Vulnerability-Lookup

FKIE_CVE-2026-34780

Vulnerability from fkie_nvd - Published: 2026-04-04 01:16 - Updated: 2026-04-14 19:02

Severity ?

8.3 (High) - CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H
6.1 (Medium) - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Summary

Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. From versions 39.0.0-alpha.1 to before 39.8.0, 40.0.0-alpha.1 to before 40.7.0, and 41.0.0-alpha.1 to before 41.0.0-beta.8, apps that pass VideoFrame objects (from the WebCodecs API) across the contextBridge are vulnerable to a context isolation bypass. An attacker who can execute JavaScript in the main world (for example, via XSS) can use a bridged VideoFrame to gain access to the isolated world, including any Node.js APIs exposed to the preload script. Apps are only affected if a preload script returns, resolves, or passes a VideoFrame object to the main world via contextBridge.exposeInMainWorld(). Apps that do not bridge VideoFrame objects are not affected. This issue has been patched in versions 39.8.0, 40.7.0, and 41.0.0-beta.8.

References

	URL	Tags
	security-advisories@github.com	https://github.com/electron/electron/security/advisories/GHSA-jfqg-hf23-qpw2	Vendor Advisory

Impacted products

Vendor	Product	Version
electronjs	electron	*
electronjs	electron	*
electronjs	electron	41.0.0
electronjs	electron	41.0.0
electronjs	electron	41.0.0
electronjs	electron	41.0.0
electronjs	electron	41.0.0
electronjs	electron	41.0.0
electronjs	electron	41.0.0
electronjs	electron	41.0.0
electronjs	electron	41.0.0
electronjs	electron	41.0.0
electronjs	electron	41.0.0
electronjs	electron	41.0.0
electronjs	electron	41.0.0

JSON

To clipboard

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:electronjs:electron:*:*:*:*:*:node.js:*:*",
              "matchCriteriaId": "642CA6B2-000A-480D-B062-80593D150787",
              "versionEndExcluding": "39.8.0",
              "versionStartIncluding": "39.0.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:electronjs:electron:*:*:*:*:*:node.js:*:*",
              "matchCriteriaId": "E54036E0-1D1F-4265-A2F3-B9C1F88F65ED",
              "versionEndExcluding": "40.7.0",
              "versionStartIncluding": "40.0.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:electronjs:electron:41.0.0:alpha1:*:*:*:node.js:*:*",
              "matchCriteriaId": "A20225D6-F435-4D09-962D-B162F521B6AD",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:electronjs:electron:41.0.0:alpha2:*:*:*:node.js:*:*",
              "matchCriteriaId": "33712802-EB60-4E9A-83B8-9F2320B70CB4",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:electronjs:electron:41.0.0:alpha3:*:*:*:node.js:*:*",
              "matchCriteriaId": "9D0A9142-54FE-47BB-9FEB-5E97528E28FE",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:electronjs:electron:41.0.0:alpha4:*:*:*:node.js:*:*",
              "matchCriteriaId": "9E1D191F-DEAE-4DB3-9822-F31AF9FE3BAC",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:electronjs:electron:41.0.0:alpha5:*:*:*:node.js:*:*",
              "matchCriteriaId": "45A8192F-3D2C-4987-9BBE-7ECC3F71965D",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:electronjs:electron:41.0.0:alpha6:*:*:*:node.js:*:*",
              "matchCriteriaId": "EEA1A2E5-03DB-46CB-8427-7F31A8A7CE1C",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:electronjs:electron:41.0.0:beta1:*:*:*:node.js:*:*",
              "matchCriteriaId": "B2DFCE75-BD3F-4537-B5B8-14097E262EA2",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:electronjs:electron:41.0.0:beta2:*:*:*:node.js:*:*",
              "matchCriteriaId": "BC346E25-EA43-4615-8CDB-16D15D46E4FF",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:electronjs:electron:41.0.0:beta3:*:*:*:node.js:*:*",
              "matchCriteriaId": "FA5B3C00-CAFC-4995-BF35-9920F3039E77",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:electronjs:electron:41.0.0:beta4:*:*:*:node.js:*:*",
              "matchCriteriaId": "3672F3FB-6B5E-40FD-8A92-CB4DD6BC6A93",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:electronjs:electron:41.0.0:beta5:*:*:*:node.js:*:*",
              "matchCriteriaId": "9EE4F8AE-21D2-4815-85B7-B7ECCC0D5059",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:electronjs:electron:41.0.0:beta6:*:*:*:node.js:*:*",
              "matchCriteriaId": "D195760C-7DD9-4259-9042-EDE65AEAC1D6",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:electronjs:electron:41.0.0:beta7:*:*:*:node.js:*:*",
              "matchCriteriaId": "B370859F-24D3-4B25-B580-1A5B6DB94BFE",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. From versions 39.0.0-alpha.1 to before 39.8.0, 40.0.0-alpha.1 to before 40.7.0, and 41.0.0-alpha.1 to before 41.0.0-beta.8, apps that pass VideoFrame objects (from the WebCodecs API) across the contextBridge are vulnerable to a context isolation bypass. An attacker who can execute JavaScript in the main world (for example, via XSS) can use a bridged VideoFrame to gain access to the isolated world, including any Node.js APIs exposed to the preload script. Apps are only affected if a preload script returns, resolves, or passes a VideoFrame object to the main world via contextBridge.exposeInMainWorld(). Apps that do not bridge VideoFrame objects are not affected. This issue has been patched in versions 39.8.0, 40.7.0, and 41.0.0-beta.8."
    }
  ],
  "id": "CVE-2026-34780",
  "lastModified": "2026-04-14T19:02:23.427",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "HIGH",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 8.3,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "scope": "CHANGED",
          "userInteraction": "REQUIRED",
          "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 1.6,
        "impactScore": 6.0,
        "source": "security-advisories@github.com",
        "type": "Secondary"
      },
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 6.1,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "LOW",
          "integrityImpact": "LOW",
          "privilegesRequired": "NONE",
          "scope": "CHANGED",
          "userInteraction": "REQUIRED",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 2.7,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ]
  },
  "published": "2026-04-04T01:16:39.540",
  "references": [
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://github.com/electron/electron/security/advisories/GHSA-jfqg-hf23-qpw2"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-668"
        },
        {
          "lang": "en",
          "value": "CWE-1188"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Primary"
    }
  ]
}

CVE-2026-34780 (GCVE-0-2026-34780)

Vulnerability from cvelistv5 – Published: 2026-04-04 00:02 – Updated: 2026-04-08 03:55

Title

Electron: Context Isolation bypass via contextBridge VideoFrame transfer

Summary

Severity ?

8.4 (High)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

CWE

CWE-668 - Exposure of Resource to Wrong Sphere
CWE-1188 - Insecure Default Initialization of Resource

Assigner

GitHub_M

References

URL

Tags

https://github.com/electron/electron/security/adv…

x_refsource_CONFIRM

Impacted products

	Vendor	Product	Version
	electron	electron	Affected: >= 39.0.0-alpha.1, < 39.8.0 Affected: >= 40.0.0-alpha.1, < 40.7.0 Affected: >= 41.0.0-alpha.1, < 41.0.0-beta.8

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-34780",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-04-07T00:00:00+00:00",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-04-08T03:55:42.004Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "electron",
          "vendor": "electron",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 39.0.0-alpha.1, \u003c 39.8.0"
            },
            {
              "status": "affected",
              "version": "\u003e= 40.0.0-alpha.1, \u003c 40.7.0"
            },
            {
              "status": "affected",
              "version": "\u003e= 41.0.0-alpha.1, \u003c 41.0.0-beta.8"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. From versions 39.0.0-alpha.1 to before 39.8.0, 40.0.0-alpha.1 to before 40.7.0, and 41.0.0-alpha.1 to before 41.0.0-beta.8, apps that pass VideoFrame objects (from the WebCodecs API) across the contextBridge are vulnerable to a context isolation bypass. An attacker who can execute JavaScript in the main world (for example, via XSS) can use a bridged VideoFrame to gain access to the isolated world, including any Node.js APIs exposed to the preload script. Apps are only affected if a preload script returns, resolves, or passes a VideoFrame object to the main world via contextBridge.exposeInMainWorld(). Apps that do not bridge VideoFrame objects are not affected. This issue has been patched in versions 39.8.0, 40.7.0, and 41.0.0-beta.8."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.4,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-668",
              "description": "CWE-668: Exposure of Resource to Wrong Sphere",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-1188",
              "description": "CWE-1188: Insecure Default Initialization of Resource",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-04-04T00:02:02.224Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/electron/electron/security/advisories/GHSA-jfqg-hf23-qpw2",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/electron/electron/security/advisories/GHSA-jfqg-hf23-qpw2"
        }
      ],
      "source": {
        "advisory": "GHSA-jfqg-hf23-qpw2",
        "discovery": "UNKNOWN"
      },
      "title": "Electron: Context Isolation bypass via contextBridge VideoFrame transfer"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-34780",
    "datePublished": "2026-04-04T00:02:02.224Z",
    "dateReserved": "2026-03-30T19:54:55.556Z",
    "dateUpdated": "2026-04-08T03:55:42.004Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

FKIE_CVE-2026-34780

CVE-2026-34780 (GCVE-0-2026-34780)

Tags

Sightings

Nomenclature