Exposure of Resource to Wrong Sphere

Summary

Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. From versions 39.0.0-alpha.1 prior to 39.8.0, 40.0.0-alpha.1 prior to 40.7.0, and 41.0.0-alpha.1 prior to 41.0.0-beta.8, apps that pass "VideoFrame" objects (from the WebCodecs API) across the "contextBridge" are vulnerable to a context isolation bypass. An attacker who can execute JavaScript in the main world (for example, via XSS) can use a bridged "VideoFrame" to gain access to the isolated world, including any Node.js APIs exposed to the preload script. Apps are only affected if a preload script returns, resolves, or passes a "VideoFrame" object to the main world via "contextBridge.exposeInMainWorld()". Apps that do not bridge "VideoFrame" objects are not affected. This issue has been patched in versions 39.8.0, 40.7.0, and 41.0.0-beta.8.