p PatchFirst

PatchFirst · Aktuelle Sicherheitslücken

Sicherheitslücken in electron

In den letzten 30 Tagen veröffentlichte Sicherheitslücken für electron: 14. Davon im KEV-Katalog: 0.

RSS ↗
Sicherheitslücken filtern
Filter zurücksetzen

Sicherheitslücken: 79

  1. CVE-2026-115570

    Hoch · CVSS 7.4Korrektur verfügbar

    Electron: Mitigation for compromised eMudhra intermediate certificates

    Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 42.11.16, 43.8.1, 44.9.1, and 45.0.0-beta.6, Electron does not block compromised eMudhra intermediate certificates in Chromium networking, Node.js tls, Node.js https, or Node.js fetch. An attacker who holds a certificate issued through one of these intermediates and can intercept network traffic can impersonate a TLS server to an affected application. This issue is fixed in versions 42.11.16, 43.8.1, 44.9.1, and 45.0.0-beta.6.

    electron electron electron electronNode.js
    • Auf 42.11.16 aktualisieren
    • Auf 43.8.1 aktualisieren
    • Auf 44.9.1 aktualisieren
    • Auf 45.0.0-beta.6 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

  2. CVE-2026-114124

    Niedrig · CVSS 3.9EPSS 0,15%Korrektur verfügbar

    Electron: Off-screen rendering on macOS trusts GPU-supplied frame geometry

    Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to versions 42.11.6, 43.7.3, 44.4.3, and 45.0.0-alpha.9, frame data received from the GPU process for macOS offscreen rendering was not fully validated by the main process. An attacker who had separately gained code execution in the GPU process could provide inconsistent frame geometry and cause the main process to read out-of-bounds memory while producing paint event images, disclosing memory or crashing the application. This issue is fixed in versions 42.11.6, 43.7.3, 44.4.3, and 45.0.0-alpha.9.

    electron electron electron electronNode.js
    • Auf 42.11.6 aktualisieren
    • Auf 43.7.3 aktualisieren
    • Auf 44.4.3 aktualisieren
    • Auf 45.0.0-alpha.9 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

  3. CVE-2026-114122

    Niedrig · CVSS 3.9EPSS 0,14%Korrektur verfügbar

    Electron: Frame subscription trusts GPU-supplied frame geometry

    Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to versions 42.11.6, 43.7.3, 44.4.3, and 45.0.0-alpha.9, frame data received from the GPU process for webContents.beginFrameSubscription was not fully validated by the main process. An attacker who had separately gained code execution in the GPU process could supply inconsistent frame geometry and cause the main process to read out-of-bounds memory while producing captured frame images, disclosing memory or crashing the application. This issue is fixed in versions 42.11.6, 43.7.3, 44.4.3, and 45.0.0-alpha.9.

    electron electron electron electronNode.js
    • Auf 42.11.6 aktualisieren
    • Auf 43.7.3 aktualisieren
    • Auf 44.4.3 aktualisieren
    • Auf 45.0.0-alpha.9 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

  4. CVE-2026-114121

    Mittel · CVSS 5.4EPSS 0,18%Korrektur verfügbar

    Electron: openExternal permission requests can be attributed to the wrong origin

    Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to versions 42.11.3, 43.7.0, 44.3.0, and 45.0.0-alpha.5, requests to open external protocol URLs could be attributed to a document other than the one that initiated them, causing the requestingUrl passed to session.setPermissionRequestHandler to identify trusted content for a launch requested by untrusted content. An application that grants openExternal based on the requesting origin and allows untrusted content to open or navigate windows could therefore allow that content to launch an OS-registered external application. This issue i

    electron electron electron electronNode.js
    • Auf 42.11.3 aktualisieren
    • Auf 43.7.0 aktualisieren
    • Auf 44.3.0 aktualisieren
    • Auf 45.0.0-alpha.5 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

  5. CVE-2026-113800

    Mittel · CVSS 5.4EPSS 0,24%Korrektur verfügbar

    Electron: HID and USB permission checks can be attributed to the wrong origin

    Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to versions 42.11.3, 43.7.0, 44.3.0, and 45.0.0-alpha.5, hid and usb permission checks made from an iframe caused setPermissionCheckHandler to receive the top-level frame's origin and details instead of the requesting frame's. An application that delegated hid or usb to a cross-origin untrusted iframe and allowed device access with origin-based logic could therefore grant that embedded frame access intended for the top-level page. This issue is fixed in versions 42.11.3, 43.7.0, 44.3.0, and 45.0.0-alpha.5.

    electron electron electron electronNode.js
    • Auf 42.11.3 aktualisieren
    • Auf 43.7.0 aktualisieren
    • Auf 44.3.0 aktualisieren
    • Auf 45.0.0-alpha.5 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

  6. CVE-2026-113798

    Mittel · CVSS 5.4EPSS 0,21%Korrektur verfügbar

    Electron: Pointer lock permission requests can be attributed to the wrong frame

    Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to versions 42.11.9, 43.7.6, 44.5.0, and 45.0.0-alpha.13, pointerLock permission requests from some cross-origin iframes caused session.setPermissionRequestHandler() to receive the top-level frame's requestingUrl and isMainFrame values instead of those of the requesting frame. An application that embeds untrusted iframe content and grants pointer lock based on the requesting origin could therefore grant the permission under the top-level page's identity. Applications that deny pointerLock for untrusted embedded content are not affecte

    electron electron electron electronNode.js
    • Auf 42.11.9 aktualisieren
    • Auf 43.7.6 aktualisieren
    • Auf 44.5.0 aktualisieren
    • Auf 45.0.0-alpha.13 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

  7. CVE-2026-113797

    Niedrig · CVSS 3.1EPSS 0,49%Korrektur verfügbar

    Electron: Extension tabs.query returns tab URLs and titles without the tabs permission

    Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to versions 42.11.1, 43.5.1, 44.1.1, and 45.0.0-alpha.4, chrome.tabs.query() returned each tab's url and title to extensions that had neither the tabs permission nor matching host permissions. An application that loaded an extension it did not fully trust through session.extensions.loadExtension could therefore allow that extension to read the URL and title of every webContents in its session. This issue is fixed in versions 42.11.1, 43.5.1, 44.1.1, and 45.0.0-alpha.4.

    electron electron electron electronNode.js
    • Auf 42.11.1 aktualisieren
    • Auf 43.5.1 aktualisieren
    • Auf 44.1.1 aktualisieren
    • Auf 45.0.0-alpha.4 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

  8. CVE-2026-113796

    Mittel · CVSS 4.2EPSS 0,18%Korrektur verfügbar

    Electron: SameSite cookie restrictions are not applied to windows opened from links

    Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to versions 42.11.3, 43.7.0, 44.3.0, and 45.0.0-alpha.6, Electron treated pages opened into a new window from links as application-initiated navigations instead of preserving the page containing the link as the initiator. The resulting top-level request could be classified as same-site, causing SameSite=Strict cookies to be sent and Sec-Fetch-Site not to identify the initiating page. An application that loads untrusted content and permits it to open new windows could therefore allow that content to make a credentialed request to anoth

    electron electron electron electronNode.js
    • Auf 42.11.3 aktualisieren
    • Auf 43.7.0 aktualisieren
    • Auf 44.3.0 aktualisieren
    • Auf 45.0.0-alpha.6 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

  9. CVE-2026-102672

    Mittel · CVSS 6.7EPSS 0,11%Korrektur verfügbar

    Electron: Local race condition in Squirrel.Mac update installation on macOS

    Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.10, 41.10.5, and 42.0.0-beta.2, Electron applications on macOS that use Squirrel.Mac-based automatic updates are vulnerable to a local race in the privileged ShipIt helper. The helper did not bind the validated update target to one canonical application-bundle path for the full installation, allowing a local attacker to redirect the root-level write so that it overwrites another application's files instead of the application that initiated the update. Applications on other platforms and macOS applications that do not use Squir

    electron electron electronNode.js
    • Auf 39.8.10 aktualisieren
    • Auf 41.10.5 aktualisieren
    • Auf 42.0.0-beta.2 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

  10. CVE-2026-102677

    Hoch · CVSS 7.8EPSS 0,1%Korrektur verfügbar

    Electron: Sandboxed preload code cache can be poisoned by a compromised renderer

    Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. From 42.3.3 until 42.10.0, 43.5.0, and 44.0.0-beta.6, Electron's sandboxed preload code cache did not verify that a cached entry matched the preload it was served for. A compromised renderer could write attacker-controlled cache data and cause Electron to reuse it for a later load, executing the renderer's code in the more privileged preload context. The issue affects applications that load untrusted content. This issue is fixed in versions 42.10.0, 43.5.0, and 44.0.0-beta.6.

    electron electron electronNode.js
    • Auf 42.10.0 aktualisieren
    • Auf 43.5.0 aktualisieren
    • Auf 44.0.0-beta.6 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

  11. CVE-2026-102676

    Hoch · CVSS 8.3EPSS 0,48%Korrektur verfügbar

    Electron: <webview> can enable Node.js integration in Web Workers despite embedder restrictions

    Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 41.10.6, 42.9.2, 43.4.1, and 44.0.0-beta.5, an Electron <webview> guest could enable nodeIntegrationInWorker for its Web Workers even when the unsandboxed embedder had Node.js integration disabled, allowing untrusted guest content to create a Node-enabled worker with more privilege than the embedder granted. Applications that do not enable the <webview> tag or that keep the embedder sandboxed are not affected. This issue is fixed in versions 41.10.6, 42.9.2, 43.4.1, and 44.0.0-beta.5.

    electron electron electron electronNode.js
    • Auf 41.10.6 aktualisieren
    • Auf 42.9.2 aktualisieren
    • Auf 43.4.1 aktualisieren
    • Auf 44.0.0-beta.5 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

  12. CVE-2026-102675

    Hoch · CVSS 7.4EPSS 0,21%Korrektur verfügbar

    Electron: File and HTTP protocol handlers allow cross-origin reads without corsEnabled

    Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 41.10.6, 42.9.2, 43.4.1, and 44.0.0-beta.5, responses served through protocol.registerFileProtocol or protocol.registerHttpProtocol for a custom scheme registered with supportFetchAPI enabled but corsEnabled disabled could remain script-readable across origins. This residual issue completes the remediation for CVE-2026-70604. Applications are affected only when they expose such a scheme and load untrusted content in the same session. Schemes intentionally registered with corsEnabled enabled remain cross-origin readable by design. T

    electron electron electron electronNode.js
    • Auf 41.10.6 aktualisieren
    • Auf 42.9.2 aktualisieren
    • Auf 43.4.1 aktualisieren
    • Auf 44.0.0-beta.5 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

  13. CVE-2026-102674

    Hoch · CVSS 8.2EPSS 0,24%Korrektur verfügbar

    Electron: Windows opened from a sandboxed top-level document do not inherit its sandbox restrictions

    Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 41.10.6, 42.9.2, 43.4.1, and 44.0.0-beta.5, windows opened from a sandboxed top-level document did not inherit that document's active HTML sandbox restrictions. Untrusted content in a sandboxed top-level document that was permitted to open popups could therefore create a window with the Electron application's full origin instead of the restricted origin intended by the sandbox. Applications that deny such popups with setWindowOpenHandler are not affected. This issue is fixed in versions 41.10.6, 42.9.2, 43.4.1, and 44.0.0-beta.5.

    electron electron electron electronNode.js
    • Auf 41.10.6 aktualisieren
    • Auf 42.9.2 aktualisieren
    • Auf 43.4.1 aktualisieren
    • Auf 44.0.0-beta.5 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

  14. CVE-2026-102673

    Hoch · CVSS 8.2EPSS 0,13%Korrektur verfügbar

    Electron drops inherited HTML sandbox restrictions for popups opened through OpenURLFromTab

    Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 41.10.4, 42.5.2, and 43.0.0, popups opened from a sandboxed iframe through Electron's OpenURLFromTab navigation path, including links using target="_blank" or a middle-click, did not receive the inherited HTML sandbox restrictions. An untrusted iframe using the allow-scripts allow-popups configuration could therefore open a popup with the embedding application's full origin, exposing that origin's cookies, storage, and same-origin scripting capabilities. Applications that do not embed untrusted content in sandboxed iframes are not

    electron electron electronNode.js
    • Auf 41.10.4 aktualisieren
    • Auf 42.5.2 aktualisieren
    • Auf 43.0.0 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

  15. CVE-2026-70612

    Mittel · CVSS 5.4EPSS 0,43%Korrektur verfügbar

    Electron: Sandboxed iframes can launch external protocol handlers

    Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.8, 40.9.0, 41.2.1, and 42.0.0-beta.3, requests to open external protocol URLs from web content did not take iframe sandbox restrictions into account, so a sandboxed iframe could cause an OS-registered external application to be launched. The frame sandbox state was also not made available to the app permission handlers, affecting apps that render untrusted content in sandboxed iframes and grant the openExternal permission by default when no setPermissionRequestHandler is installed. This issue is fixed in 39.8.8, 40.9.0, 41.2.1

    electron electron electron electronNode.js
    • Auf 39.8.8 aktualisieren
    • Auf 40.9.0 aktualisieren
    • Auf 41.2.1 aktualisieren
    • Auf 42.0.0-beta.3 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

  16. CVE-2026-70611

    Mittel · CVSS 6.9EPSS 0,19%Korrektur verfügbar

    Electron: DevTools embedder handler executes arbitrary files via shell open

    Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.9, 40.9.2, 41.2.1, and 42.0.0-beta.3, the DevTools reveal in file manager action could launch the target file rather than reveal it. An attacker with a separate means of running script inside the DevTools frontend, such as a malicious DevTools extension, could use showItemInFolder handling to execute native code outside the sandbox when DevTools is opened for windows exposed to untrusted content or untrusted DevTools extensions. This issue is fixed in 39.8.9, 40.9.2, 41.2.1, and 42.0.0-beta.3.

    electron electron electron electronNode.js
    • Auf 39.8.9 aktualisieren
    • Auf 40.9.2 aktualisieren
    • Auf 41.2.1 aktualisieren
    • Auf 42.0.0-beta.3 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

  17. CVE-2026-70610

    Mittel · CVSS 5.4EPSS 0,56%Korrektur verfügbar

    Electron: contextBridge object copy honors prototype setters

    Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.9, 40.9.2, 41.2.2, and 42.0.0-beta.4, objects copied across the contextBridge boundary from untrusted content could carry an attacker-influenced prototype, enabling prototype-pollution-style attacks against preload code despite context isolation being enabled. Apps are only affected if their preload code accepts object arguments from untrusted content and reads properties from them without own-property checks, while apps that only accept primitive arguments or validate object arguments are not affected. This issue is fixed in

    electron electron electron electronNode.js
    • Auf 39.8.9 aktualisieren
    • Auf 40.9.2 aktualisieren
    • Auf 41.2.2 aktualisieren
    • Auf 42.0.0-beta.4 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

  18. CVE-2026-70609

    Mittel · CVSS 5.7EPSS 0,53%Korrektur verfügbar

    Electron: DevTools JavaScript Injection via Unsanitized Dock State Parameter

    Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.7, 40.9.0, 41.2.0, and 42.0.0-beta.1, the mode option of webContents.openDevTools() was not sanitized before use by the DevTools frontend. If an attacker can influence this value, script under their control may run in the DevTools context, which in unsandboxed configurations has access to Node.js, including when untrusted input reaches the mode argument of openDevTools() or untrusted content calls openDevTools() on a webview it embeds. This issue is fixed in 39.8.7, 40.9.0, 41.2.0, and 42.0.0-beta.1.

    electron electron electron electronNode.js
    • Auf 39.8.7 aktualisieren
    • Auf 40.9.0 aktualisieren
    • Auf 41.2.0 aktualisieren
    • Auf 42.0.0-beta.1 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

  19. CVE-2026-70608

    Hoch · CVSS 7.2EPSS 0,43%Korrektur verfügbar

    Electron: Sandboxed iframe can bypass the allow-popups restriction via the OpenURL navigation path

    Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.10, 41.10.3, and 42.0.1, a sandboxed iframe without the allow-popups keyword could still open a new window or trigger setWindowOpenHandler with no user interaction because new-window navigations taking the OpenURL path did not apply the iframe sandbox popup restriction. Apps that embed untrusted content in sandboxed iframes and rely on the absence of allow-popups to prevent window creation are affected, while apps that deny window creation in setWindowOpenHandler or do not embed untrusted content in sandboxed iframes are not a

    electron electron electronNode.js
    • Auf 39.8.10 aktualisieren
    • Auf 41.10.3 aktualisieren
    • Auf 42.0.1 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

  20. CVE-2026-70607

    Mittel · CVSS 5.3EPSS 0,56%Korrektur verfügbar

    Electron: window.open features string controls some window options considered privileged

    Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.8, 40.9.0, 41.2.1, and 42.0.0-beta.3, some window options supplied by web content in the window.open() features string were applied to the new BrowserWindow without an allowlist. Untrusted content could set window options it should not control, including options that cause the main process to access attacker-chosen file or network paths, when untrusted content can call window.open() and the app does not override child window options via setWindowOpenHandler or overrideBrowserWindowOptions. This issue is fixed in 39.8.8, 40.9.0

    electron electron electron electronNode.js
    • Auf 39.8.8 aktualisieren
    • Auf 40.9.0 aktualisieren
    • Auf 41.2.1 aktualisieren
    • Auf 42.0.0-beta.3 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

Prüfen Sie Ihren Server

Gleichen Sie Ihren installierten Stack und seine Versionen mit den aktuellen Sicherheitsmeldungen ab.

Prüfen Sie Ihren Server →