{"id":"CVE-2026-34770","aliases":["EUVD-2026-18939","GHSA-jjp3-mq3x-295m"],"status":"published","title":"Electron: Use-after-free in PowerMonitor on Windows and macOS","description":"Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to versions 38.8.6, 39.8.1, 40.8.0, and 41.0.0-beta.8, apps that use the powerMonitor module may be vulnerable to a use-after-free. After the native PowerMonitor object is garbage-collected, the associated OS-level resources (a message window on Windows, a shutdown handler on macOS) retain dangling references. A subsequent session-change event (Windows) or system shutdown (macOS) dereferences freed memory, which may lead to a crash or memory corruption. All apps that access powerMonitor events (suspend, resume, lock-screen, etc.) are potentially affected. The issue is not directly renderer-controllable. This issue has been patched in versions 38.8.6, 39.8.1, 40.8.0, and 41.0.0-beta.8.","severity":{"version":"3.1","score":7,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.00249,"percentile":0.16399,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-416"],"published":"2026-04-03T02:39:52Z","modified":"2026-10-28T10:50:41Z","fixes":[{"ecosystem":"npm","package":"electron","fixed_in":["38.8.6","39.8.1","40.8.0","41.0.0-beta.8"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"electron","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"38.8.6"}]}]},{"source":"ghsa","ecosystem":"npm","package":"electron","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"39.0.0-alpha.1"},{"fixed":"39.8.1"}]}]},{"source":"ghsa","ecosystem":"npm","package":"electron","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"40.0.0-alpha.1"},{"fixed":"40.8.0"}]}]},{"source":"ghsa","ecosystem":"npm","package":"electron","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"41.0.0-alpha.1"},{"fixed":"41.0.0-beta.8"}]}]},{"source":"osv","ecosystem":"npm","package":"electron","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"38.8.6"}]}]},{"source":"osv","ecosystem":"npm","package":"electron","ranges":[{"type":"SEMVER","events":[{"introduced":"39.0.0-alpha.1"},{"fixed":"39.8.1"}]}]},{"source":"osv","ecosystem":"npm","package":"electron","ranges":[{"type":"SEMVER","events":[{"introduced":"40.0.0-alpha.1"},{"fixed":"40.8.0"}]}]},{"source":"osv","ecosystem":"npm","package":"electron","ranges":[{"type":"SEMVER","events":[{"introduced":"41.0.0-alpha.1"},{"fixed":"41.0.0-beta.8"}]}]}],"products":[{"vendor":"electron","product":"electron"},{"vendor":"electronjs","product":"electron"}],"references":[{"url":"https://github.com/electron/electron/security/advisories/GHSA-jjp3-mq3x-295m","tags":["x_refsource_CONFIRM","Vendor Advisory","advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-34770","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-jjp3-mq3x-295m"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/34xxx/CVE-2026-34770.json","tags":["advisory"]},{"url":"https://github.com/electron/electron","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2026-34770","title":"Electron: Use-after-free in PowerMonitor on Windows and macOS","description":"Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to versions 38.8.6, 39.8.1, 40.8.0, and 41.0.0-beta.8, apps that use the powerMonitor module may be vulnerable to a use-after-free. After the native PowerMonitor object is garbage-collected, the associated OS-level resources (a message window on Windows, a shutdown handler on macOS) retain dangling references. A subsequent session-change event (Windows) or system shutdown (macOS) dereferences freed memory, which may lead to a crash or memory corruption. All apps that access powerMonitor events (suspend, resume, lock-screen, etc.) are potentially affected. The issue is not directly renderer-controllable. This issue has been patched in versions 38.8.6, 39.8.1, 40.8.0, and 41.0.0-beta.8.","status":"published","published":"2026-04-03T23:46:11.095Z","modified":"2026-04-08T03:55:36.38Z","cvss":[{"version":"3.1","score":7,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-416"],"updated_at":"2026-11-02T14:20:13.962274Z"}],"euvd":[{"id":"EUVD-2026-18939","description":"Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to versions 38.8.6, 39.8.1, 40.8.0, and 41.0.0-beta.8, apps that use the powerMonitor module may be vulnerable to a use-after-free. After the native PowerMonitor object is garbage-collected, the associated OS-level resources (a message window on Windows, a shutdown handler on macOS) retain dangling references. A subsequent session-change event (Windows) or system shutdown (macOS) dereferences freed memory, which may lead to a crash or memory corruption. All apps that access powerMonitor events (suspend, resume, lock-screen, etc.) are potentially affected. The issue is not directly renderer-controllable. This issue has been patched in versions 38.8.6, 39.8.1, 40.8.0, and 41.0.0-beta.8.","status":"published","published":"2026-04-03T23:46:11Z","modified":"2026-04-08T03:55:36Z","cvss":[{"version":"3.1","score":7,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T19:25:12.431163Z"}],"ghsa":[{"id":"GHSA-jjp3-mq3x-295m","title":"Electron: Use-after-free in PowerMonitor on Windows and macOS","description":"### Impact\nApps that use the `powerMonitor` module may be vulnerable to a use-after-free. After the native `PowerMonitor` object is garbage-collected, the associated OS-level resources (a message window on Windows, a shutdown handler on macOS) retain dangling references. A subsequent session-change event (Windows) or system shutdown (macOS) dereferences freed memory, which may lead to a crash or memory corruption.\n\nAll apps that access `powerMonitor` events (`suspend`, `resume`, `lock-screen`, etc.) are potentially affected. The issue is not directly renderer-controllable.\n\n### Workarounds\nThere are no app side workarounds, you must update to a patched version of Electron.\n\n### Fixed Versions\n* `41.0.0-beta.8`\n* `40.8.0`\n* `39.8.1`\n* `38.8.6`\n\n### For more information\nIf there are any questions or comments about this advisory, please email [security@electronjs.org](mailto:security@electronjs.org)","status":"published","published":"2026-04-03T02:39:52Z","modified":"2026-04-06T23:10:42Z","cvss":[{"version":"3.1","score":7,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-416"],"updated_at":"2026-11-02T14:39:50.076383Z"}],"nvd":[{"id":"CVE-2026-34770","description":"Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to versions 38.8.6, 39.8.1, 40.8.0, and 41.0.0-beta.8, apps that use the powerMonitor module may be vulnerable to a use-after-free. After the native PowerMonitor object is garbage-collected, the associated OS-level resources (a message window on Windows, a shutdown handler on macOS) retain dangling references. A subsequent session-change event (Windows) or system shutdown (macOS) dereferences freed memory, which may lead to a crash or memory corruption. All apps that access powerMonitor events (suspend, resume, lock-screen, etc.) are potentially affected. The issue is not directly renderer-controllable. This issue has been patched in versions 38.8.6, 39.8.1, 40.8.0, and 41.0.0-beta.8.","status":"published","published":"2026-04-04T00:16:17.823Z","modified":"2026-07-24T22:10:00.14Z","cvss":[{"version":"3.1","score":7,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"secondary"},{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"}],"cwes":["CWE-416"],"updated_at":"2026-11-02T14:12:13.1424Z"}],"osv":[{"id":"CVE-2026-34770","title":"Electron: Use-after-free in PowerMonitor on Windows and macOS","description":"Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to versions 38.8.6, 39.8.1, 40.8.0, and 41.0.0-beta.8, apps that use the powerMonitor module may be vulnerable to a use-after-free. After the native PowerMonitor object is garbage-collected, the associated OS-level resources (a message window on Windows, a shutdown handler on macOS) retain dangling references. A subsequent session-change event (Windows) or system shutdown (macOS) dereferences freed memory, which may lead to a crash or memory corruption. All apps that access powerMonitor events (suspend, resume, lock-screen, etc.) are potentially affected. The issue is not directly renderer-controllable. This issue has been patched in versions 38.8.6, 39.8.1, 40.8.0, and 41.0.0-beta.8.","status":"published","published":"2026-04-03T23:46:11.095Z","modified":"2026-10-28T10:50:41.042056402Z","cvss":[{"version":"3.1","score":7,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-416"],"updated_at":"2026-11-02T15:45:02.247031Z"},{"id":"GHSA-jjp3-mq3x-295m","title":"Electron: Use-after-free in PowerMonitor on Windows and macOS","description":"### Impact\nApps that use the `powerMonitor` module may be vulnerable to a use-after-free. After the native `PowerMonitor` object is garbage-collected, the associated OS-level resources (a message window on Windows, a shutdown handler on macOS) retain dangling references. A subsequent session-change event (Windows) or system shutdown (macOS) dereferences freed memory, which may lead to a crash or memory corruption.\n\nAll apps that access `powerMonitor` events (`suspend`, `resume`, `lock-screen`, etc.) are potentially affected. The issue is not directly renderer-controllable.\n\n### Workarounds\nThere are no app side workarounds, you must update to a patched version of Electron.\n\n### Fixed Versions\n* `41.0.0-beta.8`\n* `40.8.0`\n* `39.8.1`\n* `38.8.6`\n\n### For more information\nIf there are any questions or comments about this advisory, please email [security@electronjs.org](mailto:security@electronjs.org)","status":"published","published":"2026-04-03T02:39:52Z","modified":"2026-04-06T23:20:13.797422Z","cvss":[{"version":"3.1","score":7,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-416"],"updated_at":"2026-11-02T15:46:50.687609Z"}]}}