If an API exposed to the main world via contextBridge has a return value that throws a user-generated exception while being sent over the bridge, such as a dynamic getter property on an object that throws an error when being computed. This would normally result in an Error: object could not be cloned exception being thrown. If an API exposed to the main world via contextBridge can return an object or array that contains a JS object that cannot be serialized, such as a canvas rendering context. This issue is exploitable under either of two conditions: Electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS.Īffected versions of this package are vulnerable to Improper Access Control via nested unserializable return value when using contextIsolation and contextBridge are affected.Įxploiting this vulnerability allows code running in the main world context in the renderer to reach into the isolated Electron context and perform privileged actions.
0 kommentar(er)
