electronjs electron vulnerabilities

Latest electronjs electron CVEs

Newest publication first · page 1 of 3

1. CVE-2026-102677 Electron: Sandboxed preload code cache can be poisoned by a compromised renderer

   Published 2026-09-29

   High·CVSS 8.8 EPSS 0.10%

   Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. From 42.3.3 until 42.10.0, 43.5.0, and 44.0.0-beta.6, Electron's sandboxed preload code cache did not verify that a cached entry matched the preload it was served for. A compro...

2. CVE-2026-102676 Electron: <webview> can enable Node.js integration in Web Workers despite embedder restrictions

   Published 2026-09-29

   Critical·CVSS 9.8 EPSS 0.48%

   Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 41.10.6, 42.9.2, 43.4.1, and 44.0.0-beta.5, an Electron <webview> guest could enable nodeIntegrationInWorker for its Web Workers even when the unsandboxed embedder had...

3. CVE-2026-102675 Electron: File and HTTP protocol handlers allow cross-origin reads without corsEnabled

   Published 2026-09-29

   High·CVSS 7.4 EPSS 0.21%

   Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 41.10.6, 42.9.2, 43.4.1, and 44.0.0-beta.5, responses served through protocol.registerFileProtocol or protocol.registerHttpProtocol for a custom scheme registered with...

4. CVE-2026-102674 Electron: Windows opened from a sandboxed top-level document do not inherit its sandbox restrictions

   Published 2026-09-29

   Medium·CVSS 6.1 EPSS 0.24%

   Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 41.10.6, 42.9.2, 43.4.1, and 44.0.0-beta.5, windows opened from a sandboxed top-level document did not inherit that document's active HTML sandbox restrictions. Untrus...

5. CVE-2026-102673 Electron drops inherited HTML sandbox restrictions for popups opened through OpenURLFromTab

   Published 2026-09-29

   Medium·CVSS 6.1 EPSS 0.13%

   Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 41.10.4, 42.5.2, and 43.0.0, popups opened from a sandboxed iframe through Electron's OpenURLFromTab navigation path, including links using target="_blank" or a middle...

6. CVE-2026-70612 Electron: Sandboxed iframes can launch external protocol handlers

   Published 2026-08-05

   Medium·CVSS 5.4 EPSS 0.43%

   Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.8, 40.9.0, 41.2.1, and 42.0.0-beta.3, requests to open external protocol URLs from web content did not take iframe sandbox restrictions into account, so a sandbox...

7. CVE-2026-70611 Electron: DevTools embedder handler executes arbitrary files via shell open

   Published 2026-08-05

   Medium·CVSS 6.9 EPSS 0.19%

   Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.9, 40.9.2, 41.2.1, and 42.0.0-beta.3, the DevTools reveal in file manager action could launch the target file rather than reveal it. An attacker with a separate m...

8. CVE-2026-70610 Electron: contextBridge object copy honors prototype setters

   Published 2026-08-05

   Medium·CVSS 5.4 EPSS 0.56%

   Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.9, 40.9.2, 41.2.2, and 42.0.0-beta.4, objects copied across the contextBridge boundary from untrusted content could carry an attacker-influenced prototype, enabli...

9. CVE-2026-70609 Electron: DevTools JavaScript Injection via Unsanitized Dock State Parameter

   Published 2026-08-05

   Medium·CVSS 5.7 EPSS 0.53%

   Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.7, 40.9.0, 41.2.0, and 42.0.0-beta.1, the mode option of webContents.openDevTools() was not sanitized before use by the DevTools frontend. If an attacker can infl...

10. CVE-2026-70608 Electron: Sandboxed iframe can bypass the allow-popups restriction via the OpenURL navigation path

    Published 2026-08-05

    High·CVSS 7.2 EPSS 0.43%

    Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.10, 41.10.3, and 42.0.1, a sandboxed iframe without the allow-popups keyword could still open a new window or trigger setWindowOpenHandler with no user interactio...

11. CVE-2026-70607 Electron: window.open features string controls some window options considered privileged

    Published 2026-08-05

    Medium·CVSS 5.3 EPSS 0.56%

    Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.8, 40.9.0, 41.2.1, and 42.0.0-beta.3, some window options supplied by web content in the window.open() features string were applied to the new BrowserWindow witho...

12. CVE-2026-70606 Electron: ProtocolResponse.url reuses the default session cache instead of the registering session

    Published 2026-08-05

    Medium·CVSS 5.9 EPSS 0.26%

    Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 40.10.6, 41.9.1, 42.5.1, and 43.0.0, when a custom protocol handler returned a ProtocolResponse with a url and no session, Electron made the upstream request through d...

13. CVE-2026-70605 Electron: HTTP redirect followed into local file loader

    Published 2026-08-05

    Medium·CVSS 5.9 EPSS 0.32%

    Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.8, 40.9.0, 41.2.1, and 42.0.0-beta.3, when following HTTP redirects, net.fetch() and net.request() did not restrict which schemes a redirect could target. A remot...

14. CVE-2026-70604 Electron: Custom protocol with supportFetchAPI but not corsEnabled allows cross-origin reads

    Published 2026-08-05

    High·CVSS 7.4 EPSS 0.35%

    Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.10, 40.9.3, 41.4.0, and 42.0.0, a custom scheme registered with supportFetchAPI: true but without corsEnabled: true was not subject to CORS enforcement. A page lo...

15. CVE-2026-70603 Electron: shell.openPath path validation bypass via embedded null byte

    Published 2026-08-05

    Medium·CVSS 6.0 EPSS 0.13%

    Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.6, 40.9.0, 41.1.1, and 42.0.0-beta.1, shell.openPath() did not reject paths containing embedded null bytes. Apps that perform string-only validation of file paths...

16. CVE-2026-70602 Electron: Extension tab APIs operate across session boundaries

    Published 2026-08-05

    Medium·CVSS 6.6 EPSS 0.26%

    Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.8, 40.9.0, 41.2.1, and 42.0.0-beta.3, extension tab and scripting APIs were not scoped to the extension's own session. A malicious or compromised extension loaded...

17. CVE-2026-70601 Electron: Context isolation bypass via Function.prototype.bind hijack

    Published 2026-08-05

    High·CVSS 7.5 EPSS 0.29%

    Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.9, 40.9.2, 41.2.2, and 42.0.0-beta.5, apps that expose Promise-returning functions to web content via contextBridge may be vulnerable to a context isolation bypas...

18. CVE-2026-70600 Electron: Cross-origin iframe can position native autofill popup

    Published 2026-08-05

    Medium·CVSS 4.3 EPSS 0.18%

    Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.8, 40.9.0, 41.2.1, and 42.0.0-beta.3, the native autofill popup could be positioned by a cross-origin iframe outside that iframe's bounds, over the embedding page...

19. CVE-2026-70599 Electron: Permission Check Handler Receives Main Frame Origin Instead of Requesting Iframe Origin

    Published 2026-08-05

    Medium·CVSS 5.9 EPSS 0.19%

    Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.7, 40.9.0, 41.2.0, and 42.0.0-beta.1, serial-port and media permission checks made from an iframe passed the top-level frame origin to session.setPermissionCheckH...

20. CVE-2026-70598 Electron: Off-screen rendering trusts GPU-supplied geometry over shared-memory size

    Published 2026-08-05

    Low·CVSS 3.9 EPSS 0.14%

    Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.10, 40.9.0, 41.2.1, and 42.0.0-beta.3, offscreen rendering frame data received from the GPU process was not fully validated by the main process. A compromised GPU...

21. CVE-2026-70597 Electron: Parent process code-sign check is spoofable

    Published 2026-08-05

    Medium·CVSS 6.3 EPSS 0.10%

    Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.8, 40.9.0, 41.2.1, and 42.0.0-beta.3, the check Electron uses on macOS to confirm it was launched by a same-signed parent process could be bypassed by a local pro...

22. CVE-2026-34781 Electron crashes in clipboard.readImage() on malformed clipboard image data

    Published 2026-04-07

    Low·CVSS 3.3 EPSS 0.15%

    Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.5, 40.8.5, 41.1.0, and 42.0.0-alpha.5, apps that call clipboard.readImage() may be vulnerable to a denial of service. If the system clipboard contains image data...

23. CVE-2026-34765 Electron named window.open targets not scoped to the opener's browsing context

    Published 2026-04-07

    High·CVSS 8.8 EPSS 0.31%

    Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.5, 40.8.5, 41.1.0, and 42.0.0-alpha.5, when a renderer calls window.open() with a target name, Electron did not correctly scope the named-window lookup to the ope...

24. CVE-2026-34764 Electron has a use-after-free in offscreen shared texture release() callback

    Published 2026-04-06

    Medium·CVSS 5.5 EPSS 0.10%

    Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. From 33.0.0-alpha.1 to before 39.8.5, 40.8.5, 41.1.0, and 42.0.0-alpha.5, apps that use offscreen rendering with GPU shared textures may be vulnerable to a use-after-free. Unde...

25. CVE-2026-34780 Electron: Context Isolation bypass via contextBridge VideoFrame transfer

    Published 2026-04-04

    Medium·CVSS 6.1 EPSS 0.33%

    Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. From versions 39.0.0-alpha.1 to before 39.8.0, 40.0.0-alpha.1 to before 40.7.0, and 41.0.0-alpha.1 to before 41.0.0-beta.8, apps that pass VideoFrame objects (from the WebCodec...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.