{"id":"CVE-2026-34780","aliases":["EUVD-2026-18961","GHSA-jfqg-hf23-qpw2"],"status":"published","title":"Electron: Context Isolation bypass via contextBridge VideoFrame transfer","description":"Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. From versions 39.0.0-alpha.1 to before 39.8.0, 40.0.0-alpha.1 to before 40.7.0, and 41.0.0-alpha.1 to before 41.0.0-beta.8, apps that pass VideoFrame objects (from the WebCodecs API) across the contextBridge are vulnerable to a context isolation bypass. An attacker who can execute JavaScript in the main world (for example, via XSS) can use a bridged VideoFrame to gain access to the isolated world, including any Node.js APIs exposed to the preload script. Apps are only affected if a preload script returns, resolves, or passes a VideoFrame object to the main world via contextBridge.exposeInMainWorld(). Apps that do not bridge VideoFrame objects are not affected. This issue has been patched in versions 39.8.0, 40.7.0, and 41.0.0-beta.8.","severity":{"version":"3.1","score":8.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.00333,"percentile":0.26829,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-1188","CWE-501","CWE-668"],"published":"2026-04-03T02:46:56Z","modified":"2026-10-28T10:49:35Z","fixes":[{"ecosystem":"npm","package":"electron","fixed_in":["39.8.0","40.7.0","41.0.0-beta.8"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"electron","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"39.0.0-alpha.1"},{"fixed":"39.8.0"}]}]},{"source":"ghsa","ecosystem":"npm","package":"electron","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"40.0.0-alpha.1"},{"fixed":"40.7.0"}]}]},{"source":"ghsa","ecosystem":"npm","package":"electron","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"41.0.0-alpha.1"},{"fixed":"41.0.0-beta.8"}]}]},{"source":"osv","ecosystem":"npm","package":"electron","ranges":[{"type":"SEMVER","events":[{"introduced":"39.0.0-alpha.1"},{"fixed":"39.8.0"}]}]},{"source":"osv","ecosystem":"npm","package":"electron","ranges":[{"type":"SEMVER","events":[{"introduced":"40.0.0-alpha.1"},{"fixed":"40.7.0"}]}]},{"source":"osv","ecosystem":"npm","package":"electron","ranges":[{"type":"SEMVER","events":[{"introduced":"41.0.0-alpha.1"},{"fixed":"41.0.0-beta.8"}]}]}],"products":[{"vendor":"electron","product":"electron"},{"vendor":"electronjs","product":"electron"},{"vendor":"red hat","product":"red hat build of podman desktop"},{"vendor":"red hat","product":"red hat build of podman desktop - tech preview"}],"references":[{"url":"https://github.com/electron/electron/security/advisories/GHSA-jfqg-hf23-qpw2","tags":["x_refsource_CONFIRM","Vendor Advisory","advisory","web"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-34780","tags":["vdb-entry","x_refsource_REDHAT","advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2455020","tags":["issue-tracking","x_refsource_REDHAT","report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-34780.json","tags":["x_sadp-csaf-vex","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-34780","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-jfqg-hf23-qpw2"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/34xxx/CVE-2026-34780.json","tags":["advisory"]},{"url":"https://github.com/electron/electron","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2026-34780","title":"Electron: Context Isolation bypass via contextBridge VideoFrame transfer","description":"Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. From versions 39.0.0-alpha.1 to before 39.8.0, 40.0.0-alpha.1 to before 40.7.0, and 41.0.0-alpha.1 to before 41.0.0-beta.8, apps that pass VideoFrame objects (from the WebCodecs API) across the contextBridge are vulnerable to a context isolation bypass. An attacker who can execute JavaScript in the main world (for example, via XSS) can use a bridged VideoFrame to gain access to the isolated world, including any Node.js APIs exposed to the preload script. Apps are only affected if a preload script returns, resolves, or passes a VideoFrame object to the main world via contextBridge.exposeInMainWorld(). Apps that do not bridge VideoFrame objects are not affected. This issue has been patched in versions 39.8.0, 40.7.0, and 41.0.0-beta.8.","status":"published","published":"2026-04-04T00:02:02.224Z","modified":"2026-07-15T01:03:46.178Z","cvss":[{"version":"3.1","score":8.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H","level":"high","assessor":"cna"},{"version":"3.1","score":8,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H","level":"high","assessor":"adp"}],"cwes":["CWE-668","CWE-1188","CWE-501"],"updated_at":"2026-11-02T14:20:14.302133Z"}],"euvd":[{"id":"EUVD-2026-18961","description":"Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. From versions 39.0.0-alpha.1 to before 39.8.0, 40.0.0-alpha.1 to before 40.7.0, and 41.0.0-alpha.1 to before 41.0.0-beta.8, apps that pass VideoFrame objects (from the WebCodecs API) across the contextBridge are vulnerable to a context isolation bypass. An attacker who can execute JavaScript in the main world (for example, via XSS) can use a bridged VideoFrame to gain access to the isolated world, including any Node.js APIs exposed to the preload script. Apps are only affected if a preload script returns, resolves, or passes a VideoFrame object to the main world via contextBridge.exposeInMainWorld(). Apps that do not bridge VideoFrame objects are not affected. This issue has been patched in versions 39.8.0, 40.7.0, and 41.0.0-beta.8.","status":"published","published":"2026-04-04T00:02:02Z","modified":"2026-07-15T01:03:46Z","cvss":[{"version":"3.1","score":8.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T18:19:56.47701Z"}],"ghsa":[{"id":"GHSA-jfqg-hf23-qpw2","title":"Electron: Context Isolation bypass via contextBridge VideoFrame transfer","description":"### Impact\nApps that pass `VideoFrame` objects (from the WebCodecs API) across the `contextBridge` are vulnerable to a context isolation bypass. An attacker who can execute JavaScript in the main world (for example, via XSS) can use a bridged `VideoFrame` to gain access to the isolated world, including any Node.js APIs exposed to the preload script.\n\nApps are only affected if a preload script returns, resolves, or passes a `VideoFrame` object to the main world via `contextBridge.exposeInMainWorld()`. Apps that do not bridge `VideoFrame` objects are not affected.\n\n### Workarounds\nDo not pass `VideoFrame` objects across `contextBridge`. If an app needs to transfer video frame data, serialize it to an `ArrayBuffer` or `ImageBitmap` before bridging.\n\n### Fixed Versions\n* `41.0.0-beta.8`\n* `40.7.0`\n* `39.8.0`\n\n### For more information\nIf there are any questions or comments about this advisory, please email [security@electronjs.org](mailto:security@electronjs.org)","status":"published","published":"2026-04-03T02:46:56Z","modified":"2026-04-06T23:11:51Z","cvss":[{"version":"3.1","score":8.3,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-668","CWE-1188"],"updated_at":"2026-11-02T14:39:50.076383Z"}],"nvd":[{"id":"CVE-2026-34780","description":"Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. From versions 39.0.0-alpha.1 to before 39.8.0, 40.0.0-alpha.1 to before 40.7.0, and 41.0.0-alpha.1 to before 41.0.0-beta.8, apps that pass VideoFrame objects (from the WebCodecs API) across the contextBridge are vulnerable to a context isolation bypass. An attacker who can execute JavaScript in the main world (for example, via XSS) can use a bridged VideoFrame to gain access to the isolated world, including any Node.js APIs exposed to the preload script. Apps are only affected if a preload script returns, resolves, or passes a VideoFrame object to the main world via contextBridge.exposeInMainWorld(). Apps that do not bridge VideoFrame objects are not affected. This issue has been patched in versions 39.8.0, 40.7.0, and 41.0.0-beta.8.","status":"published","published":"2026-04-04T01:16:39.54Z","modified":"2026-07-24T22:10:00.14Z","cvss":[{"version":"3.1","score":8.3,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H","level":"high","assessor":"secondary"},{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"primary"},{"version":"3.1","score":8,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-668","CWE-1188","CWE-501"],"updated_at":"2026-11-02T14:12:13.1424Z"}],"osv":[{"id":"CVE-2026-34780","title":"Electron: Context Isolation bypass via contextBridge VideoFrame transfer","description":"Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. From versions 39.0.0-alpha.1 to before 39.8.0, 40.0.0-alpha.1 to before 40.7.0, and 41.0.0-alpha.1 to before 41.0.0-beta.8, apps that pass VideoFrame objects (from the WebCodecs API) across the contextBridge are vulnerable to a context isolation bypass. An attacker who can execute JavaScript in the main world (for example, via XSS) can use a bridged VideoFrame to gain access to the isolated world, including any Node.js APIs exposed to the preload script. Apps are only affected if a preload script returns, resolves, or passes a VideoFrame object to the main world via contextBridge.exposeInMainWorld(). Apps that do not bridge VideoFrame objects are not affected. This issue has been patched in versions 39.8.0, 40.7.0, and 41.0.0-beta.8.","status":"published","published":"2026-04-04T00:02:02.224Z","modified":"2026-10-28T10:49:35.898949139Z","cvss":[{"version":"3.1","score":8.3,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-1188","CWE-668"],"updated_at":"2026-11-02T15:45:02.247031Z"},{"id":"GHSA-jfqg-hf23-qpw2","title":"Electron: Context Isolation bypass via contextBridge VideoFrame transfer","description":"### Impact\nApps that pass `VideoFrame` objects (from the WebCodecs API) across the `contextBridge` are vulnerable to a context isolation bypass. An attacker who can execute JavaScript in the main world (for example, via XSS) can use a bridged `VideoFrame` to gain access to the isolated world, including any Node.js APIs exposed to the preload script.\n\nApps are only affected if a preload script returns, resolves, or passes a `VideoFrame` object to the main world via `contextBridge.exposeInMainWorld()`. Apps that do not bridge `VideoFrame` objects are not affected.\n\n### Workarounds\nDo not pass `VideoFrame` objects across `contextBridge`. If an app needs to transfer video frame data, serialize it to an `ArrayBuffer` or `ImageBitmap` before bridging.\n\n### Fixed Versions\n* `41.0.0-beta.8`\n* `40.7.0`\n* `39.8.0`\n\n### For more information\nIf there are any questions or comments about this advisory, please email [security@electronjs.org](mailto:security@electronjs.org)","status":"published","published":"2026-04-03T02:46:56Z","modified":"2026-04-06T23:19:49.06315Z","cvss":[{"version":"3.1","score":8.3,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-1188","CWE-668"],"updated_at":"2026-11-02T15:46:50.336262Z"}]}}