Electron vulnerabilities

Products

• Electron 71
• Electron-builder 4

Newest

• electron Electron: Mitigation for compromised eMudhra intermediate certificates CVE-2026-115570 Fix available 7.4 HighOctober 23, 2026
• electron Electron: Off-screen rendering on macOS trusts GPU-supplied frame geometry CVE-2026-114124 Fix available 3.9 LowOctober 21, 2026
• electron Electron: Frame subscription trusts GPU-supplied frame geometry CVE-2026-114122 Fix available 3.9 LowOctober 21, 2026
• electron Electron: openExternal permission requests can be attributed to the wrong origin CVE-2026-114121 Fix available 5.4 MediumOctober 21, 2026
• electron Electron: HID and USB permission checks can be attributed to the wrong origin CVE-2026-113800 Fix available 5.4 MediumOctober 21, 2026
• electron Electron: Pointer lock permission requests can be attributed to the wrong frame CVE-2026-113798 Fix available 5.4 MediumOctober 21, 2026
• electron Electron: Extension tabs.query returns tab URLs and titles without the tabs permission CVE-2026-113797 Fix available 3.1 LowOctober 21, 2026
• electron Electron: SameSite cookie restrictions are not applied to windows opened from links CVE-2026-113796 Fix available 4.2 MediumOctober 21, 2026
• electron Electron: Local race condition in Squirrel.Mac update installation on macOS CVE-2026-102672 Fix available 6.7 MediumSeptember 29, 2026
• electron Electron: Sandboxed preload code cache can be poisoned by a compromised renderer CVE-2026-102677 Fix available 7.8 HighSeptember 29, 2026
• electron Electron: <webview> can enable Node.js integration in Web Workers despite embedder restrictions CVE-2026-102676 Fix available 8.3 HighSeptember 29, 2026
• electron Electron: File and HTTP protocol handlers allow cross-origin reads without corsEnabled CVE-2026-102675 Fix available 7.4 HighSeptember 29, 2026
• electron Electron: Windows opened from a sandboxed top-level document do not inherit its sandbox restrictions CVE-2026-102674 Fix available 8.2 HighSeptember 29, 2026
• electron Electron drops inherited HTML sandbox restrictions for popups opened through OpenURLFromTab CVE-2026-102673 Fix available 8.2 HighSeptember 29, 2026
• electron Electron: Sandboxed iframes can launch external protocol handlers CVE-2026-70612 Fix available 5.4 MediumAugust 5, 2026
• electron Electron: DevTools embedder handler executes arbitrary files via shell open CVE-2026-70611 Fix available 6.9 MediumAugust 5, 2026
• electron Electron: contextBridge object copy honors prototype setters CVE-2026-70610 Fix available 5.4 MediumAugust 5, 2026
• electron Electron: DevTools JavaScript Injection via Unsanitized Dock State Parameter CVE-2026-70609 Fix available 5.7 MediumAugust 5, 2026
• electron Electron: Sandboxed iframe can bypass the allow-popups restriction via the OpenURL navigation path CVE-2026-70608 Fix available 7.2 HighAugust 5, 2026
• electron Electron: window.open features string controls some window options considered privileged CVE-2026-70607 Fix available 5.3 MediumAugust 5, 2026
• electron Electron: ProtocolResponse.url reuses the default session cache instead of the registering session CVE-2026-70606 Fix available 5.9 MediumAugust 5, 2026
• electron Electron: HTTP redirect followed into local file loader CVE-2026-70605 Fix available 5.9 MediumAugust 5, 2026
• electron Electron: Custom protocol with supportFetchAPI but not corsEnabled allows cross-origin reads CVE-2026-70604 Fix available 7.4 HighAugust 5, 2026
• electron Electron: shell.openPath path validation bypass via embedded null byte CVE-2026-70603 Fix available 6.0 MediumAugust 5, 2026
• electron Electron: Extension tab APIs operate across session boundaries CVE-2026-70602 Fix available 6.6 MediumAugust 5, 2026
• electron Electron: Context isolation bypass via Function.prototype.bind hijack CVE-2026-70601 Fix available 7.5 HighAugust 5, 2026
• electron Electron: Cross-origin iframe can position native autofill popup CVE-2026-70600 Fix available 3.1 LowAugust 5, 2026
• electron Electron: Permission Check Handler Receives Main Frame Origin Instead of Requesting Iframe Origin CVE-2026-70599 Fix available 5.9 MediumAugust 5, 2026
• electron Electron: Off-screen rendering trusts GPU-supplied geometry over shared-memory size CVE-2026-70598 Fix available 3.9 LowAugust 5, 2026
• electron Electron: Parent process code-sign check is spoofable CVE-2026-70597 Fix available 6.3 MediumAugust 5, 2026
• electron-userland app-builder-lib, electron electron-builder +1 more electron-updater: Uncontrolled search path elements within `AppImage` built by `app-builder-lib` CVE-2026-54672 Fix available 7.8 HighJune 30, 2026
• electron builder-util-runtime, electron-builder +1 more electron-updater: Cross-origin redirect leaks `PRIVATE-TOKEN` and mixed-case `Authorization` credentials in `builder-util-runtime` CVE-2026-54673 Fix available 8.2 HighJune 30, 2026
• electron Electron: Buffer performs incorrect byte length calculations resulting in heap buffer under/overflow CVE-2026-54257 Fix available 9.3 CriticalJune 15, 2026
• electron Electron crashes in clipboard.readImage() on malformed clipboard image data CVE-2026-34781 Fix available 2.8 LowApril 7, 2026
• electron Electron named window.open targets not scoped to the opener's browsing context CVE-2026-34765 Fix available 6.0 MediumApril 7, 2026
• electron Electron has a use-after-free in offscreen shared texture release() callback CVE-2026-34764 Fix available 2.3 LowApril 3, 2026
• electron, red hat build of podman desktop, build of podman desktop - tech preview +2 more Electron: Context Isolation bypass via contextBridge VideoFrame transfer CVE-2026-34780 Fix available 8.4 HighApril 3, 2026
• electron Electron: AppleScript injection in app.moveToApplicationsFolder on macOS CVE-2026-34779 Fix available 6.5 MediumApril 3, 2026
• electron Electron: Service worker can spoof executeJavaScript IPC replies CVE-2026-34778 Fix available 5.9 MediumApril 3, 2026
• electron Electron: Incorrect origin passed to permission request handler for iframe requests CVE-2026-34777 Fix available 5.4 MediumApril 3, 2026
• electron Electron: Out-of-bounds read in second-instance IPC on macOS and Linux CVE-2026-34776 Fix available 5.3 MediumApril 3, 2026
• electron Electron: nodeIntegrationInWorker not correctly scoped in shared renderer processes CVE-2026-34775 Fix available 6.8 MediumApril 3, 2026
• electron, red hat build of podman desktop, build of podman desktop - tech preview +2 more Electron: Use-after-free in offscreen child window paint callback CVE-2026-34774 Fix available 8.1 HighApril 3, 2026
• electron Electron: Registry key path injection in app.setAsDefaultProtocolClient on Windows CVE-2026-34773 Fix available 4.7 MediumApril 3, 2026
• electron Electron: Use-after-free in download save dialog callback CVE-2026-34772 Fix available 5.8 MediumApril 3, 2026
• electron, red hat build of podman desktop, build of podman desktop - tech preview +2 more Electron: Use-after-free in WebContents fullscreen, pointer-lock, and keyboard-lock permission callbacks CVE-2026-34771 Fix available 7.5 HighApril 3, 2026
• electron Electron: Use-after-free in PowerMonitor on Windows and macOS CVE-2026-34770 Fix available 7.0 HighApril 3, 2026
• electron, red hat build of podman desktop, build of podman desktop - tech preview +2 more Electron: Renderer command-line switch injection via undocumented commandLineSwitches webPreference CVE-2026-34769 Fix available 7.8 HighApril 3, 2026
• electron Electron: Unquoted executable path in app.setLoginItemSettings on Windows CVE-2026-34768 Fix available 3.9 LowApril 3, 2026
• electron Electron: HTTP Response Header Injection in custom protocol handlers and webRequest CVE-2026-34767 Fix available 5.9 MediumApril 3, 2026
• Show olderLoading…