Threats tagged 'ghsa-h7rp-cf8h-j98x'

Electron versions prior to 39.8.9 are vulnerable to a context isolation bypass via hijacking Function.prototype.bind. This affects apps that expose Promise-returning functions to web content through contextBridge, potentially allowing untrusted web content to access the isolated preload environment and escalate privileges to Node.js access in certain configurations. The vulnerability is fixed in Electron versions 39.8.9 and later.