CVE-2018-15685

HIGH

Electron 1.7.15, 1.8.7, 2.0.7, 3.0.0-beta.6 - Remote Code Execution via WebPreferences Misconfiguration

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 2 public exploits for CVE-2018-15685. PoCs published by Matt Austin.

AI-analyzed exploit summary This exploit demonstrates a remote code execution vulnerability in Electron applications that allows nested child windows to bypass `nodeIntegration` restrictions. It leverages a misconfiguration in WebPreferences to execute arbitrary code despite security settings.

Description

GitHub Electron 1.7.15, 1.8.7, 2.0.7, and 3.0.0-beta.6, in certain scenarios involving IFRAME elements and "nativeWindowOpen: true" or "sandbox: true" options, is affected by a WebPreferences vulnerability that can be leveraged to perform remote code execution.

Exploits (2)

exploitdb WORKING POC VERIFIED
by Matt Austin · textremotemultiple
https://www.exploit-db.com/exploits/45272

This exploit demonstrates a remote code execution vulnerability in Electron applications that allows nested child windows to bypass `nodeIntegration` restrictions. It leverages a misconfiguration in WebPreferences to execute arbitrary code despite security settings.

Classification
Working Poc 90%
Attack Type
Rce
Complexity
Moderate
Reliability
Reliable
Target: Electron (versions 3.0.0-beta.6, 2.0.7, 1.8.7, 1.7.15)
No auth needed
Prerequisites: Electron app with nested child windows enabled · Ability to open a malicious window (e.g., via XSS or controlled URL)
devstral-2 · analyzed Feb 16, 2026 Full analysis →
inthewild WORKING POC
poc
https://github.com/matt-/cve-2018-15685

This repository contains a functional Electron application demonstrating CVE-2018-15685, a remote code execution vulnerability in Electron versions with nested child windows. The PoC includes a main process with disabled nodeIntegration and an example HTML page to showcase the exploit.

Classification
Working Poc 95%
Attack Type
Rce
Complexity
Moderate
Reliability
Reliable
Target: Electron (versions 3.0.0-beta.6, 2.0.7, 1.8.7, 1.7.15)
No auth needed
Prerequisites: Electron application with nested child windows · Ability to open a crafted HTML page
devstral-2 · analyzed Feb 23, 2026 Full analysis →

References (2)

Core 2
Core References
Exploit, Third Party Advisory, VDB Entry exploit x_refsource_exploit-db
https://www.exploit-db.com/exploits/45272/
Mitigation, Vendor Advisory x_refsource_misc
https://electronjs.org/blog/web-preferences-fix

Scores

CVSS v3 8.1
EPSS 0.1268
EPSS Percentile 94.2%
Attack Vector NETWORK
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Details

CWE
CWE-1188
Status published
Products (5)
electronjs/electron 1.7.15
electronjs/electron 1.8.7
electronjs/electron 2.0.7
electronjs/electron 3.0.0 beta6
npm/electron 1.7.0 - 1.7.16npm
Published Aug 23, 2018
Tracked Since Feb 18, 2026