"
            ],
            "threshold": 0.9
        },
        "target": {
            "file": "shell/browser/api/electron_api_web_contents.h"
        },
        "source": "https://github.com/electron/electron/commit/36c695ce2a7e22c07fe1e30c61c00d20371daee2"
    },
    {
        "id": "CVE-2020-26272-30546e15",
        "deprecated": false,
        "signature_version": "v1",
        "signature_type": "Line",
        "digest": {
            "line_hashes": [
                "245984452434646337200063399336997769655",
                "132475682388429538998910461779838567299",
                "181795265450562538829351116307706265918",
                "183474686773543786798413565345237138256",
                "65061730555892512890488248059829659862",
                "179966689541382938445925330339670496392",
                "104157118008051671957768437988763371346"
            ],
            "threshold": 0.9
        },
        "target": {
            "file": "shell/common/gin_helper/event_emitter.cc"
        },
        "source": "https://github.com/electron/electron/commit/5c8e7e8b7f485ceafa8b271086d7b87e1de9dedd"
    },
    {
        "id": "CVE-2020-26272-5c372b63",
        "deprecated": false,
        "signature_version": "v1",
        "signature_type": "Line",
        "digest": {
            "line_hashes": [
                "259626012671428820934679576571791564272",
                "190888827895443283507189164906074420513",
                "140114056141223143105956523774720280216",
                "323984724206437864177961710133179841237"
            ],
            "threshold": 0.9
        },
        "target": {
            "file": "shell/browser/api/electron_api_web_contents.h"
        },
        "source": "https://github.com/electron/electron/commit/429400040ecb16a21d19936658579e65a797e4cc"
    },
    {
        "id": "CVE-2020-26272-77e39721",
        "deprecated": false,
        "signature_version": "v1",
        "signature_type": "Function",
        "digest": {
            "function_hash": "213465454861229333496615410510581771599",
            "length": 576.0
        },
        "target": {
            "file": "shell/common/api/remote/remote_callback_freer.cc",
            "function": "RemoteCallbackFreer::RunDestructor"
        },
        "source": "https://github.com/electron/electron/commit/0bbd268eb4caf35604443df5ff196980dd49e208"
    },
    {
        "id": "CVE-2020-26272-8487b6c8",
        "deprecated": false,
        "signature_version": "v1",
        "signature_type": "Line",
        "digest": {
            "line_hashes": [
                "245984452434646337200063399336997769655",
                "132475682388429538998910461779838567299",
                "181795265450562538829351116307706265918",
                "183474686773543786798413565345237138256",
                "65061730555892512890488248059829659862",
                "179966689541382938445925330339670496392",
                "104157118008051671957768437988763371346"
            ],
            "threshold": 0.9
        },
        "target": {
            "file": "shell/common/gin_helper/event_emitter.cc"
        },
        "source": "https://github.com/electron/electron/commit/429400040ecb16a21d19936658579e65a797e4cc"
    },
    {
        "id": "CVE-2020-26272-88bc5f8d",
        "deprecated": false,
        "signature_version": "v1",
        "signature_type": "Line",
        "digest": {
            "line_hashes": [
                "286546095561722849304899761614243606370",
                "18594053933147830935146762621454189881",
                "231744994441500991232230753212301907421",
                "147742664690478424494676506633580142686",
                "225478983946948299042794069263406854697",
                "155908254062235301081122339545368807131",
                "113263493416511065577179012511659304799",
                "33770344712824465416138643710495897284",
                "65467732814744102592409384208054786610",
                "50465836792174489854299633506672120570",
                "156228786641059252339118863713545955313",
                "58034794325934109090949819898393575455",
                "147742664690478424494676506633580142686",
                "62473832892499251564086550250572886934",
                "268875754937602499414675415335897911256",
                "82413767142776151616339699397539184835",
                "326328112980054107830867134204970401986",
                "337799738599541814054532293596149286346",
                "332440534599940154327226532152897528635",
                "132554946538616583053448283770668316321",
                "219414745585961351299723657212182395995",
                "121202287163674045107233119935464359180",
                "78589303759395228020773884345992410259",
                "276741656170477293699742489778032574516",
                "232976832141171976369752706427772500095",
                "293955162568213765605321527794583283599",
                "127370560358776926474583449499664163330",
                "254610680437732091224903217537865617309",
                "20363517208715894320276692211536556011",
                "236238828480783366741635939204395195924",
                "184631512299303109827892524831286415373"
            ],
            "threshold": 0.9
        },
        "target": {
            "file": "shell/common/api/remote/remote_callback_freer.cc"
        },
        "source": "https://github.com/electron/electron/commit/5c8e7e8b7f485ceafa8b271086d7b87e1de9dedd"
    },
    {
        "id": "CVE-2020-26272-a1de8ade",
        "deprecated": false,
        "signature_version": "v1",
        "signature_type": "Line",
        "digest": {
            "line_hashes": [
                "16023040936284061033740414276037819986",
                "261015332494660348124059935672633569702",
                "252396433010161011977279938552784780172",
                "323984724206437864177961710133179841237"
            ],
            "threshold": 0.9
        },
        "target": {
            "file": "shell/browser/api/electron_api_web_contents.h"
        },
        "source": "https://github.com/electron/electron/commit/07a1c2a3e5845901f7e2eda9506695be58edc73c"
    },
    {
        "id": "CVE-2020-26272-a55e3956",
        "deprecated": false,
        "signature_version": "v1",
        "signature_type": "Line",
        "digest": {
            "line_hashes": [
                "287205841254502126395013713886078832934",
                "142898809094716955430341410026077155259",
                "15439720782795250393735098077939218399",
                "182950242858280576171103341694523513130",
                "5876225114195792717144737006117293343",
                "223290068118242090994011858547218091545",
                "236632885221594991751031321296683685587",
                "206214436811680868532001440442209278227",
                "178641189899975236565140470433134671115",
                "2508836763789185739556126658258170977",
                "246033333725504385989276433967000175798",
                "102290467538447217642659619127202112389",
                "318062980058434488377787339922332087419",
                "296451280269323490138728269617060190838",
                "256060359665179448562459742671970585680",
                "295845677708379514334721721017657725002",
                "301725277742181896432511116192743128019"
            ],
            "threshold": 0.9
        },
        "target": {
            "file": "shell/browser/api/electron_api_web_contents.cc"
        },
        "source": "https://github.com/electron/electron/commit/0bbd268eb4caf35604443df5ff196980dd49e208"
    },
    {
        "id": "CVE-2020-26272-acb847cf",
        "deprecated": false,
        "signature_version": "v1",
        "signature_type": "Line",
        "digest": {
            "line_hashes": [
                "245984452434646337200063399336997769655",
                "132475682388429538998910461779838567299",
                "181795265450562538829351116307706265918",
                "183474686773543786798413565345237138256",
                "65061730555892512890488248059829659862",
                "179966689541382938445925330339670496392",
                "104157118008051671957768437988763371346"
            ],
            "threshold": 0.9
        },
        "target": {
            "file": "shell/common/gin_helper/event_emitter.cc"
        },
        "source": "https://github.com/electron/electron/commit/0bbd268eb4caf35604443df5ff196980dd49e208"
    },
    {
        "id": "CVE-2020-26272-bb1a7427",
        "deprecated": false,
        "signature_version": "v1",
        "signature_type": "Function",
        "digest": {
            "function_hash": "213465454861229333496615410510581771599",
            "length": 576.0
        },
        "target": {
            "file": "shell/common/api/remote/remote_callback_freer.cc",
            "function": "RemoteCallbackFreer::RunDestructor"
        },
        "source": "https://github.com/electron/electron/commit/5c8e7e8b7f485ceafa8b271086d7b87e1de9dedd"
    },
    {
        "id": "CVE-2020-26272-bd0a0966",
        "deprecated": false,
        "signature_version": "v1",
        "signature_type": "Line",
        "digest": {
            "line_hashes": [
                "245984452434646337200063399336997769655",
                "132475682388429538998910461779838567299",
                "181795265450562538829351116307706265918",
                "183474686773543786798413565345237138256",
                "65061730555892512890488248059829659862",
                "179966689541382938445925330339670496392",
                "104157118008051671957768437988763371346"
            ],
            "threshold": 0.9
        },
        "target": {
            "file": "shell/common/gin_helper/event_emitter.cc"
        },
        "source": "https://github.com/electron/electron/commit/36c695ce2a7e22c07fe1e30c61c00d20371daee2"
    },
    {
        "id": "CVE-2020-26272-d814d793",
        "deprecated": false,
        "signature_version": "v1",
        "signature_type": "Line",
        "digest": {
            "line_hashes": [
                "287205841254502126395013713886078832934",
                "142898809094716955430341410026077155259",
                "15439720782795250393735098077939218399",
                "153759453852004843131803498537909663200",
                "219031189397780464877209732934955614333",
                "223290068118242090994011858547218091545",
                "236632885221594991751031321296683685587",
                "206214436811680868532001440442209278227",
                "178641189899975236565140470433134671115",
                "2508836763789185739556126658258170977",
                "246033333725504385989276433967000175798",
                "102290467538447217642659619127202112389",
                "318062980058434488377787339922332087419",
                "296451280269323490138728269617060190838",
                "256060359665179448562459742671970585680",
                "295845677708379514334721721017657725002",
                "301725277742181896432511116192743128019"
            ],
            "threshold": 0.9
        },
        "target": {
            "file": "shell/browser/api/electron_api_web_contents.cc"
        },
        "source": "https://github.com/electron/electron/commit/36c695ce2a7e22c07fe1e30c61c00d20371daee2"
    },
    {
        "id": "CVE-2020-26272-e0c806e8",
        "deprecated": false,
        "signature_version": "v1",
        "signature_type": "Line",
        "digest": {
            "line_hashes": [
                "259626012671428820934679576571791564272",
                "190888827895443283507189164906074420513",
                "140114056141223143105956523774720280216",
                "323984724206437864177961710133179841237"
            ],
            "threshold": 0.9
        },
        "target": {
            "file": "shell/browser/api/electron_api_web_contents.h"
        },
        "source": "https://github.com/electron/electron/commit/5c8e7e8b7f485ceafa8b271086d7b87e1de9dedd"
    },
    {
        "id": "CVE-2020-26272-e21c650f",
        "deprecated": false,
        "signature_version": "v1",
        "signature_type": "Line",
        "digest": {
            "line_hashes": [
                "106505602959973383940994886937260803597",
                "235996486376174733981178229482520875689",
                "173302040137704966800277636069628800380",
                "153759453852004843131803498537909663200",
                "219031189397780464877209732934955614333",
                "223290068118242090994011858547218091545",
                "236632885221594991751031321296683685587",
                "206214436811680868532001440442209278227",
                "178641189899975236565140470433134671115",
                "2508836763789185739556126658258170977",
                "246033333725504385989276433967000175798",
                "102290467538447217642659619127202112389",
                "318062980058434488377787339922332087419",
                "296451280269323490138728269617060190838",
                "55404362077133348940758015694065464844",
                "204093587208131812488658372570920700381",
                "247419182561815150224337625135513180335"
            ],
            "threshold": 0.9
        },
        "target": {
            "file": "shell/browser/api/electron_api_web_contents.cc"
        },
        "source": "https://github.com/electron/electron/commit/07a1c2a3e5845901f7e2eda9506695be58edc73c"
    },
    {
        "id": "CVE-2020-26272-ec7ded07",
        "deprecated": false,
        "signature_version": "v1",
        "signature_type": "Line",
        "digest": {
            "line_hashes": [
                "287205841254502126395013713886078832934",
                "142898809094716955430341410026077155259",
                "15439720782795250393735098077939218399",
                "153759453852004843131803498537909663200",
                "219031189397780464877209732934955614333",
                "223290068118242090994011858547218091545",
                "236632885221594991751031321296683685587",
                "206214436811680868532001440442209278227",
                "178641189899975236565140470433134671115",
                "2508836763789185739556126658258170977",
                "246033333725504385989276433967000175798",
                "102290467538447217642659619127202112389",
                "318062980058434488377787339922332087419",
                "296451280269323490138728269617060190838",
                "256060359665179448562459742671970585680",
                "295845677708379514334721721017657725002",
                "301725277742181896432511116192743128019"
            ],
            "threshold": 0.9
        },
        "target": {
            "file": "shell/browser/api/electron_api_web_contents.cc"
        },
        "source": "https://github.com/electron/electron/commit/429400040ecb16a21d19936658579e65a797e4cc"
    }
]