VULNERABILITY INTELLIGENCE

CVE-2018-15685

CVSS score8.1 HIGH

EPSS probability10.43%

CISA KEVNot currently listed

Published2018-08-23

Last modified2026-06-17

CVSS vectorCVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Description

GitHub Electron 1.7.15, 1.8.7, 2.0.7, and 3.0.0-beta.6, in certain scenarios involving IFRAME elements and "nativeWindowOpen: true" or "sandbox: true" options, is affected by a WebPreferences vulnerability that can be leveraged to perform remote code execution.

Weakness classification

CWE-1188: Initialization of a Resource with an Insecure Default

Primary references

cve@mitre.org — Mitigation, Vendor Advisory
cve@mitre.org — Exploit, Third Party Advisory, VDB Entry
af854a3a-2127-422b-91ae-364da2661108 — Mitigation, Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108 — Exploit, Third Party Advisory, VDB Entry