{"id":"GHSA-2q4g-w47c-4674","summary":"Unpreventable top-level navigation","details":"### Impact\nThe `will-navigate` event that apps use to prevent navigations to unexpected destinations [as per our security recommendations](https://www.electronjs.org/docs/tutorial/security) can be bypassed when a sub-frame performs a top-frame navigation across sites.\n\n### Patches\n\n* `11.0.0-beta.1`\n* `10.0.1`\n* `9.3.0`\n* `8.5.1`\n\n### Workarounds\nSandbox all your iframes using the [`sandbox` attribute](https://developer.mozilla.org/en-US/docs/Web/HTML/Element/iframe#attr-sandbox).  This will prevent them creating top-frame navigations and is good practice anyway.\n\n### For more information\nIf you have any questions or comments about this advisory:\n\n* Email us at security@electronjs.org","aliases":["CVE-2020-15174"],"modified":"2026-05-07T05:01:06.056378960Z","published":"2020-10-06T14:24:04Z","database_specific":{"severity":"HIGH","github_reviewed":true,"github_reviewed_at":"2020-10-06T14:12:16Z","nvd_published_at":"2020-10-06T18:15:00Z","cwe_ids":["CWE-20","CWE-693"]},"references":[{"type":"WEB","url":"https://github.com/electron/electron/security/advisories/GHSA-2q4g-w47c-4674"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2020-15174"},{"type":"WEB","url":"https://github.com/electron/electron/commit/18613925610ba319da7f497b6deed85ad712c59b"},{"type":"PACKAGE","url":"https://github.com/electron/electron"}],"affected":[{"package":{"name":"electron","ecosystem":"npm","purl":"pkg:npm/electron"},"ranges":[{"type":"SEMVER","events":[{"introduced":"8.0.0-beta.0"},{"fixed":"8.5.1"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2020/10/GHSA-2q4g-w47c-4674/GHSA-2q4g-w47c-4674.json"}},{"package":{"name":"electron","ecosystem":"npm","purl":"pkg:npm/electron"},"ranges":[{"type":"SEMVER","events":[{"introduced":"9.0.0-beta.0"},{"fixed":"9.3.0"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2020/10/GHSA-2q4g-w47c-4674/GHSA-2q4g-w47c-4674.json"}},{"package":{"name":"electron","ecosystem":"npm","purl":"pkg:npm/electron"},"ranges":[{"type":"SEMVER","events":[{"introduced":"10.0.0-beta.0"},{"fixed":"10.0.1"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2020/10/GHSA-2q4g-w47c-4674/GHSA-2q4g-w47c-4674.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:L"}]}