Technical impact
Electron incorrectly reused the default session cache when a custom protocol handler returned a ProtocolResponse that contained a URL but omitted the session field. As a result, cached responses could be shared across otherwise isolated session partitions, enabling sensitive data to leak between sessions that are supposed to remain separate. This flaw is a type of privileged information disclosure (CWE-668).
Affected Systems
The flaw affects Electron framework releases before 40.10.6, 41.9.1, 42.5.1, and 43.0.0. Applications that employ ProtocolResponse.url without specifying a session and rely on separate session partitions for isolation are vulnerable. The fix was introduced in the aforementioned Electron releases.
Risk and Exploitability
The CVSS score of 5.9 indicates moderate severity, and the vulnerability is not listed in CISA’s Known Exploited Vulnerabilities catalog. No EPSS data is available, so the likelihood of exploitation is unclear. Based on the description, the likely attack vector involves a malicious or compromised Electron application that can register a custom protocol handler and control the content of a ProtocolResponse. An attacker could inject cached data that crosses session boundaries, potentially exposing sensitive information to other sessions that should remain isolated.
Github GHSA