GHSA-m55f-7gqj-fr98 Electron: Extension tab APIs operate across session boundaries

• npm electron: < 39.8.8 → fixed in 39.8.8 • npm electron: >= 40.0.0-alpha.1, < 40.9.0 → fixed in 40.9.0 • npm electron: >= 41.0.0-alpha.1, < 41.2.1 → fixed in 41.2.1 • npm electron: >= 42.0.0-alpha.1, < 42.0.0-beta.3 → fixed in 42.0.0-beta.3

Impact Extension tab and scripting APIs were not scoped to the extension's own `session`. A malicious or compromised extension loaded into one session could navigate, script, and read from windows belonging to a different session. Apps are only affected if they load Chrome extensions via `session.loadExtension` and rely on separate sessions to isolate that extension from other content. Apps that do not load extensions, or that use a single session, are not affected. Workarounds Only load extensions from sources you trust; do not rely on session separation alone to contain an extension. Fixed Versions • `42.0.0-beta.3` • `41.2.1` • `40.9.0` • `39.8.8` For more information If you have any questions or comments about this advisory, email Electron at [email protected]