Threats tagged 'ghsa-r4w5-6pfg-jxp5'

Electron versions prior to 40.10.6, 41.9.1, 42.5.1, and 43.0.0 contain a vulnerability where a custom protocol handler returning a ProtocolResponse with a url but without an explicit session causes the request to use the default session cache. This leads to potential cache reuse across isolated session partitions, undermining session isolation. Applications that explicitly set the session or do not isolate content across sessions are not affected. A fix is available in the specified versions.