CVE-2023-29198

Electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS. Electron apps using `contextIsolation` and `contextBridge` are affected. This is a context isolation bypass, meaning that code running in the main world context in the renderer can reach into the isolated Electron context and perform privileged actions. This issue is only exploitable if an API exposed to the main world via `contextBridge` can return an object or array that contains a javascript object which cannot be serialized, for instance, a canvas rendering context. This would normally result in an exception being thrown `Error: object could not be cloned`. The app side workaround is to ensure that such a case is not possible. Ensure all values returned from a function exposed over the context bridge are supported. This issue has been fixed in versions `25.0.0-alpha.2`, `24.0.1`, `23.2.3`, and `22.3.6`.

• CWE-754
• CWE-754

• https://github.com/electron/electron/security/advisories/GHSA-p7v2-p9m8-qqg7Mitigation, Vendor Advisory
• https://www.electronjs.org/docs/latest/api/context-bridge#parameter--error--return-type-supportProduct
• https://github.com/electron/electron/security/advisories/GHSA-p7v2-p9m8-qqg7Mitigation, Vendor Advisory
• https://www.electronjs.org/docs/latest/api/context-bridge#parameter--error--return-type-supportProduct

Published

Sep 6, 2023

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-29192SilverwareGames.io versions before 1.2.19 allow users with a…4.3
• CVE-2023-29193SpiceDB is an open source, Google Zanzibar-inspired, databas…7.5
• CVE-2023-29194Vitess is a database clustering system for horizontal scalin…2.7
• CVE-2023-29195Vitess is a database clustering system for horizontal scalin…4.3
• CVE-2023-29196Discourse is an open source platform for community discussio…6.1
• CVE-2023-29197guzzlehttp/psr7 is a PSR-7 HTTP message library implementati…7.5
• CVE-2023-29199There exists a vulnerability in source code transformer (exc…10
• CVE-2023-2920Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMB…
• CVE-2023-29200Contao is an open source content management system. Prior to…6.5
• CVE-2023-29201XWiki Commons are technical libraries common to several othe…9
• CVE-2023-29202XWiki Commons are technical libraries common to several othe…9
• CVE-2023-29203XWiki Commons are technical libraries common to several othe…5.3