{
  "site": "https://pwn.watch",
  "generatedAt": "2026-10-22T20:45:43.249Z",
  "tag": {
    "id": "electron",
    "label": "Electron",
    "isStack": false,
    "url": "https://pwn.watch/t/electron",
    "feed": "https://pwn.watch/t/electron/feed.xml"
  },
  "counts": {
    "incidents": 2,
    "live": 0,
    "notFullyPatched": 0,
    "patched": 2
  },
  "incidents": [
    {
      "slug": "libwebp-heap-overflow-cve-2023-4863",
      "title": "libwebp heap overflow exploited in the wild (CVE-2023-4863)",
      "url": "https://pwn.watch/i/libwebp-heap-overflow-cve-2023-4863",
      "json": "https://pwn.watch/i/libwebp-heap-overflow-cve-2023-4863.json",
      "status": "closed",
      "severity": "high",
      "patchStatus": "patched",
      "product": "libwebp (Google Chrome and everything that bundles libwebp)",
      "tags": [
        "node",
        "python",
        "libwebp",
        "google",
        "chrome",
        "electron",
        "zero-day",
        "cisa-kev"
      ],
      "cveIds": [
        "CVE-2023-4863"
      ],
      "affectedVersions": [
        "Google Chrome before 116.0.5845.187; libwebp before 1.3.2 (NVD)"
      ],
      "fixedVersions": [
        "Chrome 116.0.5845.187",
        "libwebp 1.3.2",
        "Bundling apps/libraries: see each vendor's advisory"
      ],
      "startedAt": "2023-09-11",
      "closedAt": "2023-09-13",
      "updatedAt": "2023-09-13",
      "summary": "A heap overflow in libwebp's lossless decoder, found by Apple SEAR and Citizen Lab after the BLASTPASS iPhone exploit, was exploited in the wild. Because libwebp is everywhere, browsers, Electron apps and image libraries that bundle it all had to ship updates.",
      "xPost": null
    },
    {
      "slug": "3cx-desktopapp-supply-chain-attack-2023",
      "title": "3CX DesktopApp supply-chain attack (trojanized signed builds)",
      "url": "https://pwn.watch/i/3cx-desktopapp-supply-chain-attack-2023",
      "json": "https://pwn.watch/i/3cx-desktopapp-supply-chain-attack-2023.json",
      "status": "closed",
      "severity": "critical",
      "patchStatus": "patched",
      "product": "3CX DesktopApp (Electron)",
      "tags": [
        "3cx",
        "supply-chain",
        "electron",
        "north-korea",
        "windows",
        "macos"
      ],
      "cveIds": [
        "CVE-2023-29059"
      ],
      "affectedVersions": [
        "Windows Electron app 18.12.407 and 18.12.416 (Update 7) (NVD)",
        "macOS Electron app 18.11.1213, 18.12.402, 18.12.407 and 18.12.416 (NVD)"
      ],
      "fixedVersions": [
        "See vendor advisory"
      ],
      "startedAt": "2023-03-29",
      "closedAt": "2023-04-20",
      "updatedAt": "2023-04-20",
      "summary": "Signed 3CX DesktopApp builds for Windows and macOS shipped with embedded malicious code. Mandiant traced it to a North Korea-linked actor (UNC4736) who first got in through a trojanized X_TRADER install from Trading Technologies: a supply-chain attack caused by another supply-chain attack.",
      "xPost": null
    }
  ],
  "posts": [],
  "changes": [
    {
      "incident": "libwebp-heap-overflow-cve-2023-4863",
      "incidentTitle": "libwebp heap overflow exploited in the wild (CVE-2023-4863)",
      "severity": "high",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2023-09-13",
      "title": "CISA adds CVE-2023-4863 to the KEV catalog",
      "body": null,
      "sourceUrl": null,
      "url": "https://pwn.watch/i/libwebp-heap-overflow-cve-2023-4863"
    },
    {
      "incident": "libwebp-heap-overflow-cve-2023-4863",
      "incidentTitle": "libwebp heap overflow exploited in the wild (CVE-2023-4863)",
      "severity": "high",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2023-09-11",
      "title": "Chrome stable update fixes CVE-2023-4863; Google says an exploit exists in the wild",
      "body": null,
      "sourceUrl": "https://chromereleases.googleblog.com/2023/09/stable-channel-update-for-desktop_11.html",
      "url": "https://pwn.watch/i/libwebp-heap-overflow-cve-2023-4863"
    },
    {
      "incident": "3cx-desktopapp-supply-chain-attack-2023",
      "incidentTitle": "3CX DesktopApp supply-chain attack (trojanized signed builds)",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2023-04-20",
      "title": "Mandiant: the 3CX breach began with a trojanized X_TRADER package, the first software supply-chain attack it had seen caused by another",
      "body": null,
      "sourceUrl": "https://cloud.google.com/blog/topics/threat-intelligence/3cx-software-supply-chain-compromise",
      "url": "https://pwn.watch/i/3cx-desktopapp-supply-chain-attack-2023"
    },
    {
      "incident": "3cx-desktopapp-supply-chain-attack-2023",
      "incidentTitle": "3CX DesktopApp supply-chain attack (trojanized signed builds)",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2023-03-30",
      "title": "3CX confirms the compromise and tells customers to uninstall the Electron desktop app",
      "body": null,
      "sourceUrl": "https://www.3cx.com/blog/news/desktopapp-security-alert/",
      "url": "https://pwn.watch/i/3cx-desktopapp-supply-chain-attack-2023"
    },
    {
      "incident": "3cx-desktopapp-supply-chain-attack-2023",
      "incidentTitle": "3CX DesktopApp supply-chain attack (trojanized signed builds)",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2023-03-29",
      "title": "CrowdStrike reports malicious activity from the signed 3CXDesktopApp on customer machines",
      "body": null,
      "sourceUrl": "https://www.crowdstrike.com/en-us/blog/crowdstrike-detects-and-prevents-active-intrusion-campaign-targeting-3cxdesktopapp-customers/",
      "url": "https://pwn.watch/i/3cx-desktopapp-supply-chain-attack-2023"
    }
  ]
}