Threats tagged 'ghsa-ff2p-hmqr-hxm4'

A vulnerability in Electron's contextBridge allows objects copied from untrusted content to carry attacker-influenced prototypes, enabling prototype-pollution-style attacks against preload code despite context isolation. This affects apps that accept object arguments from untrusted content and read their properties without own-property checks. The issue is fixed in Electron versions 39.8.9 and later.