Allele Security Intelligence

ASA-2019-00646 – Electron: Chromium WebAudio Use-After-Free Vulnerability

Posted on December 2, 2019December 9, 2019 by Allele Security Intelligence in Alerts

A vulnerability has been discovered in Chrome which affects all software based on Chromium, including Electron. Use-after-free in WebAudio in Google Chrome allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.

ASA-2019-00072 – Electron: Vulnerability that allowed Node to be re-enabled in child Windows

Posted on February 11, 2019February 11, 2019 by Allele Security Intelligence in Alerts

A code vulnerability has been discovered that allows Node to be re-enabled in child windows. Opening a BrowserView with sandbox: true or nativeWindowOpen: true and nodeIntegration: false results in a webContents where window.open can be called and the newly opened child window will have nodeIntegration enabled.