Cyber Resilience

CVE-2020-26272

Medium

Published: 28 January 2021

Published
28 January 2021
Modified
27 May 2025
KEV Added
Patch
CVSS Score v3.1 5.4 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N
EPSS Score 0.0097 77.0th percentile
Risk Priority 11 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2020-26272 is a medium-severity Exposure of Resource to Wrong Sphere (CWE-668) vulnerability in Electronjs Electron. Its CVSS base score is 5.4 (Medium).

Operationally, ranked in the top 23.0% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.

EU & UK References

Vulnerability details

The Electron framework lets users write cross-platform desktop applications using JavaScript, HTML and CSS. In versions of Electron IPC prior to 9.4.0, 10.2.0, 11.1.0, and 12.0.0-beta.9, messages sent from the main process to a subframe in the renderer process, through…

more

webContents.sendToFrame, event.reply or when using the remote module, can in some cases be delivered to the wrong frame. If your app uses remote, calls webContents.sendToFrame, or calls event.reply in an IPC message handler then it is impacted by this issue. This has been fixed in versions 9.4.0, 10.2.0, 11.1.0, and 12.0.0-beta.9. There are no known workarounds for this issue.

CWE(s)

Related Threats

No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.

Affected Assets

electronjs
electron
10.0.0, 11.0.0, 12.0.0, 9.0.0 · 9.0.0 — 9.4.0 · 10.0.0 — 10.2.0 · 11.0.0 — 11.1.0

Mitigating Controls

Likely Mitigating Controls AI

Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.

addresses: CWE-668

Controls whether organization resources are exposed to external system spheres by permitting or prohibiting their use.

addresses: CWE-668

The control ensures information is not released into a security sphere where the recipient lacks matching access authorizations.

addresses: CWE-668

The control ensures information resources are not exposed to the incorrect (public) sphere through review and authorization.

addresses: CWE-668

Protects against data mining that would expose resources to unauthorized spheres by enforcing detection and controls.

addresses: CWE-668

Restricts information flows to ensure resources are not exposed to incorrect or unauthorized spheres.

addresses: CWE-668

Controlling internal connections prevents exposure of resources to unintended internal spheres.

addresses: CWE-668

Knowing exact processing and storage locations helps avoid exposure of resources to incorrect spheres.

addresses: CWE-668

The control prevents exposure of the media resource to the wrong security sphere.

References