Threats tagged 'ghsa-x8rc-wpg4-grpf'

A vulnerability in Electron allows a cross-origin iframe to position the native autofill popup outside its bounds, overlaying the embedding page's UI. This can enable clickjacking or spoofing of trusted UI elements. Only applications embedding untrusted content in iframes within windows that also display trusted UI are affected. Versions prior to 39.8.8 are vulnerable. Fixed versions include 39.8.8 and later. The vulnerability has a low CVSS score of 3.1.