Search
Find a vulnerability
Search criteria
55 vulnerabilities found for electron by electron
CVE-2026-70612 (GCVE-0-2026-70612)
Vulnerability from cvelistv5 – Published: 2026-08-05 17:56 – Updated: 2026-08-05 19:03
VLAI
EPSS
VEX
Title
Electron: Sandboxed iframes can launch external protocol handlers
Summary
Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.8, 40.9.0, 41.2.1, and 42.0.0-beta.3, requests to open external protocol URLs from web content did not take iframe sandbox restrictions into account, so a sandboxed iframe could cause an OS-registered external application to be launched. The frame sandbox state was also not made available to the app permission handlers, affecting apps that render untrusted content in sandboxed iframes and grant the openExternal permission by default when no setPermissionRequestHandler is installed. This issue is fixed in 39.8.8, 40.9.0, 41.2.1, and 42.0.0-beta.3.
Severity
5.4 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-05 19:03 UTC
CWE
- CWE-284 - Improper Access Control
Assigner
References
13 references
| URL | Tags |
|---|---|
| https://github.com/electron/electron/security/adv… | x_refsource_CONFIRM |
| https://github.com/electron/electron/pull/50961 | x_refsource_MISC |
| https://github.com/electron/electron/pull/50962 | x_refsource_MISC |
| https://github.com/electron/electron/pull/50963 | x_refsource_MISC |
| https://github.com/electron/electron/pull/50964 | x_refsource_MISC |
| https://github.com/electron/electron/commit/08b9d… | x_refsource_MISC |
| https://github.com/electron/electron/commit/2764e… | x_refsource_MISC |
| https://github.com/electron/electron/commit/477dc… | x_refsource_MISC |
| https://github.com/electron/electron/commit/c39e3… | x_refsource_MISC |
| https://github.com/electron/electron/releases/tag… | x_refsource_MISC |
| https://github.com/electron/electron/releases/tag… | x_refsource_MISC |
| https://github.com/electron/electron/releases/tag… | x_refsource_MISC |
| https://github.com/electron/electron/releases/tag… | x_refsource_MISC |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-70612",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-05T19:03:22.677858Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T19:03:29.121Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "electron",
"vendor": "electron",
"versions": [
{
"status": "affected",
"version": "\u003c 39.8.8"
},
{
"status": "affected",
"version": "\u003e= 40.0.0-alpha.1, \u003c 40.9.0"
},
{
"status": "affected",
"version": "\u003e= 41.0.0-alpha.1, \u003c 41.2.1"
},
{
"status": "affected",
"version": "\u003e= 42.0.0-alpha.1, \u003c 42.0.0-beta.3"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.8, 40.9.0, 41.2.1, and 42.0.0-beta.3, requests to open external protocol URLs from web content did not take iframe sandbox restrictions into account, so a sandboxed iframe could cause an OS-registered external application to be launched. The frame sandbox state was also not made available to the app permission handlers, affecting apps that render untrusted content in sandboxed iframes and grant the openExternal permission by default when no setPermissionRequestHandler is installed. This issue is fixed in 39.8.8, 40.9.0, 41.2.1, and 42.0.0-beta.3."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-284",
"description": "CWE-284: Improper Access Control",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T17:56:41.464Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/electron/electron/security/advisories/GHSA-p2rr-rvmm-c5fp",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/electron/electron/security/advisories/GHSA-p2rr-rvmm-c5fp"
},
{
"name": "https://github.com/electron/electron/pull/50961",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/electron/electron/pull/50961"
},
{
"name": "https://github.com/electron/electron/pull/50962",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/electron/electron/pull/50962"
},
{
"name": "https://github.com/electron/electron/pull/50963",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/electron/electron/pull/50963"
},
{
"name": "https://github.com/electron/electron/pull/50964",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/electron/electron/pull/50964"
},
{
"name": "https://github.com/electron/electron/commit/08b9d0a220e267d1a2402a44bdd01a2e9aa320b5",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/electron/electron/commit/08b9d0a220e267d1a2402a44bdd01a2e9aa320b5"
},
{
"name": "https://github.com/electron/electron/commit/2764e4c35168855f614876051823db4f58a3714a",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/electron/electron/commit/2764e4c35168855f614876051823db4f58a3714a"
},
{
"name": "https://github.com/electron/electron/commit/477dcf7afc6550715f9ec5e6f39ee38e5dd7bf39",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/electron/electron/commit/477dcf7afc6550715f9ec5e6f39ee38e5dd7bf39"
},
{
"name": "https://github.com/electron/electron/commit/c39e3d5687d57434c8d5fe814c5152efd2f631c3",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/electron/electron/commit/c39e3d5687d57434c8d5fe814c5152efd2f631c3"
},
{
"name": "https://github.com/electron/electron/releases/tag/v39.8.8",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/electron/electron/releases/tag/v39.8.8"
},
{
"name": "https://github.com/electron/electron/releases/tag/v40.9.0",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/electron/electron/releases/tag/v40.9.0"
},
{
"name": "https://github.com/electron/electron/releases/tag/v41.2.1",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/electron/electron/releases/tag/v41.2.1"
},
{
"name": "https://github.com/electron/electron/releases/tag/v42.0.0-beta.3",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/electron/electron/releases/tag/v42.0.0-beta.3"
}
],
"source": {
"advisory": "GHSA-p2rr-rvmm-c5fp",
"discovery": "UNKNOWN"
},
"title": "Electron: Sandboxed iframes can launch external protocol handlers"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-70612",
"datePublished": "2026-08-05T17:56:41.464Z",
"dateReserved": "2026-08-04T19:50:27.329Z",
"dateUpdated": "2026-08-05T19:03:29.121Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-70611 (GCVE-0-2026-70611)
Vulnerability from cvelistv5 – Published: 2026-08-05 17:49 – Updated: 2026-08-06 03:55
VLAI
EPSS
VEX
Title
Electron: DevTools embedder handler executes arbitrary files via shell open
Summary
Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.9, 40.9.2, 41.2.1, and 42.0.0-beta.3, the DevTools reveal in file manager action could launch the target file rather than reveal it. An attacker with a separate means of running script inside the DevTools frontend, such as a malicious DevTools extension, could use showItemInFolder handling to execute native code outside the sandbox when DevTools is opened for windows exposed to untrusted content or untrusted DevTools extensions. This issue is fixed in 39.8.9, 40.9.2, 41.2.1, and 42.0.0-beta.3.
Severity
6.9 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-05 00:00 UTC
CWE
- CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Assigner
References
13 references
| URL | Tags |
|---|---|
| https://github.com/electron/electron/security/adv… | x_refsource_CONFIRM |
| https://github.com/electron/electron/pull/50937 | x_refsource_MISC |
| https://github.com/electron/electron/pull/50938 | x_refsource_MISC |
| https://github.com/electron/electron/pull/51114 | x_refsource_MISC |
| https://github.com/electron/electron/pull/51115 | x_refsource_MISC |
| https://github.com/electron/electron/commit/10fb5… | x_refsource_MISC |
| https://github.com/electron/electron/commit/1b8a2… | x_refsource_MISC |
| https://github.com/electron/electron/commit/27bf1… | x_refsource_MISC |
| https://github.com/electron/electron/commit/7a1eb… | x_refsource_MISC |
| https://github.com/electron/electron/releases/tag… | x_refsource_MISC |
| https://github.com/electron/electron/releases/tag… | x_refsource_MISC |
| https://github.com/electron/electron/releases/tag… | x_refsource_MISC |
| https://github.com/electron/electron/releases/tag… | x_refsource_MISC |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-70611",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-05T00:00:00+00:00",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-06T03:55:50.649Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "electron",
"vendor": "electron",
"versions": [
{
"status": "affected",
"version": "\u003c 39.8.9"
},
{
"status": "affected",
"version": "\u003e= 40.0.0-alpha.1, \u003c 40.9.2"
},
{
"status": "affected",
"version": "\u003e= 41.0.0-alpha.1, \u003c 41.2.1"
},
{
"status": "affected",
"version": "\u003e= 42.0.0-alpha.1, \u003c 42.0.0-beta.3"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.9, 40.9.2, 41.2.1, and 42.0.0-beta.3, the DevTools reveal in file manager action could launch the target file rather than reveal it. An attacker with a separate means of running script inside the DevTools frontend, such as a malicious DevTools extension, could use showItemInFolder handling to execute native code outside the sandbox when DevTools is opened for windows exposed to untrusted content or untrusted DevTools extensions. This issue is fixed in 39.8.9, 40.9.2, 41.2.1, and 42.0.0-beta.3."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "LOCAL",
"availabilityImpact": "NONE",
"baseScore": 6.9,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-78",
"description": "CWE-78: Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T17:49:09.144Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/electron/electron/security/advisories/GHSA-f2r8-jv7c-xqmp",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/electron/electron/security/advisories/GHSA-f2r8-jv7c-xqmp"
},
{
"name": "https://github.com/electron/electron/pull/50937",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/electron/electron/pull/50937"
},
{
"name": "https://github.com/electron/electron/pull/50938",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/electron/electron/pull/50938"
},
{
"name": "https://github.com/electron/electron/pull/51114",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/electron/electron/pull/51114"
},
{
"name": "https://github.com/electron/electron/pull/51115",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/electron/electron/pull/51115"
},
{
"name": "https://github.com/electron/electron/commit/10fb5b39c5287f70c4bbcab4c24197f3871ec322",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/electron/electron/commit/10fb5b39c5287f70c4bbcab4c24197f3871ec322"
},
{
"name": "https://github.com/electron/electron/commit/1b8a298d629d5a642c816ea5f7505359de17b771",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/electron/electron/commit/1b8a298d629d5a642c816ea5f7505359de17b771"
},
{
"name": "https://github.com/electron/electron/commit/27bf1cae9274d5025684c7268496f435b7e06b44",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/electron/electron/commit/27bf1cae9274d5025684c7268496f435b7e06b44"
},
{
"name": "https://github.com/electron/electron/commit/7a1eb7e5585991b3726cedb890a6244f327f43de",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/electron/electron/commit/7a1eb7e5585991b3726cedb890a6244f327f43de"
},
{
"name": "https://github.com/electron/electron/releases/tag/v39.8.9",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/electron/electron/releases/tag/v39.8.9"
},
{
"name": "https://github.com/electron/electron/releases/tag/v40.9.2",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/electron/electron/releases/tag/v40.9.2"
},
{
"name": "https://github.com/electron/electron/releases/tag/v41.2.1",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/electron/electron/releases/tag/v41.2.1"
},
{
"name": "https://github.com/electron/electron/releases/tag/v42.0.0-beta.3",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/electron/electron/releases/tag/v42.0.0-beta.3"
}
],
"source": {
"advisory": "GHSA-f2r8-jv7c-xqmp",
"discovery": "UNKNOWN"
},
"title": "Electron: DevTools embedder handler executes arbitrary files via shell open"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-70611",
"datePublished": "2026-08-05T17:49:09.144Z",
"dateReserved": "2026-08-04T19:50:27.329Z",
"dateUpdated": "2026-08-06T03:55:50.649Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-70610 (GCVE-0-2026-70610)
Vulnerability from cvelistv5 – Published: 2026-08-05 17:41 – Updated: 2026-08-06 14:31
VLAI
EPSS
VEX
Title
Electron: contextBridge object copy honors prototype setters
Summary
Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.9, 40.9.2, 41.2.2, and 42.0.0-beta.4, objects copied across the contextBridge boundary from untrusted content could carry an attacker-influenced prototype, enabling prototype-pollution-style attacks against preload code despite context isolation being enabled. Apps are only affected if their preload code accepts object arguments from untrusted content and reads properties from them without own-property checks, while apps that only accept primitive arguments or validate object arguments are not affected. This issue is fixed in 39.8.9, 40.9.2, 41.2.2, and 42.0.0-beta.4.
Severity
5.4 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-06 14:30 UTC
CWE
- CWE-1321 - Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')
Assigner
References
13 references
| URL | Tags |
|---|---|
| https://github.com/electron/electron/security/adv… | x_refsource_CONFIRM |
| https://github.com/electron/electron/pull/51083 | x_refsource_MISC |
| https://github.com/electron/electron/pull/51084 | x_refsource_MISC |
| https://github.com/electron/electron/pull/51085 | x_refsource_MISC |
| https://github.com/electron/electron/pull/51086 | x_refsource_MISC |
| https://github.com/electron/electron/commit/17d5d… | x_refsource_MISC |
| https://github.com/electron/electron/commit/23a6e… | x_refsource_MISC |
| https://github.com/electron/electron/commit/4ac50… | x_refsource_MISC |
| https://github.com/electron/electron/commit/5b699… | x_refsource_MISC |
| https://github.com/electron/electron/releases/tag… | x_refsource_MISC |
| https://github.com/electron/electron/releases/tag… | x_refsource_MISC |
| https://github.com/electron/electron/releases/tag… | x_refsource_MISC |
| https://github.com/electron/electron/releases/tag… | x_refsource_MISC |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-70610",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-06T14:30:58.717300Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-06T14:31:10.761Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "electron",
"vendor": "electron",
"versions": [
{
"status": "affected",
"version": "\u003c 39.8.9"
},
{
"status": "affected",
"version": "\u003e= 40.0.0-alpha.1, \u003c 40.9.2"
},
{
"status": "affected",
"version": "\u003e= 41.0.0-alpha.1, \u003c 41.2.2"
},
{
"status": "affected",
"version": "\u003e= 42.0.0-alpha.1, \u003c 42.0.0-beta.4"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.9, 40.9.2, 41.2.2, and 42.0.0-beta.4, objects copied across the contextBridge boundary from untrusted content could carry an attacker-influenced prototype, enabling prototype-pollution-style attacks against preload code despite context isolation being enabled. Apps are only affected if their preload code accepts object arguments from untrusted content and reads properties from them without own-property checks, while apps that only accept primitive arguments or validate object arguments are not affected. This issue is fixed in 39.8.9, 40.9.2, 41.2.2, and 42.0.0-beta.4."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-1321",
"description": "CWE-1321: Improperly Controlled Modification of Object Prototype Attributes (\u0027Prototype Pollution\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T17:41:03.016Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/electron/electron/security/advisories/GHSA-ff2p-hmqr-hxm4",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/electron/electron/security/advisories/GHSA-ff2p-hmqr-hxm4"
},
{
"name": "https://github.com/electron/electron/pull/51083",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/electron/electron/pull/51083"
},
{
"name": "https://github.com/electron/electron/pull/51084",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/electron/electron/pull/51084"
},
{
"name": "https://github.com/electron/electron/pull/51085",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/electron/electron/pull/51085"
},
{
"name": "https://github.com/electron/electron/pull/51086",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/electron/electron/pull/51086"
},
{
"name": "https://github.com/electron/electron/commit/17d5d26499cd279fab48f5f26527f8edc02a7713",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/electron/electron/commit/17d5d26499cd279fab48f5f26527f8edc02a7713"
},
{
"name": "https://github.com/electron/electron/commit/23a6efb714dec80e2cf45d3054d18d701162e4dd",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/electron/electron/commit/23a6efb714dec80e2cf45d3054d18d701162e4dd"
},
{
"name": "https://github.com/electron/electron/commit/4ac50292d552fb510eb778392620c85308770a55",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/electron/electron/commit/4ac50292d552fb510eb778392620c85308770a55"
},
{
"name": "https://github.com/electron/electron/commit/5b699544cbbed51bedb7c60d75c8c42be5825737",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/electron/electron/commit/5b699544cbbed51bedb7c60d75c8c42be5825737"
},
{
"name": "https://github.com/electron/electron/releases/tag/v39.8.9",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/electron/electron/releases/tag/v39.8.9"
},
{
"name": "https://github.com/electron/electron/releases/tag/v40.9.2",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/electron/electron/releases/tag/v40.9.2"
},
{
"name": "https://github.com/electron/electron/releases/tag/v41.2.2",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/electron/electron/releases/tag/v41.2.2"
},
{
"name": "https://github.com/electron/electron/releases/tag/v42.0.0-beta.4",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/electron/electron/releases/tag/v42.0.0-beta.4"
}
],
"source": {
"advisory": "GHSA-ff2p-hmqr-hxm4",
"discovery": "UNKNOWN"
},
"title": "Electron: contextBridge object copy honors prototype setters"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-70610",
"datePublished": "2026-08-05T17:41:03.016Z",
"dateReserved": "2026-08-04T19:50:27.329Z",
"dateUpdated": "2026-08-06T14:31:10.761Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-70609 (GCVE-0-2026-70609)
Vulnerability from cvelistv5 – Published: 2026-08-05 17:32 – Updated: 2026-08-06 03:55
VLAI
EPSS
VEX
Title
Electron: DevTools JavaScript Injection via Unsanitized Dock State Parameter
Summary
Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.7, 40.9.0, 41.2.0, and 42.0.0-beta.1, the mode option of webContents.openDevTools() was not sanitized before use by the DevTools frontend. If an attacker can influence this value, script under their control may run in the DevTools context, which in unsandboxed configurations has access to Node.js, including when untrusted input reaches the mode argument of openDevTools() or untrusted content calls openDevTools() on a webview it embeds. This issue is fixed in 39.8.7, 40.9.0, 41.2.0, and 42.0.0-beta.1.
Severity
5.7 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-05 00:00 UTC
CWE
Assigner
References
13 references
| URL | Tags |
|---|---|
| https://github.com/electron/electron/security/adv… | x_refsource_CONFIRM |
| https://github.com/electron/electron/pull/50665 | x_refsource_MISC |
| https://github.com/electron/electron/pull/50666 | x_refsource_MISC |
| https://github.com/electron/electron/pull/50667 | x_refsource_MISC |
| https://github.com/electron/electron/pull/50668 | x_refsource_MISC |
| https://github.com/electron/electron/commit/04614… | x_refsource_MISC |
| https://github.com/electron/electron/commit/2046a… | x_refsource_MISC |
| https://github.com/electron/electron/commit/96974… | x_refsource_MISC |
| https://github.com/electron/electron/commit/efc4d… | x_refsource_MISC |
| https://github.com/electron/electron/releases/tag… | x_refsource_MISC |
| https://github.com/electron/electron/releases/tag… | x_refsource_MISC |
| https://github.com/electron/electron/releases/tag… | x_refsource_MISC |
| https://github.com/electron/electron/releases/tag… | x_refsource_MISC |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-70609",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-05T00:00:00+00:00",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-06T03:55:49.348Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "electron",
"vendor": "electron",
"versions": [
{
"status": "affected",
"version": "\u003c 39.8.7"
},
{
"status": "affected",
"version": "\u003e= 40.0.0-alpha.1, \u003c 40.9.0"
},
{
"status": "affected",
"version": "\u003e= 41.0.0-alpha.1, \u003c 41.2.0"
},
{
"status": "affected",
"version": "\u003e= 42.0.0-alpha.1, \u003c 42.0.0-beta.1"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.7, 40.9.0, 41.2.0, and 42.0.0-beta.1, the mode option of webContents.openDevTools() was not sanitized before use by the DevTools frontend. If an attacker can influence this value, script under their control may run in the DevTools context, which in unsandboxed configurations has access to Node.js, including when untrusted input reaches the mode argument of openDevTools() or untrusted content calls openDevTools() on a webview it embeds. This issue is fixed in 39.8.7, 40.9.0, 41.2.0, and 42.0.0-beta.1."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.7,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-94",
"description": "CWE-94: Improper Control of Generation of Code (\u0027Code Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-116",
"description": "CWE-116: Improper Encoding or Escaping of Output",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T17:32:21.067Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/electron/electron/security/advisories/GHSA-4f78-qhmw-8j8m",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/electron/electron/security/advisories/GHSA-4f78-qhmw-8j8m"
},
{
"name": "https://github.com/electron/electron/pull/50665",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/electron/electron/pull/50665"
},
{
"name": "https://github.com/electron/electron/pull/50666",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/electron/electron/pull/50666"
},
{
"name": "https://github.com/electron/electron/pull/50667",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/electron/electron/pull/50667"
},
{
"name": "https://github.com/electron/electron/pull/50668",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/electron/electron/pull/50668"
},
{
"name": "https://github.com/electron/electron/commit/04614eed17986bddc43eb509ec870424ee6a47d1",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/electron/electron/commit/04614eed17986bddc43eb509ec870424ee6a47d1"
},
{
"name": "https://github.com/electron/electron/commit/2046ae87731d80a7b535512ae19acb529e10e33b",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/electron/electron/commit/2046ae87731d80a7b535512ae19acb529e10e33b"
},
{
"name": "https://github.com/electron/electron/commit/969741f9f847c5c583f6bbc63ca22549dbd954ce",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/electron/electron/commit/969741f9f847c5c583f6bbc63ca22549dbd954ce"
},
{
"name": "https://github.com/electron/electron/commit/efc4d3c6b6f1c04f658ca0d9d2512dcfe78eb7ba",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/electron/electron/commit/efc4d3c6b6f1c04f658ca0d9d2512dcfe78eb7ba"
},
{
"name": "https://github.com/electron/electron/releases/tag/v39.8.7",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/electron/electron/releases/tag/v39.8.7"
},
{
"name": "https://github.com/electron/electron/releases/tag/v40.9.0",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/electron/electron/releases/tag/v40.9.0"
},
{
"name": "https://github.com/electron/electron/releases/tag/v41.2.0",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/electron/electron/releases/tag/v41.2.0"
},
{
"name": "https://github.com/electron/electron/releases/tag/v42.0.0-beta.1",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/electron/electron/releases/tag/v42.0.0-beta.1"
}
],
"source": {
"advisory": "GHSA-4f78-qhmw-8j8m",
"discovery": "UNKNOWN"
},
"title": "Electron: DevTools JavaScript Injection via Unsanitized Dock State Parameter"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-70609",
"datePublished": "2026-08-05T17:32:21.067Z",
"dateReserved": "2026-08-04T19:50:27.329Z",
"dateUpdated": "2026-08-06T03:55:49.348Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-70608 (GCVE-0-2026-70608)
Vulnerability from cvelistv5 – Published: 2026-08-05 17:27 – Updated: 2026-08-05 18:46
VLAI
EPSS
VEX
Title
Electron: Sandboxed iframe can bypass the allow-popups restriction via the OpenURL navigation path
Summary
Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.10, 41.10.3, and 42.0.1, a sandboxed iframe without the allow-popups keyword could still open a new window or trigger setWindowOpenHandler with no user interaction because new-window navigations taking the OpenURL path did not apply the iframe sandbox popup restriction. Apps that embed untrusted content in sandboxed iframes and rely on the absence of allow-popups to prevent window creation are affected, while apps that deny window creation in setWindowOpenHandler or do not embed untrusted content in sandboxed iframes are not affected. This issue is fixed in 39.8.10, 41.10.3, and 42.0.1.
Severity
7.2 (High)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-05 18:14 UTC
CWE
Assigner
References
10 references
| URL | Tags |
|---|---|
| https://github.com/electron/electron/security/adv… | x_refsource_CONFIRM |
| https://github.com/electron/electron/pull/51437 | x_refsource_MISC |
| https://github.com/electron/electron/pull/51438 | x_refsource_MISC |
| https://github.com/electron/electron/pull/51439 | x_refsource_MISC |
| https://github.com/electron/electron/commit/3ff23… | x_refsource_MISC |
| https://github.com/electron/electron/commit/57cbe… | x_refsource_MISC |
| https://github.com/electron/electron/commit/68cf8… | x_refsource_MISC |
| https://github.com/electron/electron/releases/tag… | x_refsource_MISC |
| https://github.com/electron/electron/releases/tag… | x_refsource_MISC |
| https://github.com/electron/electron/releases/tag… | x_refsource_MISC |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-70608",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-05T18:14:00.193334Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T18:46:49.877Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "electron",
"vendor": "electron",
"versions": [
{
"status": "affected",
"version": "\u003c 39.8.10"
},
{
"status": "affected",
"version": "\u003e= 40.0.0-alpha.1, \u003c 41.10.3"
},
{
"status": "affected",
"version": "\u003e= 42.0.0-alpha.1, \u003c 42.0.1"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.10, 41.10.3, and 42.0.1, a sandboxed iframe without the allow-popups keyword could still open a new window or trigger setWindowOpenHandler with no user interaction because new-window navigations taking the OpenURL path did not apply the iframe sandbox popup restriction. Apps that embed untrusted content in sandboxed iframes and rely on the absence of allow-popups to prevent window creation are affected, while apps that deny window creation in setWindowOpenHandler or do not embed untrusted content in sandboxed iframes are not affected. This issue is fixed in 39.8.10, 41.10.3, and 42.0.1."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-693",
"description": "CWE-693: Protection Mechanism Failure",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-1021",
"description": "CWE-1021: Improper Restriction of Rendered UI Layers or Frames",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T17:27:15.743Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/electron/electron/security/advisories/GHSA-9f4c-93c8-jc8g",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/electron/electron/security/advisories/GHSA-9f4c-93c8-jc8g"
},
{
"name": "https://github.com/electron/electron/pull/51437",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/electron/electron/pull/51437"
},
{
"name": "https://github.com/electron/electron/pull/51438",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/electron/electron/pull/51438"
},
{
"name": "https://github.com/electron/electron/pull/51439",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/electron/electron/pull/51439"
},
{
"name": "https://github.com/electron/electron/commit/3ff23c52ab364a0afc6ab5bd7851291d3159de57",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/electron/electron/commit/3ff23c52ab364a0afc6ab5bd7851291d3159de57"
},
{
"name": "https://github.com/electron/electron/commit/57cbe329c4ae8aab5ac5ebdcb588adc9a11de0d3",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/electron/electron/commit/57cbe329c4ae8aab5ac5ebdcb588adc9a11de0d3"
},
{
"name": "https://github.com/electron/electron/commit/68cf8b7d9122260f6b534a69a82c701a56cf159f",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/electron/electron/commit/68cf8b7d9122260f6b534a69a82c701a56cf159f"
},
{
"name": "https://github.com/electron/electron/releases/tag/v39.8.10",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/electron/electron/releases/tag/v39.8.10"
},
{
"name": "https://github.com/electron/electron/releases/tag/v41.10.3",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/electron/electron/releases/tag/v41.10.3"
},
{
"name": "https://github.com/electron/electron/releases/tag/v42.0.1",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/electron/electron/releases/tag/v42.0.1"
}
],
"source": {
"advisory": "GHSA-9f4c-93c8-jc8g",
"discovery": "UNKNOWN"
},
"title": "Electron: Sandboxed iframe can bypass the allow-popups restriction via the OpenURL navigation path"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-70608",
"datePublished": "2026-08-05T17:27:15.743Z",
"dateReserved": "2026-08-04T19:50:27.329Z",
"dateUpdated": "2026-08-05T18:46:49.877Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-70607 (GCVE-0-2026-70607)
Vulnerability from cvelistv5 – Published: 2026-08-05 16:24 – Updated: 2026-08-05 18:27
VLAI
EPSS
VEX
Title
Electron: window.open features string controls some window options considered privileged
Summary
Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.8, 40.9.0, 41.2.1, and 42.0.0-beta.3, some window options supplied by web content in the window.open() features string were applied to the new BrowserWindow without an allowlist. Untrusted content could set window options it should not control, including options that cause the main process to access attacker-chosen file or network paths, when untrusted content can call window.open() and the app does not override child window options via setWindowOpenHandler or overrideBrowserWindowOptions. This issue is fixed in 39.8.8, 40.9.0, 41.2.1, and 42.0.0-beta.3.
Severity
5.3 (Medium)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-05 18:27 UTC
CWE
- CWE-20 - Improper Input Validation
Assigner
References
13 references
| URL | Tags |
|---|---|
| https://github.com/electron/electron/security/adv… | x_refsource_CONFIRM |
| https://github.com/electron/electron/pull/50946 | x_refsource_MISC |
| https://github.com/electron/electron/pull/50947 | x_refsource_MISC |
| https://github.com/electron/electron/pull/50948 | x_refsource_MISC |
| https://github.com/electron/electron/pull/50949 | x_refsource_MISC |
| https://github.com/electron/electron/commit/30cf3… | x_refsource_MISC |
| https://github.com/electron/electron/commit/4eff3… | x_refsource_MISC |
| https://github.com/electron/electron/commit/615d6… | x_refsource_MISC |
| https://github.com/electron/electron/commit/fe2e7… | x_refsource_MISC |
| https://github.com/electron/electron/releases/tag… | x_refsource_MISC |
| https://github.com/electron/electron/releases/tag… | x_refsource_MISC |
| https://github.com/electron/electron/releases/tag… | x_refsource_MISC |
| https://github.com/electron/electron/releases/tag… | x_refsource_MISC |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-70607",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-05T18:27:03.596456Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T18:27:13.014Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "electron",
"vendor": "electron",
"versions": [
{
"status": "affected",
"version": "\u003c 39.8.8"
},
{
"status": "affected",
"version": "\u003e= 40.0.0-alpha.1, \u003c 40.9.0"
},
{
"status": "affected",
"version": "\u003e= 41.0.0-alpha.1, \u003c 41.2.1"
},
{
"status": "affected",
"version": "\u003e= 42.0.0-alpha.1, \u003c 42.0.0-beta.3"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.8, 40.9.0, 41.2.1, and 42.0.0-beta.3, some window options supplied by web content in the window.open() features string were applied to the new BrowserWindow without an allowlist. Untrusted content could set window options it should not control, including options that cause the main process to access attacker-chosen file or network paths, when untrusted content can call window.open() and the app does not override child window options via setWindowOpenHandler or overrideBrowserWindowOptions. This issue is fixed in 39.8.8, 40.9.0, 41.2.1, and 42.0.0-beta.3."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-20",
"description": "CWE-20: Improper Input Validation",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T16:24:11.939Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/electron/electron/security/advisories/GHSA-v93f-fgjr-hjrj",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/electron/electron/security/advisories/GHSA-v93f-fgjr-hjrj"
},
{
"name": "https://github.com/electron/electron/pull/50946",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/electron/electron/pull/50946"
},
{
"name": "https://github.com/electron/electron/pull/50947",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/electron/electron/pull/50947"
},
{
"name": "https://github.com/electron/electron/pull/50948",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/electron/electron/pull/50948"
},
{
"name": "https://github.com/electron/electron/pull/50949",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/electron/electron/pull/50949"
},
{
"name": "https://github.com/electron/electron/commit/30cf3882de75ee651bd4e5f27002f13fd3d3163a",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/electron/electron/commit/30cf3882de75ee651bd4e5f27002f13fd3d3163a"
},
{
"name": "https://github.com/electron/electron/commit/4eff3dc09e4d1e62d649c5ce9902f532bb7469c7",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/electron/electron/commit/4eff3dc09e4d1e62d649c5ce9902f532bb7469c7"
},
{
"name": "https://github.com/electron/electron/commit/615d62500fc7732d068274b796c49487e652e90b",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/electron/electron/commit/615d62500fc7732d068274b796c49487e652e90b"
},
{
"name": "https://github.com/electron/electron/commit/fe2e7d0073949b4593b624b93abf1788f5377e55",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/electron/electron/commit/fe2e7d0073949b4593b624b93abf1788f5377e55"
},
{
"name": "https://github.com/electron/electron/releases/tag/v39.8.8",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/electron/electron/releases/tag/v39.8.8"
},
{
"name": "https://github.com/electron/electron/releases/tag/v40.9.0",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/electron/electron/releases/tag/v40.9.0"
},
{
"name": "https://github.com/electron/electron/releases/tag/v41.2.1",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/electron/electron/releases/tag/v41.2.1"
},
{
"name": "https://github.com/electron/electron/releases/tag/v42.0.0-beta.3",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/electron/electron/releases/tag/v42.0.0-beta.3"
}
],
"source": {
"advisory": "GHSA-v93f-fgjr-hjrj",
"discovery": "UNKNOWN"
},
"title": "Electron: window.open features string controls some window options considered privileged"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-70607",
"datePublished": "2026-08-05T16:24:11.939Z",
"dateReserved": "2026-08-04T19:50:27.329Z",
"dateUpdated": "2026-08-05T18:27:13.014Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-70606 (GCVE-0-2026-70606)
Vulnerability from cvelistv5 – Published: 2026-08-05 16:07 – Updated: 2026-08-05 17:23
VLAI
EPSS
VEX
Title
Electron: ProtocolResponse.url reuses the default session cache instead of the registering session
Summary
Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 40.10.6, 41.9.1, 42.5.1, and 43.0.0, when a custom protocol handler returned a ProtocolResponse with a url and no session, Electron made the upstream request through defaultSession instead of the session that handled the protocol. A cached response could then be reused across otherwise isolated session partitions. Apps that use ProtocolResponse.url, omit ProtocolResponse.session, and rely on separate sessions to isolate content are affected. This issue is fixed in versions 40.10.6, 41.9.1, 42.5.1, and 43.0.0.
Severity
5.9 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-05 17:15 UTC
CWE
- CWE-668 - Exposure of Resource to Wrong Sphere
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://github.com/electron/electron/security/adv… | x_refsource_CONFIRM |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-70606",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-05T17:15:44.765454Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T17:23:30.639Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "electron",
"vendor": "electron",
"versions": [
{
"status": "affected",
"version": "\u003e= 40.0.0-alpha.1, \u003c 40.10.6"
},
{
"status": "affected",
"version": "\u003e= 41.0.0-alpha.1, \u003c 41.9.1"
},
{
"status": "affected",
"version": "\u003e= 42.0.0-alpha.1, \u003c 42.5.1"
},
{
"status": "affected",
"version": "\u003e= 43.0.0-alpha.1, \u003c 43.0.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 40.10.6, 41.9.1, 42.5.1, and 43.0.0, when a custom protocol handler returned a ProtocolResponse with a url and no session, Electron made the upstream request through defaultSession instead of the session that handled the protocol. A cached response could then be reused across otherwise isolated session partitions. Apps that use ProtocolResponse.url, omit ProtocolResponse.session, and rely on separate sessions to isolate content are affected. This issue is fixed in versions 40.10.6, 41.9.1, 42.5.1, and 43.0.0."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.9,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-668",
"description": "CWE-668: Exposure of Resource to Wrong Sphere",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T16:07:46.008Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/electron/electron/security/advisories/GHSA-r4w5-6pfg-jxp5",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/electron/electron/security/advisories/GHSA-r4w5-6pfg-jxp5"
}
],
"source": {
"advisory": "GHSA-r4w5-6pfg-jxp5",
"discovery": "UNKNOWN"
},
"title": "Electron: ProtocolResponse.url reuses the default session cache instead of the registering session"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-70606",
"datePublished": "2026-08-05T16:07:46.008Z",
"dateReserved": "2026-08-04T19:50:27.328Z",
"dateUpdated": "2026-08-05T17:23:30.639Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-70605 (GCVE-0-2026-70605)
Vulnerability from cvelistv5 – Published: 2026-08-05 16:04 – Updated: 2026-08-06 14:24
VLAI
EPSS
VEX
Title
Electron: HTTP redirect followed into local file loader
Summary
Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.8, 40.9.0, 41.2.1, and 42.0.0-beta.3, when following HTTP redirects, net.fetch() and net.request() did not restrict which schemes a redirect could target. A remote server could redirect a request to a local resource, and if the app returns or forwards the response body, local file contents could be disclosed. Apps are only affected if they make net requests to attacker-influenced URLs with redirects followed and expose the response body. This issue is fixed in versions 39.8.8, 40.9.0, 41.2.1, and 42.0.0-beta.3.
Severity
5.9 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-06 14:23 UTC
CWE
- CWE-918 - Server-Side Request Forgery (SSRF)
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://github.com/electron/electron/security/adv… | x_refsource_CONFIRM |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-70605",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-06T14:23:48.944947Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-06T14:24:06.012Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "electron",
"vendor": "electron",
"versions": [
{
"status": "affected",
"version": "\u003c 39.8.8"
},
{
"status": "affected",
"version": "\u003e= 40.0.0-alpha.1, \u003c 40.9.0"
},
{
"status": "affected",
"version": "\u003e= 41.0.0-alpha.1, \u003c 41.2.1"
},
{
"status": "affected",
"version": "\u003e= 42.0.0-alpha.1, \u003c 42.0.0-beta.3"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.8, 40.9.0, 41.2.1, and 42.0.0-beta.3, when following HTTP redirects, net.fetch() and net.request() did not restrict which schemes a redirect could target. A remote server could redirect a request to a local resource, and if the app returns or forwards the response body, local file contents could be disclosed. Apps are only affected if they make net requests to attacker-influenced URLs with redirects followed and expose the response body. This issue is fixed in versions 39.8.8, 40.9.0, 41.2.1, and 42.0.0-beta.3."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.9,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-918",
"description": "CWE-918: Server-Side Request Forgery (SSRF)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T16:04:12.428Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/electron/electron/security/advisories/GHSA-v64r-4m7r-3mvq",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/electron/electron/security/advisories/GHSA-v64r-4m7r-3mvq"
}
],
"source": {
"advisory": "GHSA-v64r-4m7r-3mvq",
"discovery": "UNKNOWN"
},
"title": "Electron: HTTP redirect followed into local file loader"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-70605",
"datePublished": "2026-08-05T16:04:12.428Z",
"dateReserved": "2026-08-04T19:50:27.328Z",
"dateUpdated": "2026-08-06T14:24:06.012Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-70604 (GCVE-0-2026-70604)
Vulnerability from cvelistv5 – Published: 2026-08-05 15:59 – Updated: 2026-08-05 18:41
VLAI
EPSS
VEX
Title
Electron: Custom protocol with supportFetchAPI but not corsEnabled allows cross-origin reads
Summary
Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.10, 40.9.3, 41.4.0, and 42.0.0, a custom scheme registered with supportFetchAPI: true but without corsEnabled: true was not subject to CORS enforcement. A page loaded from a remote origin could therefore fetch() or XMLHttpRequest that scheme cross-origin and read the full response body, rather than the read being blocked. Apps that serve sensitive data from such a scheme and load remote or untrusted content in a renderer are affected. This issue is fixed in versions 39.8.10, 40.9.3, 41.4.0, and 42.0.0.
Severity
7.4 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-05 18:13 UTC
CWE
- CWE-942 - Permissive Cross-domain Policy with Untrusted Domains
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://github.com/electron/electron/security/adv… | x_refsource_CONFIRM |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-70604",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-05T18:13:52.321211Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T18:41:32.481Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "electron",
"vendor": "electron",
"versions": [
{
"status": "affected",
"version": "\u003c 39.8.10"
},
{
"status": "affected",
"version": "\u003e= 40.0.0-alpha.1, \u003c 40.9.3"
},
{
"status": "affected",
"version": "\u003e= 41.0.0-alpha.1, \u003c 41.4.0"
},
{
"status": "affected",
"version": "\u003e= 42.0.0-alpha.1, \u003c 42.0.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.10, 40.9.3, 41.4.0, and 42.0.0, a custom scheme registered with supportFetchAPI: true but without corsEnabled: true was not subject to CORS enforcement. A page loaded from a remote origin could therefore fetch() or XMLHttpRequest that scheme cross-origin and read the full response body, rather than the read being blocked. Apps that serve sensitive data from such a scheme and load remote or untrusted content in a renderer are affected. This issue is fixed in versions 39.8.10, 40.9.3, 41.4.0, and 42.0.0."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.4,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-942",
"description": "CWE-942: Permissive Cross-domain Policy with Untrusted Domains",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T15:59:24.043Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/electron/electron/security/advisories/GHSA-v3j7-r9gq-3gjw",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/electron/electron/security/advisories/GHSA-v3j7-r9gq-3gjw"
}
],
"source": {
"advisory": "GHSA-v3j7-r9gq-3gjw",
"discovery": "UNKNOWN"
},
"title": "Electron: Custom protocol with supportFetchAPI but not corsEnabled allows cross-origin reads"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-70604",
"datePublished": "2026-08-05T15:59:24.043Z",
"dateReserved": "2026-08-04T19:50:27.328Z",
"dateUpdated": "2026-08-05T18:41:32.481Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-70603 (GCVE-0-2026-70603)
Vulnerability from cvelistv5 – Published: 2026-08-05 15:56 – Updated: 2026-08-06 03:55
VLAI
EPSS
VEX
Title
Electron: shell.openPath path validation bypass via embedded null byte
Summary
Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.6, 40.9.0, 41.1.1, and 42.0.0-beta.1, shell.openPath() did not reject paths containing embedded null bytes. Apps that perform string-only validation of file paths, for example checking the file extension, before passing them to shell.openPath() could be bypassed, allowing an attacker-controlled path to open a different file than the one that passed validation. Apps are only affected if they pass paths derived from untrusted input to shell.openPath() and rely on string-based validation without a filesystem check. This issue is fixed in versions 39.8.6, 40.9.0, 41.1.1, and 42.0.0-beta.1.
Severity
6 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-05 00:00 UTC
CWE
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://github.com/electron/electron/security/adv… | x_refsource_CONFIRM |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-70603",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-05T00:00:00+00:00",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-06T03:55:27.402Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "electron",
"vendor": "electron",
"versions": [
{
"status": "affected",
"version": "\u003c 39.8.6"
},
{
"status": "affected",
"version": "\u003e= 40.0.0-alpha.1, \u003c 40.9.0"
},
{
"status": "affected",
"version": "\u003e= 41.0.0-alpha.1, \u003c 41.1.1"
},
{
"status": "affected",
"version": "\u003e= 42.0.0-alpha.1, \u003c 42.0.0-beta.1"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.6, 40.9.0, 41.1.1, and 42.0.0-beta.1, shell.openPath() did not reject paths containing embedded null bytes. Apps that perform string-only validation of file paths, for example checking the file extension, before passing them to shell.openPath() could be bypassed, allowing an attacker-controlled path to open a different file than the one that passed validation. Apps are only affected if they pass paths derived from untrusted input to shell.openPath() and rely on string-based validation without a filesystem check. This issue is fixed in versions 39.8.6, 40.9.0, 41.1.1, and 42.0.0-beta.1."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "LOCAL",
"availabilityImpact": "NONE",
"baseScore": 6,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-20",
"description": "CWE-20: Improper Input Validation",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-158",
"description": "CWE-158: Improper Neutralization of Null Byte or NUL Character",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T15:56:50.574Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/electron/electron/security/advisories/GHSA-5c9j-mhmv-5xgx",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/electron/electron/security/advisories/GHSA-5c9j-mhmv-5xgx"
}
],
"source": {
"advisory": "GHSA-5c9j-mhmv-5xgx",
"discovery": "UNKNOWN"
},
"title": "Electron: shell.openPath path validation bypass via embedded null byte"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-70603",
"datePublished": "2026-08-05T15:56:50.574Z",
"dateReserved": "2026-08-04T19:50:27.328Z",
"dateUpdated": "2026-08-06T03:55:27.402Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-70602 (GCVE-0-2026-70602)
Vulnerability from cvelistv5 – Published: 2026-08-05 15:54 – Updated: 2026-08-05 16:13
VLAI
EPSS
VEX
Title
Electron: Extension tab APIs operate across session boundaries
Summary
Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.8, 40.9.0, 41.2.1, and 42.0.0-beta.3, extension tab and scripting APIs were not scoped to the extension's own session. A malicious or compromised extension loaded into one session could navigate, script, and read from windows belonging to a different session. Apps are only affected if they load Chrome extensions via session.loadExtension and rely on separate sessions to isolate that extension from other content. This issue is fixed in versions 39.8.8, 40.9.0, 41.2.1, and 42.0.0-beta.3.
Severity
6.6 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-05 16:12 UTC
CWE
- CWE-284 - Improper Access Control
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://github.com/electron/electron/security/adv… | x_refsource_CONFIRM |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-70602",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-05T16:12:59.028629Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T16:13:06.513Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "electron",
"vendor": "electron",
"versions": [
{
"status": "affected",
"version": "\u003c 39.8.8"
},
{
"status": "affected",
"version": "\u003e= 40.0.0-alpha.1, \u003c 40.9.0"
},
{
"status": "affected",
"version": "\u003e= 41.0.0-alpha.1, \u003c 41.2.1"
},
{
"status": "affected",
"version": "\u003e= 42.0.0-alpha.1, \u003c 42.0.0-beta.3"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.8, 40.9.0, 41.2.1, and 42.0.0-beta.3, extension tab and scripting APIs were not scoped to the extension\u0027s own session. A malicious or compromised extension loaded into one session could navigate, script, and read from windows belonging to a different session. Apps are only affected if they load Chrome extensions via session.loadExtension and rely on separate sessions to isolate that extension from other content. This issue is fixed in versions 39.8.8, 40.9.0, 41.2.1, and 42.0.0-beta.3."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.6,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "LOW",
"privilegesRequired": "HIGH",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-284",
"description": "CWE-284: Improper Access Control",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T15:54:49.931Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/electron/electron/security/advisories/GHSA-m55f-7gqj-fr98",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/electron/electron/security/advisories/GHSA-m55f-7gqj-fr98"
}
],
"source": {
"advisory": "GHSA-m55f-7gqj-fr98",
"discovery": "UNKNOWN"
},
"title": "Electron: Extension tab APIs operate across session boundaries"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-70602",
"datePublished": "2026-08-05T15:54:49.931Z",
"dateReserved": "2026-08-04T19:50:27.328Z",
"dateUpdated": "2026-08-05T16:13:06.513Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-70601 (GCVE-0-2026-70601)
Vulnerability from cvelistv5 – Published: 2026-08-05 15:45 – Updated: 2026-08-05 17:30
VLAI
EPSS
VEX
Title
Electron: Context isolation bypass via Function.prototype.bind hijack
Summary
Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.9, 40.9.2, 41.2.2, and 42.0.0-beta.5, apps that expose Promise-returning functions to web content via contextBridge may be vulnerable to a context isolation bypass. Untrusted web content could obtain access to the isolated preload world and, through it, every capability the preload script has. In renderers without a sandbox, or with nodeIntegration enabled, this may escalate to Node.js access. Apps are affected if they expose Promise-returning functions via contextBridge, the standard pattern for wrapping ipcRenderer.invoke, in windows that load untrusted content. This issue is fixed in versions 39.8.9, 40.9.2, 41.2.2, and 42.0.0-beta.5.
Severity
7.5 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-05 17:29 UTC
CWE
- CWE-693 - Protection Mechanism Failure
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://github.com/electron/electron/security/adv… | x_refsource_CONFIRM |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-70601",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-05T17:29:54.563592Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T17:30:28.446Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "electron",
"vendor": "electron",
"versions": [
{
"status": "affected",
"version": "\u003c 39.8.9"
},
{
"status": "affected",
"version": "\u003e= 40.0.0-alpha.1, \u003c 40.9.2"
},
{
"status": "affected",
"version": "\u003e= 41.0.0-alpha.1, \u003c 41.2.2"
},
{
"status": "affected",
"version": "\u003e= 42.0.0-alpha.1, \u003c 42.0.0-beta.5"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.9, 40.9.2, 41.2.2, and 42.0.0-beta.5, apps that expose Promise-returning functions to web content via contextBridge may be vulnerable to a context isolation bypass. Untrusted web content could obtain access to the isolated preload world and, through it, every capability the preload script has. In renderers without a sandbox, or with nodeIntegration enabled, this may escalate to Node.js access. Apps are affected if they expose Promise-returning functions via contextBridge, the standard pattern for wrapping ipcRenderer.invoke, in windows that load untrusted content. This issue is fixed in versions 39.8.9, 40.9.2, 41.2.2, and 42.0.0-beta.5."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-693",
"description": "CWE-693: Protection Mechanism Failure",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T15:45:31.315Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/electron/electron/security/advisories/GHSA-h7rp-cf8h-j98x",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/electron/electron/security/advisories/GHSA-h7rp-cf8h-j98x"
}
],
"source": {
"advisory": "GHSA-h7rp-cf8h-j98x",
"discovery": "UNKNOWN"
},
"title": "Electron: Context isolation bypass via Function.prototype.bind hijack"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-70601",
"datePublished": "2026-08-05T15:45:31.315Z",
"dateReserved": "2026-08-04T19:50:27.328Z",
"dateUpdated": "2026-08-05T17:30:28.446Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-70600 (GCVE-0-2026-70600)
Vulnerability from cvelistv5 – Published: 2026-08-05 15:40 – Updated: 2026-08-06 14:21
VLAI
EPSS
VEX
Title
Electron: Cross-origin iframe can position native autofill popup
Summary
Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.8, 40.9.0, 41.2.1, and 42.0.0-beta.3, the native autofill popup could be positioned by a cross-origin iframe outside that iframe's bounds, over the embedding page's UI, enabling clickjacking or spoofing of trusted UI. Apps are only affected if they embed untrusted content in iframes within windows that also display trusted UI. Apps that do not embed untrusted third-party content are not affected. This issue is fixed in versions 39.8.8, 40.9.0, 41.2.1, and 42.0.0-beta.3.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-06 14:21 UTC
CWE
- CWE-1021 - Improper Restriction of Rendered UI Layers or Frames
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://github.com/electron/electron/security/adv… | x_refsource_CONFIRM |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-70600",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-06T14:21:34.549765Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-06T14:21:44.543Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "electron",
"vendor": "electron",
"versions": [
{
"status": "affected",
"version": "\u003c 39.8.8"
},
{
"status": "affected",
"version": "\u003e= 40.0.0-alpha.1, \u003c 40.9.0"
},
{
"status": "affected",
"version": "\u003e= 41.0.0-alpha.1, \u003c 41.2.1"
},
{
"status": "affected",
"version": "\u003e= 42.0.0-alpha.1, \u003c 42.0.0-beta.3"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.8, 40.9.0, 41.2.1, and 42.0.0-beta.3, the native autofill popup could be positioned by a cross-origin iframe outside that iframe\u0027s bounds, over the embedding page\u0027s UI, enabling clickjacking or spoofing of trusted UI. Apps are only affected if they embed untrusted content in iframes within windows that also display trusted UI. Apps that do not embed untrusted third-party content are not affected. This issue is fixed in versions 39.8.8, 40.9.0, 41.2.1, and 42.0.0-beta.3."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 3.1,
"baseSeverity": "LOW",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-1021",
"description": "CWE-1021: Improper Restriction of Rendered UI Layers or Frames",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T15:40:27.570Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/electron/electron/security/advisories/GHSA-x8rc-wpg4-grpf",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/electron/electron/security/advisories/GHSA-x8rc-wpg4-grpf"
}
],
"source": {
"advisory": "GHSA-x8rc-wpg4-grpf",
"discovery": "UNKNOWN"
},
"title": "Electron: Cross-origin iframe can position native autofill popup"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-70600",
"datePublished": "2026-08-05T15:40:27.570Z",
"dateReserved": "2026-08-04T19:50:27.328Z",
"dateUpdated": "2026-08-06T14:21:44.543Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-70599 (GCVE-0-2026-70599)
Vulnerability from cvelistv5 – Published: 2026-08-05 15:36 – Updated: 2026-08-05 18:41
VLAI
EPSS
VEX
Title
Electron: Permission Check Handler Receives Main Frame Origin Instead of Requesting Iframe Origin
Summary
Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.7, 40.9.0, 41.2.0, and 42.0.0-beta.1, serial-port and media permission checks made from an iframe passed the top-level frame origin to session.setPermissionCheckHandler instead of the requesting iframe origin. Origin-based handler logic could grant a cross-origin iframe device access intended only for the top-level origin. This issue is fixed in 39.8.7, 40.9.0, 41.2.0, and 42.0.0-beta.1.
Severity
5.9 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-05 18:13 UTC
CWE
- CWE-346 - Origin Validation Error
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/electron/electron/security/adv… | x_refsource_CONFIRM |
| https://github.com/electron/electron/commit/0cbdf… | x_refsource_MISC |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-70599",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-05T18:13:54.699962Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T18:41:57.567Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "electron",
"vendor": "electron",
"versions": [
{
"status": "affected",
"version": "\u003c 39.8.7"
},
{
"status": "affected",
"version": "\u003e= 40.0.0-alpha.1, \u003c 40.9.0"
},
{
"status": "affected",
"version": "\u003e= 41.0.0-alpha.1, \u003c 41.2.0"
},
{
"status": "affected",
"version": "\u003e= 42.0.0-alpha.1, \u003c 42.0.0-beta.1"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.7, 40.9.0, 41.2.0, and 42.0.0-beta.1, serial-port and media permission checks made from an iframe passed the top-level frame origin to session.setPermissionCheckHandler instead of the requesting iframe origin. Origin-based handler logic could grant a cross-origin iframe device access intended only for the top-level origin. This issue is fixed in 39.8.7, 40.9.0, 41.2.0, and 42.0.0-beta.1."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.9,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-346",
"description": "CWE-346: Origin Validation Error",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T15:36:02.182Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/electron/electron/security/advisories/GHSA-9pf5-hg6p-4pwp",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/electron/electron/security/advisories/GHSA-9pf5-hg6p-4pwp"
},
{
"name": "https://github.com/electron/electron/commit/0cbdf2f0375466d701aa393c92e0ec29eb89ea6c",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/electron/electron/commit/0cbdf2f0375466d701aa393c92e0ec29eb89ea6c"
}
],
"source": {
"advisory": "GHSA-9pf5-hg6p-4pwp",
"discovery": "UNKNOWN"
},
"title": "Electron: Permission Check Handler Receives Main Frame Origin Instead of Requesting Iframe Origin"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-70599",
"datePublished": "2026-08-05T15:36:02.182Z",
"dateReserved": "2026-08-04T19:50:27.328Z",
"dateUpdated": "2026-08-05T18:41:57.567Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-70598 (GCVE-0-2026-70598)
Vulnerability from cvelistv5 – Published: 2026-08-05 15:27 – Updated: 2026-08-05 18:15
VLAI
EPSS
VEX
Title
Electron: Off-screen rendering trusts GPU-supplied geometry over shared-memory size
Summary
Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.10, 40.9.0, 41.2.1, and 42.0.0-beta.3, offscreen rendering frame data received from the GPU process was not fully validated by the main process. A compromised GPU process could cause the main process to read out-of-bounds memory while producing paint event images, disclosing memory or crashing the app. This issue is fixed in 39.8.10, 40.9.0, 41.2.1, and 42.0.0-beta.3.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-05 18:15 UTC
CWE
- CWE-125 - Out-of-bounds Read
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/electron/electron/security/adv… | x_refsource_CONFIRM |
| https://github.com/electron/electron/commit/2c246… | x_refsource_MISC |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-70598",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-05T18:15:41.871588Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T18:15:50.518Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "electron",
"vendor": "electron",
"versions": [
{
"status": "affected",
"version": "\u003c 39.8.10"
},
{
"status": "affected",
"version": "\u003e= 40.0.0-alpha.1, \u003c 40.9.0"
},
{
"status": "affected",
"version": "\u003e= 41.0.0-alpha.1, \u003c 41.2.1"
},
{
"status": "affected",
"version": "\u003e= 42.0.0-alpha.1, \u003c 42.0.0-beta.3"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.10, 40.9.0, 41.2.1, and 42.0.0-beta.3, offscreen rendering frame data received from the GPU process was not fully validated by the main process. A compromised GPU process could cause the main process to read out-of-bounds memory while producing paint event images, disclosing memory or crashing the app. This issue is fixed in 39.8.10, 40.9.0, 41.2.1, and 42.0.0-beta.3."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "LOCAL",
"availabilityImpact": "LOW",
"baseScore": 3.9,
"baseSeverity": "LOW",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "HIGH",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:L/I:N/A:L",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-125",
"description": "CWE-125: Out-of-bounds Read",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T15:27:24.392Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/electron/electron/security/advisories/GHSA-pfmc-3mgc-p6fp",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/electron/electron/security/advisories/GHSA-pfmc-3mgc-p6fp"
},
{
"name": "https://github.com/electron/electron/commit/2c24640e7b0b9c74fe9f44bce0fde138340ff4fb",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/electron/electron/commit/2c24640e7b0b9c74fe9f44bce0fde138340ff4fb"
}
],
"source": {
"advisory": "GHSA-pfmc-3mgc-p6fp",
"discovery": "UNKNOWN"
},
"title": "Electron: Off-screen rendering trusts GPU-supplied geometry over shared-memory size"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-70598",
"datePublished": "2026-08-05T15:27:24.392Z",
"dateReserved": "2026-08-04T19:50:27.328Z",
"dateUpdated": "2026-08-05T18:15:50.518Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-70597 (GCVE-0-2026-70597)
Vulnerability from cvelistv5 – Published: 2026-08-05 15:21 – Updated: 2026-08-06 03:55
VLAI
EPSS
VEX
Title
Electron: Parent process code-sign check is spoofable
Summary
Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.8, 40.9.0, 41.2.1, and 42.0.0-beta.3, the check Electron uses on macOS to confirm it was launched by a same-signed parent process could be bypassed by a local process. Apps that enable fuse-based hardening restricting ELECTRON_RUN_AS_NODE and NODE_OPTIONS to same-signed parents rely on this check, and a local attacker could bypass it and run code inside the signed app, inheriting its TCC permissions and keychain access. This issue is fixed in 39.8.8, 40.9.0, 41.2.1, and 42.0.0-beta.3.
Severity
6.3 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-05 00:00 UTC
CWE
- CWE-367 - Time-of-check Time-of-use (TOCTOU) Race Condition
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/electron/electron/security/adv… | x_refsource_CONFIRM |
| https://github.com/electron/electron/commit/0a629… | x_refsource_MISC |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-70597",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-05T00:00:00+00:00",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-06T03:55:28.858Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "electron",
"vendor": "electron",
"versions": [
{
"status": "affected",
"version": "\u003c 39.8.8"
},
{
"status": "affected",
"version": "\u003e= 40.0.0-alpha.1, \u003c 40.9.0"
},
{
"status": "affected",
"version": "\u003e= 41.0.0-alpha.1, \u003c 41.2.1"
},
{
"status": "affected",
"version": "\u003e= 42.0.0-alpha.1, \u003c 42.0.0-beta.3"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.8, 40.9.0, 41.2.1, and 42.0.0-beta.3, the check Electron uses on macOS to confirm it was launched by a same-signed parent process could be bypassed by a local process. Apps that enable fuse-based hardening restricting ELECTRON_RUN_AS_NODE and NODE_OPTIONS to same-signed parents rely on this check, and a local attacker could bypass it and run code inside the signed app, inheriting its TCC permissions and keychain access. This issue is fixed in 39.8.8, 40.9.0, 41.2.1, and 42.0.0-beta.3."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "LOCAL",
"availabilityImpact": "NONE",
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-367",
"description": "CWE-367: Time-of-check Time-of-use (TOCTOU) Race Condition",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T15:23:14.524Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/electron/electron/security/advisories/GHSA-jm7p-cc5g-qwxx",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/electron/electron/security/advisories/GHSA-jm7p-cc5g-qwxx"
},
{
"name": "https://github.com/electron/electron/commit/0a6291a97d210db3733689e70a51f5711e38ed35",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/electron/electron/commit/0a6291a97d210db3733689e70a51f5711e38ed35"
}
],
"source": {
"advisory": "GHSA-jm7p-cc5g-qwxx",
"discovery": "UNKNOWN"
},
"title": "Electron: Parent process code-sign check is spoofable"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-70597",
"datePublished": "2026-08-05T15:21:11.054Z",
"dateReserved": "2026-08-04T19:50:27.328Z",
"dateUpdated": "2026-08-06T03:55:28.858Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-54257 (GCVE-0-2026-54257)
Vulnerability from cvelistv5 – Published: 2026-06-23 17:08 – Updated: 2026-06-23 17:47
VLAI
EPSS
VEX
Title
Electron: Buffer performs incorrect byte length calculations resulting in heap buffer under/overflow
Summary
Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. From 42.3.1 until 42.3.3, Buffer performs incorrect byte length calculations resulting in heap buffer under/overflow. Most apps will crash and some may perform incorrect buffer allocations in the Node.js Buffer API resulting in unexpected truncation or allocation. This vulnerability is fixed in 42.3.3.
Severity
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-06-23 17:47 UTC
CWE
- CWE-120 - Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://github.com/electron/electron/security/adv… | x_refsource_CONFIRM |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-54257",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-06-23T17:47:37.791277Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-06-23T17:47:47.594Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "electron",
"vendor": "electron",
"versions": [
{
"status": "affected",
"version": "\u003e= 42.3.1, \u003c 42.3.3"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. From 42.3.1 until 42.3.3, Buffer performs incorrect byte length calculations resulting in heap buffer under/overflow. Most apps will crash and some may perform incorrect buffer allocations in the Node.js Buffer API resulting in unexpected truncation or allocation. This vulnerability is fixed in 42.3.3."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 9.3,
"baseSeverity": "CRITICAL",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-120",
"description": "CWE-120: Buffer Copy without Checking Size of Input (\u0027Classic Buffer Overflow\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-06-23T17:08:31.786Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/electron/electron/security/advisories/GHSA-q6m5-f73j-m9mc",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/electron/electron/security/advisories/GHSA-q6m5-f73j-m9mc"
}
],
"source": {
"advisory": "GHSA-q6m5-f73j-m9mc",
"discovery": "UNKNOWN"
},
"title": "Electron: Buffer performs incorrect byte length calculations resulting in heap buffer under/overflow"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-54257",
"datePublished": "2026-06-23T17:08:31.786Z",
"dateReserved": "2026-06-12T17:13:32.278Z",
"dateUpdated": "2026-06-23T17:47:47.594Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-34781 (GCVE-0-2026-34781)
Vulnerability from cvelistv5 – Published: 2026-04-07 21:20 – Updated: 2026-04-08 16:14
VLAI
EPSS
VEX
Title
Electron crashes in clipboard.readImage() on malformed clipboard image data
Summary
Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.5, 40.8.5, 41.1.0, and 42.0.0-alpha.5, apps that call clipboard.readImage() may be vulnerable to a denial of service. If the system clipboard contains image data that fails to decode, the resulting null bitmap is passed unchecked to image construction, triggering a controlled abort and crashing the process. Apps are only affected if they call clipboard.readImage(). Apps that do not read images from the clipboard are not affected. This issue does not allow memory corruption or code execution. This vulnerability is fixed in 39.8.5, 40.8.5, 41.1.0, and 42.0.0-alpha.5.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-04-08 16:10 UTC
CWE
- CWE-476 - NULL Pointer Dereference
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://github.com/electron/electron/security/adv… | x_refsource_CONFIRM |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-34781",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-04-08T16:10:12.958024Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-04-08T16:14:38.564Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "electron",
"vendor": "electron",
"versions": [
{
"status": "affected",
"version": "\u003c 39.8.5"
},
{
"status": "affected",
"version": "\u003e= 40.0.0-alpha.1, \u003c 40.8.5"
},
{
"status": "affected",
"version": "\u003e= 41.0.0-alpha.1, \u003c 41.1.0"
},
{
"status": "affected",
"version": "\u003e= 42.0.0-alpha.1, \u003c 42.0.0-alpha.5"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.5, 40.8.5, 41.1.0, and 42.0.0-alpha.5, apps that call clipboard.readImage() may be vulnerable to a denial of service. If the system clipboard contains image data that fails to decode, the resulting null bitmap is passed unchecked to image construction, triggering a controlled abort and crashing the process. Apps are only affected if they call clipboard.readImage(). Apps that do not read images from the clipboard are not affected. This issue does not allow memory corruption or code execution. This vulnerability is fixed in 39.8.5, 40.8.5, 41.1.0, and 42.0.0-alpha.5."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "LOW",
"baseScore": 2.8,
"baseSeverity": "LOW",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:L",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-476",
"description": "CWE-476: NULL Pointer Dereference",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-04-07T21:20:12.517Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/electron/electron/security/advisories/GHSA-f37v-82c4-4x64",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/electron/electron/security/advisories/GHSA-f37v-82c4-4x64"
}
],
"source": {
"advisory": "GHSA-f37v-82c4-4x64",
"discovery": "UNKNOWN"
},
"title": "Electron crashes in clipboard.readImage() on malformed clipboard image data"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-34781",
"datePublished": "2026-04-07T21:20:12.517Z",
"dateReserved": "2026-03-30T19:54:55.556Z",
"dateUpdated": "2026-04-08T16:14:38.564Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-34765 (GCVE-0-2026-34765)
Vulnerability from cvelistv5 – Published: 2026-04-07 21:18 – Updated: 2026-04-13 15:37
VLAI
EPSS
VEX
Title
Electron named window.open targets not scoped to the opener's browsing context
Summary
Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.5, 40.8.5, 41.1.0, and 42.0.0-alpha.5, when a renderer calls window.open() with a target name, Electron did not correctly scope the named-window lookup to the opener's browsing context group. A renderer could navigate an existing child window that was opened by a different, unrelated renderer if both used the same target name. If that existing child was created with more permissive webPreferences (via setWindowOpenHandler's overrideBrowserWindowOptions), content loaded by the second renderer inherits those permissions. Apps are only affected if they open multiple top-level windows with differing trust levels and use setWindowOpenHandler to grant child windows elevated webPreferences such as a privileged preload script. Apps that do not elevate child window privileges, or that use a single top-level window, are not affected. Apps that additionally grant nodeIntegration: true or sandbox: false to child windows (contrary to the security recommendations) may be exposed to arbitrary code execution. This vulnerability is fixed in 39.8.5, 40.8.5, 41.1.0, and 42.0.0-alpha.5.
Severity
6 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-04-09 03:56 UTC
CWE
- CWE-668 - Exposure of Resource to Wrong Sphere
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://github.com/electron/electron/security/adv… | x_refsource_CONFIRM |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-34765",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-04-09T03:56:10.527333Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-04-13T15:37:12.686Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "electron",
"vendor": "electron",
"versions": [
{
"status": "affected",
"version": "\u003c 39.8.5"
},
{
"status": "affected",
"version": "\u003e= 40.0.0-alpha.1, \u003c 40.8.5"
},
{
"status": "affected",
"version": "\u003e= 41.0.0-alpha.1, \u003c 41.1.0"
},
{
"status": "affected",
"version": "\u003e= 42.0.0-alpha.1, \u003c 42.0.0-alpha.5"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.5, 40.8.5, 41.1.0, and 42.0.0-alpha.5, when a renderer calls window.open() with a target name, Electron did not correctly scope the named-window lookup to the opener\u0027s browsing context group. A renderer could navigate an existing child window that was opened by a different, unrelated renderer if both used the same target name. If that existing child was created with more permissive webPreferences (via setWindowOpenHandler\u0027s overrideBrowserWindowOptions), content loaded by the second renderer inherits those permissions. Apps are only affected if they open multiple top-level windows with differing trust levels and use setWindowOpenHandler to grant child windows elevated webPreferences such as a privileged preload script. Apps that do not elevate child window privileges, or that use a single top-level window, are not affected. Apps that additionally grant nodeIntegration: true or sandbox: false to child windows (contrary to the security recommendations) may be exposed to arbitrary code execution. This vulnerability is fixed in 39.8.5, 40.8.5, 41.1.0, and 42.0.0-alpha.5."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 6,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:L",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-668",
"description": "CWE-668: Exposure of Resource to Wrong Sphere",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-04-07T21:18:35.375Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/electron/electron/security/advisories/GHSA-f3pv-wv63-48x8",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/electron/electron/security/advisories/GHSA-f3pv-wv63-48x8"
}
],
"source": {
"advisory": "GHSA-f3pv-wv63-48x8",
"discovery": "UNKNOWN"
},
"title": "Electron named window.open targets not scoped to the opener\u0027s browsing context"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-34765",
"datePublished": "2026-04-07T21:18:35.375Z",
"dateReserved": "2026-03-30T19:54:55.554Z",
"dateUpdated": "2026-04-13T15:37:12.686Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-34764 (GCVE-0-2026-34764)
Vulnerability from cvelistv5 – Published: 2026-04-06 15:46 – Updated: 2026-04-07 16:00
VLAI
EPSS
VEX
Title
Electron has a use-after-free in offscreen shared texture release() callback
Summary
Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. From 33.0.0-alpha.1 to before 39.8.5, 40.8.5, 41.1.0, and 42.0.0-alpha.5, apps that use offscreen rendering with GPU shared textures may be vulnerable to a use-after-free. Under certain conditions, the release() callback provided on a paint event texture can outlive its backing native state, and invoking it after that point dereferences freed memory in the main process, which may lead to a crash or memory corruption. Apps are only affected if they use offscreen rendering with webPreferences.offscreen: { useSharedTexture: true }. Apps that do not enable shared-texture offscreen rendering are not affected. To mitigate this issue, ensure texture.release() is called promptly after the texture has been consumed, before the texture object becomes unreachable. This vulnerability is fixed in 39.8.5, 40.8.5, 41.1.0, and 42.0.0-alpha.5.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-04-07 15:47 UTC
CWE
- CWE-416 - Use After Free
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://github.com/electron/electron/security/adv… | x_refsource_CONFIRM |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-34764",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-04-07T15:47:38.395738Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-04-07T16:00:32.633Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "electron",
"vendor": "electron",
"versions": [
{
"status": "affected",
"version": "\u003e= 33.0.0-alpha.1, \u003c 39.8.5"
},
{
"status": "affected",
"version": "\u003e= 40.0.0-alpha.1, \u003c 40.8.5"
},
{
"status": "affected",
"version": "\u003e= 41.0.0-alpha.1, \u003c 41.1.0"
},
{
"status": "affected",
"version": "\u003e= 42.0.0-alpha.1, \u003c 42.0.0-alpha.5"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. From 33.0.0-alpha.1 to before 39.8.5, 40.8.5, 41.1.0, and 42.0.0-alpha.5, apps that use offscreen rendering with GPU shared textures may be vulnerable to a use-after-free. Under certain conditions, the release() callback provided on a paint event texture can outlive its backing native state, and invoking it after that point dereferences freed memory in the main process, which may lead to a crash or memory corruption. Apps are only affected if they use offscreen rendering with webPreferences.offscreen: { useSharedTexture: true }. Apps that do not enable shared-texture offscreen rendering are not affected. To mitigate this issue, ensure texture.release() is called promptly after the texture has been consumed, before the texture object becomes unreachable. This vulnerability is fixed in 39.8.5, 40.8.5, 41.1.0, and 42.0.0-alpha.5."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "LOW",
"baseScore": 2.3,
"baseSeverity": "LOW",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:L",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-416",
"description": "CWE-416: Use After Free",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-04-06T15:46:40.189Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/electron/electron/security/advisories/GHSA-8x5q-pvf5-64mp",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/electron/electron/security/advisories/GHSA-8x5q-pvf5-64mp"
}
],
"source": {
"advisory": "GHSA-8x5q-pvf5-64mp",
"discovery": "UNKNOWN"
},
"title": "Electron has a use-after-free in offscreen shared texture release() callback"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-34764",
"datePublished": "2026-04-06T15:46:40.189Z",
"dateReserved": "2026-03-30T19:17:10.225Z",
"dateUpdated": "2026-04-07T16:00:32.633Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-34780 (GCVE-0-2026-34780)
Vulnerability from cvelistv5 – Published: 2026-04-04 00:02 – Updated: 2026-07-15 01:03
VLAI
EPSS
VEX
Title
Electron: Context Isolation bypass via contextBridge VideoFrame transfer
Summary
Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. From versions 39.0.0-alpha.1 to before 39.8.0, 40.0.0-alpha.1 to before 40.7.0, and 41.0.0-alpha.1 to before 41.0.0-beta.8, apps that pass VideoFrame objects (from the WebCodecs API) across the contextBridge are vulnerable to a context isolation bypass. An attacker who can execute JavaScript in the main world (for example, via XSS) can use a bridged VideoFrame to gain access to the isolated world, including any Node.js APIs exposed to the preload script. Apps are only affected if a preload script returns, resolves, or passes a VideoFrame object to the main world via contextBridge.exposeInMainWorld(). Apps that do not bridge VideoFrame objects are not affected. This issue has been patched in versions 39.8.0, 40.7.0, and 41.0.0-beta.8.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-04-07 00:00 UTC
CWE
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/electron/electron/security/adv… | x_refsource_CONFIRM |
| https://access.redhat.com/security/cve/CVE-2026-34780 | vdb-entryx_refsource_REDHAT |
| https://bugzilla.redhat.com/show_bug.cgi?id=2455020 | issue-trackingx_refsource_REDHAT |
| https://security.access.redhat.com/data/csaf/v2/v… | x_sadp-csaf-vex |
Impacted products
3 products
| Vendor | Product | Version | |
|---|---|---|---|
| electron | electron |
Affected:
>= 39.0.0-alpha.1, < 39.8.0
Affected: >= 40.0.0-alpha.1, < 40.7.0 Affected: >= 41.0.0-alpha.1, < 41.0.0-beta.8 |
|
| Red Hat | Red Hat Build of Podman Desktop |
cpe:/a:redhat:podman_desktop:1 |
|
| Red Hat | Red Hat Build of Podman Desktop - Tech Preview |
cpe:/a:redhat:podman_desktop:0 |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-34780",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-04-07T00:00:00+00:00",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-04-08T03:55:42.004Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"affected": [
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:podman_desktop:1"
],
"defaultStatus": "affected",
"packageName": "podman-desktop-macos-1-0",
"product": "Red Hat Build of Podman Desktop",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:podman_desktop:1"
],
"defaultStatus": "affected",
"packageName": "podman-desktop-windows-1-0",
"product": "Red Hat Build of Podman Desktop",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:podman_desktop:0"
],
"defaultStatus": "affected",
"packageName": "rhdesktop/rh-podman-desktop-ext-openshift-local-rhel10",
"product": "Red Hat Build of Podman Desktop - Tech Preview",
"vendor": "Red Hat"
}
],
"datePublic": "2026-04-04T00:02:02.224Z",
"descriptions": [
{
"lang": "en",
"value": "A flaw was found in Electron, a framework for building cross-platform desktop applications. An attacker capable of executing JavaScript in the main world, for instance through a cross-site scripting (XSS) vulnerability, could exploit this flaw. By passing VideoFrame objects from the WebCodecs API across the contextBridge, the attacker could bypass context isolation. This allows them to gain unauthorized access to the isolated world, including Node.js APIs exposed to the preload script, potentially leading to arbitrary code execution within the application."
}
],
"metrics": [
{
"other": {
"content": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"value": "Important"
},
"type": "Red Hat severity rating"
}
},
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-501",
"description": "Trust Boundary Violation",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-15T01:03:46.178Z",
"orgId": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
"shortName": "redhat-SADP"
},
"references": [
{
"tags": [
"vdb-entry",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/security/cve/CVE-2026-34780"
},
{
"name": "RHBZ#2455020",
"tags": [
"issue-tracking",
"x_refsource_REDHAT"
],
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2455020"
},
{
"tags": [
"x_sadp-csaf-vex"
],
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-34780.json"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-04-04T01:00:52.288Z",
"value": "Reported to Red Hat."
},
{
"lang": "en",
"time": "2026-04-04T00:02:02.224Z",
"value": "Made public."
}
],
"title": "electron: Electron: Context Isolation bypass via VideoFrame object transfer",
"workarounds": [
{
"lang": "en",
"value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability."
}
],
"x_adpType": "supplier",
"x_generator": {
"engine": "sadp-cli 1.0.0"
}
}
],
"cna": {
"affected": [
{
"product": "electron",
"vendor": "electron",
"versions": [
{
"status": "affected",
"version": "\u003e= 39.0.0-alpha.1, \u003c 39.8.0"
},
{
"status": "affected",
"version": "\u003e= 40.0.0-alpha.1, \u003c 40.7.0"
},
{
"status": "affected",
"version": "\u003e= 41.0.0-alpha.1, \u003c 41.0.0-beta.8"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. From versions 39.0.0-alpha.1 to before 39.8.0, 40.0.0-alpha.1 to before 40.7.0, and 41.0.0-alpha.1 to before 41.0.0-beta.8, apps that pass VideoFrame objects (from the WebCodecs API) across the contextBridge are vulnerable to a context isolation bypass. An attacker who can execute JavaScript in the main world (for example, via XSS) can use a bridged VideoFrame to gain access to the isolated world, including any Node.js APIs exposed to the preload script. Apps are only affected if a preload script returns, resolves, or passes a VideoFrame object to the main world via contextBridge.exposeInMainWorld(). Apps that do not bridge VideoFrame objects are not affected. This issue has been patched in versions 39.8.0, 40.7.0, and 41.0.0-beta.8."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.4,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-668",
"description": "CWE-668: Exposure of Resource to Wrong Sphere",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-1188",
"description": "CWE-1188: Insecure Default Initialization of Resource",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-04-04T00:02:02.224Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/electron/electron/security/advisories/GHSA-jfqg-hf23-qpw2",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/electron/electron/security/advisories/GHSA-jfqg-hf23-qpw2"
}
],
"source": {
"advisory": "GHSA-jfqg-hf23-qpw2",
"discovery": "UNKNOWN"
},
"title": "Electron: Context Isolation bypass via contextBridge VideoFrame transfer"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-34780",
"datePublished": "2026-04-04T00:02:02.224Z",
"dateReserved": "2026-03-30T19:54:55.556Z",
"dateUpdated": "2026-07-15T01:03:46.178Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-34779 (GCVE-0-2026-34779)
Vulnerability from cvelistv5 – Published: 2026-04-04 00:00 – Updated: 2026-04-08 03:55
VLAI
EPSS
VEX
Title
Electron: AppleScript injection in app.moveToApplicationsFolder on macOS
Summary
Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to versions 38.8.6, 39.8.1, 40.8.0, and 41.0.0-beta.8, on macOS, app.moveToApplicationsFolder() used an AppleScript fallback path that did not properly handle certain characters in the application bundle path. Under specific conditions, a crafted launch path could lead to arbitrary AppleScript execution when the user accepted the move-to-Applications prompt. Apps are only affected if they call app.moveToApplicationsFolder(). Apps that do not use this API are not affected. This issue has been patched in versions 38.8.6, 39.8.1, 40.8.0, and 41.0.0-beta.8.
Severity
6.5 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-04-07 00:00 UTC
CWE
- CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://github.com/electron/electron/security/adv… | x_refsource_CONFIRM |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-34779",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-04-07T00:00:00+00:00",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-04-08T03:55:40.913Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "electron",
"vendor": "electron",
"versions": [
{
"status": "affected",
"version": "\u003c 38.8.6"
},
{
"status": "affected",
"version": "\u003e= 39.0.0-alpha.1, \u003c 39.8.1"
},
{
"status": "affected",
"version": "\u003e= 40.0.0-alpha.1, \u003c 40.8.0"
},
{
"status": "affected",
"version": "\u003e= 41.0.0-alpha.1, \u003c 41.0.0-beta.8"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to versions 38.8.6, 39.8.1, 40.8.0, and 41.0.0-beta.8, on macOS, app.moveToApplicationsFolder() used an AppleScript fallback path that did not properly handle certain characters in the application bundle path. Under specific conditions, a crafted launch path could lead to arbitrary AppleScript execution when the user accepted the move-to-Applications prompt. Apps are only affected if they call app.moveToApplicationsFolder(). Apps that do not use this API are not affected. This issue has been patched in versions 38.8.6, 39.8.1, 40.8.0, and 41.0.0-beta.8."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "LOCAL",
"availabilityImpact": "LOW",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:L",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-78",
"description": "CWE-78: Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-04-04T00:00:41.873Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/electron/electron/security/advisories/GHSA-5rqw-r77c-jp79",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/electron/electron/security/advisories/GHSA-5rqw-r77c-jp79"
}
],
"source": {
"advisory": "GHSA-5rqw-r77c-jp79",
"discovery": "UNKNOWN"
},
"title": "Electron: AppleScript injection in app.moveToApplicationsFolder on macOS"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-34779",
"datePublished": "2026-04-04T00:00:41.873Z",
"dateReserved": "2026-03-30T19:54:55.555Z",
"dateUpdated": "2026-04-08T03:55:40.913Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-34778 (GCVE-0-2026-34778)
Vulnerability from cvelistv5 – Published: 2026-04-03 23:59 – Updated: 2026-04-06 15:50
VLAI
EPSS
VEX
Title
Electron: Service worker can spoof executeJavaScript IPC replies
Summary
Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to versions 38.8.6, 39.8.1, 40.8.1, and 41.0.0, a service worker running in a session could spoof reply messages on the internal IPC channel used by webContents.executeJavaScript() and related methods, causing the main-process promise to resolve with attacker-controlled data. Apps are only affected if they have service workers registered and use the result of webContents.executeJavaScript() (or webFrameMain.executeJavaScript()) in security-sensitive decisions. This issue has been patched in versions 38.8.6, 39.8.1, 40.8.1, and 41.0.0.
Severity
5.9 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-04-06 15:50 UTC
CWE
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://github.com/electron/electron/security/adv… | x_refsource_CONFIRM |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-34778",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-04-06T15:50:39.913943Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-04-06T15:50:49.205Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "electron",
"vendor": "electron",
"versions": [
{
"status": "affected",
"version": "\u003c 38.8.6"
},
{
"status": "affected",
"version": "\u003e= 39.0.0-alpha.1, \u003c 39.8.1"
},
{
"status": "affected",
"version": "\u003e= 40.0.0-alpha.1, \u003c 40.8.1"
},
{
"status": "affected",
"version": "\u003e= 41.0.0-alpha.1, \u003c 41.0.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to versions 38.8.6, 39.8.1, 40.8.1, and 41.0.0, a service worker running in a session could spoof reply messages on the internal IPC channel used by webContents.executeJavaScript() and related methods, causing the main-process promise to resolve with attacker-controlled data. Apps are only affected if they have service workers registered and use the result of webContents.executeJavaScript() (or webFrameMain.executeJavaScript()) in security-sensitive decisions. This issue has been patched in versions 38.8.6, 39.8.1, 40.8.1, and 41.0.0."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.9,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:H/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-290",
"description": "CWE-290: Authentication Bypass by Spoofing",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-345",
"description": "CWE-345: Insufficient Verification of Data Authenticity",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-04-03T23:59:07.419Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/electron/electron/security/advisories/GHSA-xj5x-m3f3-5x3h",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/electron/electron/security/advisories/GHSA-xj5x-m3f3-5x3h"
}
],
"source": {
"advisory": "GHSA-xj5x-m3f3-5x3h",
"discovery": "UNKNOWN"
},
"title": "Electron: Service worker can spoof executeJavaScript IPC replies"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-34778",
"datePublished": "2026-04-03T23:59:07.419Z",
"dateReserved": "2026-03-30T19:54:55.555Z",
"dateUpdated": "2026-04-06T15:50:49.205Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-34777 (GCVE-0-2026-34777)
Vulnerability from cvelistv5 – Published: 2026-04-03 23:57 – Updated: 2026-04-06 15:33
VLAI
EPSS
VEX
Title
Electron: Incorrect origin passed to permission request handler for iframe requests
Summary
Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to versions 38.8.6, 39.8.1, 40.8.1, and 41.0.0, when an iframe requests fullscreen, pointerLock, keyboardLock, openExternal, or media permissions, the origin passed to session.setPermissionRequestHandler() was the top-level page's origin rather than the requesting iframe's origin. Apps that grant permissions based on the origin parameter or webContents.getURL() may inadvertently grant permissions to embedded third-party content. The correct requesting URL remains available via details.requestingUrl. Apps that already check details.requestingUrl are not affected. This issue has been patched in versions 38.8.6, 39.8.1, 40.8.1, and 41.0.0.
Severity
5.4 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-04-06 15:32 UTC
CWE
- CWE-346 - Origin Validation Error
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://github.com/electron/electron/security/adv… | x_refsource_CONFIRM |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-34777",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-04-06T15:32:48.135022Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-04-06T15:33:30.315Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "electron",
"vendor": "electron",
"versions": [
{
"status": "affected",
"version": "\u003c 38.8.6"
},
{
"status": "affected",
"version": "\u003e= 39.0.0-alpha.1, \u003c 39.8.1"
},
{
"status": "affected",
"version": "\u003e= 40.0.0-alpha.1, \u003c 40.8.1"
},
{
"status": "affected",
"version": "\u003e= 41.0.0-alpha.1, \u003c 41.0.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to versions 38.8.6, 39.8.1, 40.8.1, and 41.0.0, when an iframe requests fullscreen, pointerLock, keyboardLock, openExternal, or media permissions, the origin passed to session.setPermissionRequestHandler() was the top-level page\u0027s origin rather than the requesting iframe\u0027s origin. Apps that grant permissions based on the origin parameter or webContents.getURL() may inadvertently grant permissions to embedded third-party content. The correct requesting URL remains available via details.requestingUrl. Apps that already check details.requestingUrl are not affected. This issue has been patched in versions 38.8.6, 39.8.1, 40.8.1, and 41.0.0."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-346",
"description": "CWE-346: Origin Validation Error",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-04-03T23:57:36.488Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/electron/electron/security/advisories/GHSA-r5p7-gp4j-qhrx",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/electron/electron/security/advisories/GHSA-r5p7-gp4j-qhrx"
}
],
"source": {
"advisory": "GHSA-r5p7-gp4j-qhrx",
"discovery": "UNKNOWN"
},
"title": "Electron: Incorrect origin passed to permission request handler for iframe requests"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-34777",
"datePublished": "2026-04-03T23:57:36.488Z",
"dateReserved": "2026-03-30T19:54:55.555Z",
"dateUpdated": "2026-04-06T15:33:30.315Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-34776 (GCVE-0-2026-34776)
Vulnerability from cvelistv5 – Published: 2026-04-03 23:56 – Updated: 2026-04-06 15:31
VLAI
EPSS
VEX
Title
Electron: Out-of-bounds read in second-instance IPC on macOS and Linux
Summary
Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to versions 38.8.6, 39.8.1, 40.8.1, and 41.0.0, on macOS and Linux, apps that call app.requestSingleInstanceLock() were vulnerable to an out-of-bounds heap read when parsing a crafted second-instance message. Leaked memory could be delivered to the app's second-instance event handler. This issue is limited to processes running as the same user as the Electron app. Apps that do not call app.requestSingleInstanceLock() are not affected. Windows is not affected by this issue. This issue has been patched in versions 38.8.6, 39.8.1, 40.8.1, and 41.0.0.
Severity
5.3 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-04-06 15:31 UTC
CWE
- CWE-125 - Out-of-bounds Read
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://github.com/electron/electron/security/adv… | x_refsource_CONFIRM |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-34776",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-04-06T15:31:24.470937Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-04-06T15:31:46.052Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "electron",
"vendor": "electron",
"versions": [
{
"status": "affected",
"version": "\u003c 38.8.6"
},
{
"status": "affected",
"version": "\u003e= 39.0.0-alpha.1, \u003c 39.8.1"
},
{
"status": "affected",
"version": "\u003e= 40.0.0-alpha.1, \u003c 40.8.1"
},
{
"status": "affected",
"version": "\u003e= 41.0.0-alpha.1, \u003c 41.0.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to versions 38.8.6, 39.8.1, 40.8.1, and 41.0.0, on macOS and Linux, apps that call app.requestSingleInstanceLock() were vulnerable to an out-of-bounds heap read when parsing a crafted second-instance message. Leaked memory could be delivered to the app\u0027s second-instance event handler. This issue is limited to processes running as the same user as the Electron app. Apps that do not call app.requestSingleInstanceLock() are not affected. Windows is not affected by this issue. This issue has been patched in versions 38.8.6, 39.8.1, 40.8.1, and 41.0.0."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "LOCAL",
"availabilityImpact": "LOW",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:L",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-125",
"description": "CWE-125: Out-of-bounds Read",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-04-03T23:56:42.200Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/electron/electron/security/advisories/GHSA-3c8v-cfp5-9885",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/electron/electron/security/advisories/GHSA-3c8v-cfp5-9885"
}
],
"source": {
"advisory": "GHSA-3c8v-cfp5-9885",
"discovery": "UNKNOWN"
},
"title": "Electron: Out-of-bounds read in second-instance IPC on macOS and Linux"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-34776",
"datePublished": "2026-04-03T23:56:42.200Z",
"dateReserved": "2026-03-30T19:54:55.555Z",
"dateUpdated": "2026-04-06T15:31:46.052Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-34775 (GCVE-0-2026-34775)
Vulnerability from cvelistv5 – Published: 2026-04-03 23:55 – Updated: 2026-04-08 03:55
VLAI
EPSS
VEX
Title
Electron: nodeIntegrationInWorker not correctly scoped in shared renderer processes
Summary
Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to versions 38.8.6, 39.8.4, 40.8.4, and 41.0.0, the nodeIntegrationInWorker webPreference was not correctly scoped in all configurations. In certain process-sharing scenarios, workers spawned in frames configured with nodeIntegrationInWorker: false could still receive Node.js integration. Apps are only affected if they enable nodeIntegrationInWorker. Apps that do not use nodeIntegrationInWorker are not affected. This issue has been patched in versions 38.8.6, 39.8.4, 40.8.4, and 41.0.0.
Severity
6.8 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-04-07 00:00 UTC
CWE
- CWE-653 - Improper Isolation or Compartmentalization
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://github.com/electron/electron/security/adv… | x_refsource_CONFIRM |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-34775",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-04-07T00:00:00+00:00",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-04-08T03:55:39.764Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "electron",
"vendor": "electron",
"versions": [
{
"status": "affected",
"version": "\u003c 38.8.6"
},
{
"status": "affected",
"version": "\u003e= 39.0.0-alpha.1, \u003c 39.8.4"
},
{
"status": "affected",
"version": "\u003e= 40.0.0-alpha.1, \u003c 40.8.4"
},
{
"status": "affected",
"version": "\u003e= 41.0.0-alpha.1, \u003c 41.0.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to versions 38.8.6, 39.8.4, 40.8.4, and 41.0.0, the nodeIntegrationInWorker webPreference was not correctly scoped in all configurations. In certain process-sharing scenarios, workers spawned in frames configured with nodeIntegrationInWorker: false could still receive Node.js integration. Apps are only affected if they enable nodeIntegrationInWorker. Apps that do not use nodeIntegrationInWorker are not affected. This issue has been patched in versions 38.8.6, 39.8.4, 40.8.4, and 41.0.0."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.8,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-653",
"description": "CWE-653: Improper Isolation or Compartmentalization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-04-03T23:55:20.950Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/electron/electron/security/advisories/GHSA-xwr5-m59h-vwqr",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/electron/electron/security/advisories/GHSA-xwr5-m59h-vwqr"
}
],
"source": {
"advisory": "GHSA-xwr5-m59h-vwqr",
"discovery": "UNKNOWN"
},
"title": "Electron: nodeIntegrationInWorker not correctly scoped in shared renderer processes"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-34775",
"datePublished": "2026-04-03T23:55:20.950Z",
"dateReserved": "2026-03-30T19:54:55.555Z",
"dateUpdated": "2026-04-08T03:55:39.764Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-34774 (GCVE-0-2026-34774)
Vulnerability from cvelistv5 – Published: 2026-04-03 23:52 – Updated: 2026-07-15 01:03
VLAI
EPSS
VEX
Title
Electron: Use-after-free in offscreen child window paint callback
Summary
Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to versions 39.8.1, 40.7.0, and 41.0.0, apps that use offscreen rendering and allow child windows via window.open() may be vulnerable to a use-after-free. If the parent offscreen WebContents is destroyed while a child window remains open, subsequent paint frames on the child dereference freed memory, which may lead to a crash or memory corruption. Apps are only affected if they use offscreen rendering (webPreferences.offscreen: true) and their setWindowOpenHandler permits child windows. Apps that do not use offscreen rendering, or that deny child windows, are not affected. This issue has been patched in versions 39.8.1, 40.7.0, and 41.0.0.
Severity
8.1 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-04-07 00:00 UTC
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/electron/electron/security/adv… | x_refsource_CONFIRM |
| https://access.redhat.com/security/cve/CVE-2026-34774 | vdb-entryx_refsource_REDHAT |
| https://bugzilla.redhat.com/show_bug.cgi?id=2455026 | issue-trackingx_refsource_REDHAT |
| https://security.access.redhat.com/data/csaf/v2/v… | x_sadp-csaf-vex |
Impacted products
3 products
| Vendor | Product | Version | |
|---|---|---|---|
| electron | electron |
Affected:
< 39.8.1
Affected: >= 40.0.0-alpha.1, < 40.7.0 Affected: >= 41.0.0-alpha.1, < 41.0.0 |
|
| Red Hat | Red Hat Build of Podman Desktop |
cpe:/a:redhat:podman_desktop:1 |
|
| Red Hat | Red Hat Build of Podman Desktop - Tech Preview |
cpe:/a:redhat:podman_desktop:0 |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-34774",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-04-07T00:00:00+00:00",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-04-08T03:55:38.650Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"affected": [
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:podman_desktop:1"
],
"defaultStatus": "affected",
"packageName": "podman-desktop-macos-1-0",
"product": "Red Hat Build of Podman Desktop",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:podman_desktop:1"
],
"defaultStatus": "affected",
"packageName": "podman-desktop-windows-1-0",
"product": "Red Hat Build of Podman Desktop",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:podman_desktop:0"
],
"defaultStatus": "affected",
"packageName": "rhdesktop/rh-podman-desktop-ext-openshift-local-rhel10",
"product": "Red Hat Build of Podman Desktop - Tech Preview",
"vendor": "Red Hat"
}
],
"datePublic": "2026-04-03T23:52:38.680Z",
"descriptions": [
{
"lang": "en",
"value": "A flaw was found in Electron. This use-after-free vulnerability occurs in applications that utilize offscreen rendering and permit child windows. When the parent offscreen WebContents is destroyed while a child window remains active, subsequent rendering attempts on the child can access freed memory. This can lead to a crash or memory corruption within the application."
}
],
"metrics": [
{
"other": {
"content": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"value": "Important"
},
"type": "Red Hat severity rating"
}
},
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-825",
"description": "Expired Pointer Dereference",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-15T01:03:48.744Z",
"orgId": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
"shortName": "redhat-SADP"
},
"references": [
{
"tags": [
"vdb-entry",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/security/cve/CVE-2026-34774"
},
{
"name": "RHBZ#2455026",
"tags": [
"issue-tracking",
"x_refsource_REDHAT"
],
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2455026"
},
{
"tags": [
"x_sadp-csaf-vex"
],
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-34774.json"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-04-04T01:01:12.427Z",
"value": "Reported to Red Hat."
},
{
"lang": "en",
"time": "2026-04-03T23:52:38.680Z",
"value": "Made public."
}
],
"title": "Electron: Electron: Memory corruption and crash due to use-after-free in offscreen rendering",
"workarounds": [
{
"lang": "en",
"value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability."
}
],
"x_adpType": "supplier",
"x_generator": {
"engine": "sadp-cli 1.0.0"
}
}
],
"cna": {
"affected": [
{
"product": "electron",
"vendor": "electron",
"versions": [
{
"status": "affected",
"version": "\u003c 39.8.1"
},
{
"status": "affected",
"version": "\u003e= 40.0.0-alpha.1, \u003c 40.7.0"
},
{
"status": "affected",
"version": "\u003e= 41.0.0-alpha.1, \u003c 41.0.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to versions 39.8.1, 40.7.0, and 41.0.0, apps that use offscreen rendering and allow child windows via window.open() may be vulnerable to a use-after-free. If the parent offscreen WebContents is destroyed while a child window remains open, subsequent paint frames on the child dereference freed memory, which may lead to a crash or memory corruption. Apps are only affected if they use offscreen rendering (webPreferences.offscreen: true) and their setWindowOpenHandler permits child windows. Apps that do not use offscreen rendering, or that deny child windows, are not affected. This issue has been patched in versions 39.8.1, 40.7.0, and 41.0.0."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-416",
"description": "CWE-416: Use After Free",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-04-03T23:52:38.680Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/electron/electron/security/advisories/GHSA-532v-xpq5-8h95",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/electron/electron/security/advisories/GHSA-532v-xpq5-8h95"
}
],
"source": {
"advisory": "GHSA-532v-xpq5-8h95",
"discovery": "UNKNOWN"
},
"title": "Electron: Use-after-free in offscreen child window paint callback"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-34774",
"datePublished": "2026-04-03T23:52:38.680Z",
"dateReserved": "2026-03-30T19:54:55.555Z",
"dateUpdated": "2026-07-15T01:03:48.744Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-34773 (GCVE-0-2026-34773)
Vulnerability from cvelistv5 – Published: 2026-04-03 23:50 – Updated: 2026-04-06 16:03
VLAI
EPSS
VEX
Title
Electron: Registry key path injection in app.setAsDefaultProtocolClient on Windows
Summary
Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to versions 38.8.6, 39.8.1, 40.8.1, and 41.0.0, on Windows, app.setAsDefaultProtocolClient(protocol) did not validate the protocol name before writing to the registry. Apps that pass untrusted input as the protocol name may allow an attacker to write to arbitrary subkeys under HKCU\Software\Classes\, potentially hijacking existing protocol handlers. Apps are only affected if they call app.setAsDefaultProtocolClient() with a protocol name derived from external or untrusted input. Apps that use a hardcoded protocol name are not affected. This issue has been patched in versions 38.8.6, 39.8.1, 40.8.1, and 41.0.0.
Severity
4.7 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-04-06 16:03 UTC
CWE
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://github.com/electron/electron/security/adv… | x_refsource_CONFIRM |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-34773",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-04-06T16:03:47.836700Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-04-06T16:03:54.878Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "electron",
"vendor": "electron",
"versions": [
{
"status": "affected",
"version": "\u003c 38.8.6"
},
{
"status": "affected",
"version": "\u003e= 39.0.0-alpha.1, \u003c 39.8.1"
},
{
"status": "affected",
"version": "\u003e= 40.0.0-alpha.1, \u003c 40.8.1"
},
{
"status": "affected",
"version": "\u003e= 41.0.0-alpha.1, \u003c 41.0.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to versions 38.8.6, 39.8.1, 40.8.1, and 41.0.0, on Windows, app.setAsDefaultProtocolClient(protocol) did not validate the protocol name before writing to the registry. Apps that pass untrusted input as the protocol name may allow an attacker to write to arbitrary subkeys under HKCU\\Software\\Classes\\, potentially hijacking existing protocol handlers. Apps are only affected if they call app.setAsDefaultProtocolClient() with a protocol name derived from external or untrusted input. Apps that use a hardcoded protocol name are not affected. This issue has been patched in versions 38.8.6, 39.8.1, 40.8.1, and 41.0.0."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "LOCAL",
"availabilityImpact": "NONE",
"baseScore": 4.7,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-20",
"description": "CWE-20: Improper Input Validation",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-74",
"description": "CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component (\u0027Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-04-03T23:50:42.168Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/electron/electron/security/advisories/GHSA-mwmh-mq4g-g6gr",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/electron/electron/security/advisories/GHSA-mwmh-mq4g-g6gr"
}
],
"source": {
"advisory": "GHSA-mwmh-mq4g-g6gr",
"discovery": "UNKNOWN"
},
"title": "Electron: Registry key path injection in app.setAsDefaultProtocolClient on Windows"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-34773",
"datePublished": "2026-04-03T23:50:42.168Z",
"dateReserved": "2026-03-30T19:54:55.555Z",
"dateUpdated": "2026-04-06T16:03:54.878Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-34772 (GCVE-0-2026-34772)
Vulnerability from cvelistv5 – Published: 2026-04-03 23:49 – Updated: 2026-04-06 15:27
VLAI
EPSS
VEX
Title
Electron: Use-after-free in download save dialog callback
Summary
Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to versions 38.8.6, 39.8.0, 40.7.0, and 41.0.0-beta.8, apps that allow downloads and programmatically destroy sessions may be vulnerable to a use-after-free. If a session is torn down while a native save-file dialog is open for a download, dismissing the dialog dereferences freed memory, which may lead to a crash or memory corruption. Apps that do not destroy sessions at runtime, or that do not permit downloads, are not affected. This issue has been patched in versions 38.8.6, 39.8.0, 40.7.0, and 41.0.0-beta.8.
Severity
5.8 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-04-06 15:27 UTC
CWE
- CWE-416 - Use After Free
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://github.com/electron/electron/security/adv… | x_refsource_CONFIRM |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-34772",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-04-06T15:27:31.566763Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-04-06T15:27:44.773Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "electron",
"vendor": "electron",
"versions": [
{
"status": "affected",
"version": "\u003c 38.8.6"
},
{
"status": "affected",
"version": "\u003e= 39.0.0-alpha.1, \u003c 39.8.0"
},
{
"status": "affected",
"version": "\u003e= 40.0.0-alpha.1, \u003c 40.7.0"
},
{
"status": "affected",
"version": "\u003e= 41.0.0-alpha.1, \u003c 41.0.0-beta.8"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to versions 38.8.6, 39.8.0, 40.7.0, and 41.0.0-beta.8, apps that allow downloads and programmatically destroy sessions may be vulnerable to a use-after-free. If a session is torn down while a native save-file dialog is open for a download, dismissing the dialog dereferences freed memory, which may lead to a crash or memory corruption. Apps that do not destroy sessions at runtime, or that do not permit downloads, are not affected. This issue has been patched in versions 38.8.6, 39.8.0, 40.7.0, and 41.0.0-beta.8."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "LOCAL",
"availabilityImpact": "LOW",
"baseScore": 5.8,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:L/A:L",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-416",
"description": "CWE-416: Use After Free",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-04-03T23:49:20.467Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/electron/electron/security/advisories/GHSA-9w97-2464-8783",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/electron/electron/security/advisories/GHSA-9w97-2464-8783"
}
],
"source": {
"advisory": "GHSA-9w97-2464-8783",
"discovery": "UNKNOWN"
},
"title": "Electron: Use-after-free in download save dialog callback"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-34772",
"datePublished": "2026-04-03T23:49:20.467Z",
"dateReserved": "2026-03-30T19:54:55.555Z",
"dateUpdated": "2026-04-06T15:27:44.773Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-34771 (GCVE-0-2026-34771)
Vulnerability from cvelistv5 – Published: 2026-04-03 23:47 – Updated: 2026-07-15 01:03
VLAI
EPSS
VEX
Title
Electron: Use-after-free in WebContents fullscreen, pointer-lock, and keyboard-lock permission callbacks
Summary
Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to versions 38.8.6, 39.8.0, 40.7.0, and 41.0.0-beta.8, apps that register an asynchronous session.setPermissionRequestHandler() may be vulnerable to a use-after-free when handling fullscreen, pointer-lock, or keyboard-lock permission requests. If the requesting frame navigates or the window closes while the permission handler is pending, invoking the stored callback dereferences freed memory, which may lead to a crash or memory corruption. Apps that do not set a permission request handler, or whose handler responds synchronously, are not affected. This issue has been patched in versions 38.8.6, 39.8.0, 40.7.0, and 41.0.0-beta.8.
Severity
7.5 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-04-07 00:00 UTC
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/electron/electron/security/adv… | x_refsource_CONFIRM |
| https://access.redhat.com/security/cve/CVE-2026-34771 | vdb-entryx_refsource_REDHAT |
| https://bugzilla.redhat.com/show_bug.cgi?id=2454995 | issue-trackingx_refsource_REDHAT |
| https://security.access.redhat.com/data/csaf/v2/v… | x_sadp-csaf-vex |
Impacted products
3 products
| Vendor | Product | Version | |
|---|---|---|---|
| electron | electron |
Affected:
< 38.8.6
Affected: >= 39.0.0-alpha.1, < 39.8.0 Affected: >= 40.0.0-alpha.1, < 40.7.0 Affected: >= 41.0.0-alpha.1, < 41.0.0-beta.8 |
|
| Red Hat | Red Hat Build of Podman Desktop |
cpe:/a:redhat:podman_desktop:1 |
|
| Red Hat | Red Hat Build of Podman Desktop - Tech Preview |
cpe:/a:redhat:podman_desktop:0 |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-34771",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-04-07T00:00:00+00:00",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-04-08T03:55:37.519Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"affected": [
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:podman_desktop:1"
],
"defaultStatus": "affected",
"packageName": "podman-desktop-macos-1-0",
"product": "Red Hat Build of Podman Desktop",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:podman_desktop:1"
],
"defaultStatus": "affected",
"packageName": "podman-desktop-windows-1-0",
"product": "Red Hat Build of Podman Desktop",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:podman_desktop:0"
],
"defaultStatus": "affected",
"packageName": "rhdesktop/rh-podman-desktop-ext-openshift-local-rhel10",
"product": "Red Hat Build of Podman Desktop - Tech Preview",
"vendor": "Red Hat"
}
],
"datePublic": "2026-04-03T23:47:23.171Z",
"descriptions": [
{
"lang": "en",
"value": "A flaw was found in Electron, a framework for building desktop applications. This vulnerability, known as a use-after-free, occurs when an application registers an asynchronous permission request handler and a frame navigates or a window closes while the handler is pending. A remote attacker could exploit this by causing the application to attempt to access freed memory. This could lead to a crash of the application or memory corruption, potentially allowing for further unauthorized actions."
}
],
"metrics": [
{
"other": {
"content": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"value": "Important"
},
"type": "Red Hat severity rating"
}
},
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-364",
"description": "Signal Handler Race Condition",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-15T01:03:51.333Z",
"orgId": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
"shortName": "redhat-SADP"
},
"references": [
{
"tags": [
"vdb-entry",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/security/cve/CVE-2026-34771"
},
{
"name": "RHBZ#2454995",
"tags": [
"issue-tracking",
"x_refsource_REDHAT"
],
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2454995"
},
{
"tags": [
"x_sadp-csaf-vex"
],
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-34771.json"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-04-04T00:00:54.679Z",
"value": "Reported to Red Hat."
},
{
"lang": "en",
"time": "2026-04-03T23:47:23.171Z",
"value": "Made public."
}
],
"title": "electron: Electron: Memory corruption or application crash via use-after-free in permission request handling",
"workarounds": [
{
"lang": "en",
"value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability."
}
],
"x_adpType": "supplier",
"x_generator": {
"engine": "sadp-cli 1.0.0"
}
}
],
"cna": {
"affected": [
{
"product": "electron",
"vendor": "electron",
"versions": [
{
"status": "affected",
"version": "\u003c 38.8.6"
},
{
"status": "affected",
"version": "\u003e= 39.0.0-alpha.1, \u003c 39.8.0"
},
{
"status": "affected",
"version": "\u003e= 40.0.0-alpha.1, \u003c 40.7.0"
},
{
"status": "affected",
"version": "\u003e= 41.0.0-alpha.1, \u003c 41.0.0-beta.8"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to versions 38.8.6, 39.8.0, 40.7.0, and 41.0.0-beta.8, apps that register an asynchronous session.setPermissionRequestHandler() may be vulnerable to a use-after-free when handling fullscreen, pointer-lock, or keyboard-lock permission requests. If the requesting frame navigates or the window closes while the permission handler is pending, invoking the stored callback dereferences freed memory, which may lead to a crash or memory corruption. Apps that do not set a permission request handler, or whose handler responds synchronously, are not affected. This issue has been patched in versions 38.8.6, 39.8.0, 40.7.0, and 41.0.0-beta.8."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-416",
"description": "CWE-416: Use After Free",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-04-03T23:47:23.171Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/electron/electron/security/advisories/GHSA-8337-3p73-46f4",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/electron/electron/security/advisories/GHSA-8337-3p73-46f4"
}
],
"source": {
"advisory": "GHSA-8337-3p73-46f4",
"discovery": "UNKNOWN"
},
"title": "Electron: Use-after-free in WebContents fullscreen, pointer-lock, and keyboard-lock permission callbacks"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-34771",
"datePublished": "2026-04-03T23:47:23.171Z",
"dateReserved": "2026-03-30T19:54:55.555Z",
"dateUpdated": "2026-07-15T01:03:51.333Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}