CVE-2017-16151

9.8 criticalEPSS 2.7%

Based on details posted by the ElectronJS team; A remote code execution vulnerability has been discovered in Google Chromium that affects all recent versions of Electron. Any Electron app that accesses remote content is vulnerable to this exploit, regardless of whether the [sandbox option](https://electron.atom.io/docs/api/sandbox-option) is enabled.

Severity

CVSS 3.0

9.8 critical

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS: 2.7% chance of exploitation in the next 30 days; higher than 85% of CVEs (scores of 2026-10-31)
CWE: CWE-94
Published: 2018-06-07
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

electronjs:electron

Packages (OSV)

Advisory	Ecosystem	Package	Affected	Fixed in
GHSA-4w88-rjj3-x7wp	npm	electron	<1.6.14	1.6.14
GHSA-4w88-rjj3-x7wp	npm	electron	>=1.7.0 <1.7.8	1.7.8

References

https://electron.atom.io/blog/2017/09/27/chromium-rce-vulnerability-fix
https://nodesecurity.io/advisories/539
https://electron.atom.io/blog/2017/09/27/chromium-rce-vulnerability-fix
https://nodesecurity.io/advisories/539

Check your stack JSON