p PatchFirst

PatchFirst · Latest vulnerabilities

electron vulnerabilities · Page 2

Vulnerabilities published for electron in the last 30 days: 14. Listed in the KEV catalogue: 0.

RSS ↗
Filter vulnerabilities
Clear filters

Vulnerabilities: 79

  1. CVE-2026-70606

    Medium · CVSS 5.9EPSS 0.26%Fix available

    Electron: ProtocolResponse.url reuses the default session cache instead of the registering session

    Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 40.10.6, 41.9.1, 42.5.1, and 43.0.0, when a custom protocol handler returned a ProtocolResponse with a url and no session, Electron made the upstream request through defaultSession instead of the session that handled the protocol. A cached response could then be reused across otherwise isolated session partitions. Apps that use ProtocolResponse.url, omit ProtocolResponse.session, and rely on separate sessions to isolate content are affected. This issue is fixed in versions 40.10.6, 41.9.1, 42.5.1, and 43.0.0.

    electron electron electron electronNode.js
    • Update to 40.10.6
    • Update to 41.9.1
    • Update to 42.5.1
    • Update to 43.0.0
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗

  2. CVE-2026-70605

    Medium · CVSS 5.9EPSS 0.32%Fix available

    Electron: HTTP redirect followed into local file loader

    Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.8, 40.9.0, 41.2.1, and 42.0.0-beta.3, when following HTTP redirects, net.fetch() and net.request() did not restrict which schemes a redirect could target. A remote server could redirect a request to a local resource, and if the app returns or forwards the response body, local file contents could be disclosed. Apps are only affected if they make net requests to attacker-influenced URLs with redirects followed and expose the response body. This issue is fixed in versions 39.8.8, 40.9.0, 41.2.1, and 42.0.0-beta.3.

    electron electron electron electronNode.js
    • Update to 39.8.8
    • Update to 40.9.1
    • Update to 41.2.1
    • Update to 42.0.0-beta.3
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗

  3. CVE-2026-70604

    High · CVSS 7.4EPSS 0.35%Fix available

    Electron: Custom protocol with supportFetchAPI but not corsEnabled allows cross-origin reads

    Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.10, 40.9.3, 41.4.0, and 42.0.0, a custom scheme registered with supportFetchAPI: true but without corsEnabled: true was not subject to CORS enforcement. A page loaded from a remote origin could therefore fetch() or XMLHttpRequest that scheme cross-origin and read the full response body, rather than the read being blocked. Apps that serve sensitive data from such a scheme and load remote or untrusted content in a renderer are affected. This issue is fixed in versions 39.8.10, 40.9.3, 41.4.0, and 42.0.0.

    electron electron electron electronNode.js
    • Update to 39.8.10
    • Update to 40.9.3
    • Update to 41.4.0
    • Update to 42.0.0
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗

  4. CVE-2026-70603

    Medium · CVSS 6EPSS 0.13%Public exploitFix available

    Electron: shell.openPath path validation bypass via embedded null byte

    Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.6, 40.9.0, 41.1.1, and 42.0.0-beta.1, shell.openPath() did not reject paths containing embedded null bytes. Apps that perform string-only validation of file paths, for example checking the file extension, before passing them to shell.openPath() could be bypassed, allowing an attacker-controlled path to open a different file than the one that passed validation. Apps are only affected if they pass paths derived from untrusted input to shell.openPath() and rely on string-based validation without a filesystem check. This issue is

    electron electron electron electronNode.js
    • Update to 39.8.6
    • Update to 40.9.0
    • Update to 41.1.1
    • Update to 42.0.0-beta.1
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗

  5. CVE-2026-70602

    Medium · CVSS 6.6EPSS 0.26%Fix available

    Electron: Extension tab APIs operate across session boundaries

    Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.8, 40.9.0, 41.2.1, and 42.0.0-beta.3, extension tab and scripting APIs were not scoped to the extension's own session. A malicious or compromised extension loaded into one session could navigate, script, and read from windows belonging to a different session. Apps are only affected if they load Chrome extensions via session.loadExtension and rely on separate sessions to isolate that extension from other content. This issue is fixed in versions 39.8.8, 40.9.0, 41.2.1, and 42.0.0-beta.3.

    electron electron electron electronNode.js
    • Update to 39.8.8
    • Update to 40.9.0
    • Update to 41.2.1
    • Update to 42.0.0-beta.3
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗

  6. CVE-2026-70601

    High · CVSS 7.5EPSS 0.29%Fix available

    Electron: Context isolation bypass via Function.prototype.bind hijack

    Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.9, 40.9.2, 41.2.2, and 42.0.0-beta.5, apps that expose Promise-returning functions to web content via contextBridge may be vulnerable to a context isolation bypass. Untrusted web content could obtain access to the isolated preload world and, through it, every capability the preload script has. In renderers without a sandbox, or with nodeIntegration enabled, this may escalate to Node.js access. Apps are affected if they expose Promise-returning functions via contextBridge, the standard pattern for wrapping ipcRenderer.invoke, i

    electron electron electron electronNode.js
    • Update to 39.8.9
    • Update to 40.9.2
    • Update to 41.2.2
    • Update to 42.0.0-beta.5
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗

  7. CVE-2026-70600

    Low · CVSS 3.1EPSS 0.18%Fix available

    Electron: Cross-origin iframe can position native autofill popup

    Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.8, 40.9.0, 41.2.1, and 42.0.0-beta.3, the native autofill popup could be positioned by a cross-origin iframe outside that iframe's bounds, over the embedding page's UI, enabling clickjacking or spoofing of trusted UI. Apps are only affected if they embed untrusted content in iframes within windows that also display trusted UI. Apps that do not embed untrusted third-party content are not affected. This issue is fixed in versions 39.8.8, 40.9.0, 41.2.1, and 42.0.0-beta.3.

    electron electron electron electronNode.js
    • Update to 39.8.8
    • Update to 40.9.1
    • Update to 41.2.1
    • Update to 42.0.0-beta.3
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗

  8. CVE-2026-70599

    Medium · CVSS 5.9EPSS 0.19%Fix available

    Electron: Permission Check Handler Receives Main Frame Origin Instead of Requesting Iframe Origin

    Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.7, 40.9.0, 41.2.0, and 42.0.0-beta.1, serial-port and media permission checks made from an iframe passed the top-level frame origin to session.setPermissionCheckHandler instead of the requesting iframe origin. Origin-based handler logic could grant a cross-origin iframe device access intended only for the top-level origin. This issue is fixed in 39.8.7, 40.9.0, 41.2.0, and 42.0.0-beta.1.

    electron electron electron electronNode.js
    • Update to 39.8.7
    • Update to 40.9.0
    • Update to 41.2.0
    • Update to 42.0.0-beta.1
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  9. CVE-2026-70598

    Low · CVSS 3.9EPSS 0.14%Fix available

    Electron: Off-screen rendering trusts GPU-supplied geometry over shared-memory size

    Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.10, 40.9.0, 41.2.1, and 42.0.0-beta.3, offscreen rendering frame data received from the GPU process was not fully validated by the main process. A compromised GPU process could cause the main process to read out-of-bounds memory while producing paint event images, disclosing memory or crashing the app. This issue is fixed in 39.8.10, 40.9.0, 41.2.1, and 42.0.0-beta.3.

    electron electron electron electronNode.js
    • Update to 39.8.10
    • Update to 40.9.0
    • Update to 41.2.1
    • Update to 42.0.0-beta.3
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  10. CVE-2026-70597

    Medium · CVSS 6.3EPSS 0.1%Fix available

    Electron: Parent process code-sign check is spoofable

    Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.8, 40.9.0, 41.2.1, and 42.0.0-beta.3, the check Electron uses on macOS to confirm it was launched by a same-signed parent process could be bypassed by a local process. Apps that enable fuse-based hardening restricting ELECTRON_RUN_AS_NODE and NODE_OPTIONS to same-signed parents rely on this check, and a local attacker could bypass it and run code inside the signed app, inheriting its TCC permissions and keychain access. This issue is fixed in 39.8.8, 40.9.0, 41.2.1, and 42.0.0-beta.3.

    electron electron electron electronNode.js
    • Update to 39.8.8
    • Update to 40.9.1
    • Update to 41.2.1
    • Update to 42.0.0-beta.3
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  11. CVE-2026-54257

    Critical · CVSS 9.3EPSS 0.43%Fix available

    Electron: Buffer performs incorrect byte length calculations resulting in heap buffer under/overflow

    Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. From 42.3.1 until 42.3.3, Buffer performs incorrect byte length calculations resulting in heap buffer under/overflow. Most apps will crash and some may perform incorrect buffer allocations in the Node.js Buffer API resulting in unexpected truncation or allocation. This vulnerability is fixed in 42.3.3.

    electronNode.js
    • Update to 42.3.3
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗

  12. CVE-2026-34781

    Low · CVSS 2.8EPSS 0.14%Fix available

    Electron crashes in clipboard.readImage() on malformed clipboard image data

    Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.5, 40.8.5, 41.1.0, and 42.0.0-alpha.5, apps that call clipboard.readImage() may be vulnerable to a denial of service. If the system clipboard contains image data that fails to decode, the resulting null bitmap is passed unchecked to image construction, triggering a controlled abort and crashing the process. Apps are only affected if they call clipboard.readImage(). Apps that do not read images from the clipboard are not affected. This issue does not allow memory corruption or code execution. This vulnerability is fixed in 39.8

    electron electron electron electronNode.js
    • Update to 39.8.5
    • Update to 40.8.5
    • Update to 41.1.0
    • Update to 42.0.0-alpha.5
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗

  13. CVE-2026-34765

    Medium · CVSS 6EPSS 0.38%Fix available

    Electron named window.open targets not scoped to the opener's browsing context

    Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.5, 40.8.5, 41.1.0, and 42.0.0-alpha.5, when a renderer calls window.open() with a target name, Electron did not correctly scope the named-window lookup to the opener's browsing context group. A renderer could navigate an existing child window that was opened by a different, unrelated renderer if both used the same target name. If that existing child was created with more permissive webPreferences (via setWindowOpenHandler's overrideBrowserWindowOptions), content loaded by the second renderer inherits those permissions. Apps ar

    electron electron electron electronNode.js
    • Update to 39.8.5
    • Update to 40.8.5
    • Update to 41.1.0
    • Update to 42.0.0-alpha.5
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗

  14. CVE-2026-34764

    Low · CVSS 2.3EPSS 0.14%Fix available

    Electron has a use-after-free in offscreen shared texture release() callback

    Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. From 33.0.0-alpha.1 to before 39.8.5, 40.8.5, 41.1.0, and 42.0.0-alpha.5, apps that use offscreen rendering with GPU shared textures may be vulnerable to a use-after-free. Under certain conditions, the release() callback provided on a paint event texture can outlive its backing native state, and invoking it after that point dereferences freed memory in the main process, which may lead to a crash or memory corruption. Apps are only affected if they use offscreen rendering with webPreferences.offscreen: { useSharedTexture: true }. Apps that d

    electron electron electron electronNode.js
    • Update to 39.8.5
    • Update to 40.8.5
    • Update to 41.1.0
    • Update to 42.0.0-alpha.5
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗

  15. CVE-2026-34780

    High · CVSS 8.4EPSS 0.45%Fix available

    Electron: Context Isolation bypass via contextBridge VideoFrame transfer

    Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. From versions 39.0.0-alpha.1 to before 39.8.0, 40.0.0-alpha.1 to before 40.7.0, and 41.0.0-alpha.1 to before 41.0.0-beta.8, apps that pass VideoFrame objects (from the WebCodecs API) across the contextBridge are vulnerable to a context isolation bypass. An attacker who can execute JavaScript in the main world (for example, via XSS) can use a bridged VideoFrame to gain access to the isolated world, including any Node.js APIs exposed to the preload script. Apps are only affected if a preload script returns, resolves, or passes a VideoFrame ob

    electron electron electronNode.js
    • Update to 39.8.0
    • Update to 40.7.0
    • Update to 41.0.0-beta.8
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  16. CVE-2026-34779

    Medium · CVSS 6.5EPSS 0.18%Fix available

    Electron: AppleScript injection in app.moveToApplicationsFolder on macOS

    Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to versions 38.8.6, 39.8.1, 40.8.0, and 41.0.0-beta.8, on macOS, app.moveToApplicationsFolder() used an AppleScript fallback path that did not properly handle certain characters in the application bundle path. Under specific conditions, a crafted launch path could lead to arbitrary AppleScript execution when the user accepted the move-to-Applications prompt. Apps are only affected if they call app.moveToApplicationsFolder(). Apps that do not use this API are not affected. This issue has been patched in versions 38.8.6, 39.8.1, 40.8.0,

    electron electron electron electronNode.js
    • Update to 38.8.6
    • Update to 39.8.1
    • Update to 40.8.0
    • Update to 41.0.0-beta.8
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗

  17. CVE-2026-34778

    Medium · CVSS 5.9EPSS 0.14%Fix available

    Electron: Service worker can spoof executeJavaScript IPC replies

    Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to versions 38.8.6, 39.8.1, 40.8.1, and 41.0.0, a service worker running in a session could spoof reply messages on the internal IPC channel used by webContents.executeJavaScript() and related methods, causing the main-process promise to resolve with attacker-controlled data. Apps are only affected if they have service workers registered and use the result of webContents.executeJavaScript() (or webFrameMain.executeJavaScript()) in security-sensitive decisions. This issue has been patched in versions 38.8.6, 39.8.1, 40.8.1, and 41.0.0.

    electron electron electron electronNode.js
    • Update to 38.8.6
    • Update to 39.8.1
    • Update to 40.8.1
    • Update to 41.0.0
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗

  18. CVE-2026-34777

    Medium · CVSS 5.4EPSS 0.13%Fix available

    Electron: Incorrect origin passed to permission request handler for iframe requests

    Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to versions 38.8.6, 39.8.1, 40.8.1, and 41.0.0, when an iframe requests fullscreen, pointerLock, keyboardLock, openExternal, or media permissions, the origin passed to session.setPermissionRequestHandler() was the top-level page's origin rather than the requesting iframe's origin. Apps that grant permissions based on the origin parameter or webContents.getURL() may inadvertently grant permissions to embedded third-party content. The correct requesting URL remains available via details.requestingUrl. Apps that already check details.req

    electron electron electron electronNode.js
    • Update to 38.8.6
    • Update to 39.8.1
    • Update to 40.8.1
    • Update to 41.0.0
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗

  19. CVE-2026-34776

    Medium · CVSS 5.3EPSS 0.23%Fix available

    Electron: Out-of-bounds read in second-instance IPC on macOS and Linux

    Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to versions 38.8.6, 39.8.1, 40.8.1, and 41.0.0, on macOS and Linux, apps that call app.requestSingleInstanceLock() were vulnerable to an out-of-bounds heap read when parsing a crafted second-instance message. Leaked memory could be delivered to the app's second-instance event handler. This issue is limited to processes running as the same user as the Electron app. Apps that do not call app.requestSingleInstanceLock() are not affected. Windows is not affected by this issue. This issue has been patched in versions 38.8.6, 39.8.1, 40.8.1

    electron electron electron electronNode.js
    • Update to 38.8.6
    • Update to 39.8.1
    • Update to 40.8.1
    • Update to 41.0.0
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗

  20. CVE-2026-34775

    Medium · CVSS 6.8EPSS 0.37%Fix available

    Electron: nodeIntegrationInWorker not correctly scoped in shared renderer processes

    Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to versions 38.8.6, 39.8.4, 40.8.4, and 41.0.0, the nodeIntegrationInWorker webPreference was not correctly scoped in all configurations. In certain process-sharing scenarios, workers spawned in frames configured with nodeIntegrationInWorker: false could still receive Node.js integration. Apps are only affected if they enable nodeIntegrationInWorker. Apps that do not use nodeIntegrationInWorker are not affected. This issue has been patched in versions 38.8.6, 39.8.4, 40.8.4, and 41.0.0.

    electron electron electron electronNode.js
    • Update to 38.8.6
    • Update to 39.8.4
    • Update to 40.8.4
    • Update to 41.0.0
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗

Check your server

Check your installed stack and versions against the current vulnerability feeds.

Check your server →