Electronjs Electron vulnerabilities

• electron Electron: Sandboxed preload code cache can be poisoned by a compromised renderer CVE-2026-102677 Fix available 7.8 HighSeptember 29, 2026
• electron Electron: <webview> can enable Node.js integration in Web Workers despite embedder restrictions CVE-2026-102676 Fix available 8.3 HighSeptember 29, 2026
• electron Electron: File and HTTP protocol handlers allow cross-origin reads without corsEnabled CVE-2026-102675 Fix available 7.4 HighSeptember 29, 2026
• electron Electron: Windows opened from a sandboxed top-level document do not inherit its sandbox restrictions CVE-2026-102674 Fix available 8.2 HighSeptember 29, 2026
• electron Electron drops inherited HTML sandbox restrictions for popups opened through OpenURLFromTab CVE-2026-102673 Fix available 8.2 HighSeptember 29, 2026
• electron Electron: Sandboxed iframes can launch external protocol handlers CVE-2026-70612 Fix available 5.4 MediumAugust 5, 2026
• electron Electron: DevTools embedder handler executes arbitrary files via shell open CVE-2026-70611 Fix available 6.9 MediumAugust 5, 2026
• electron Electron: contextBridge object copy honors prototype setters CVE-2026-70610 Fix available 5.4 MediumAugust 5, 2026
• electron Electron: DevTools JavaScript Injection via Unsanitized Dock State Parameter CVE-2026-70609 Fix available 5.7 MediumAugust 5, 2026
• electron Electron: Sandboxed iframe can bypass the allow-popups restriction via the OpenURL navigation path CVE-2026-70608 Fix available 7.2 HighAugust 5, 2026
• electron Electron: window.open features string controls some window options considered privileged CVE-2026-70607 Fix available 5.3 MediumAugust 5, 2026
• electron Electron: ProtocolResponse.url reuses the default session cache instead of the registering session CVE-2026-70606 Fix available 5.9 MediumAugust 5, 2026
• electron Electron: HTTP redirect followed into local file loader CVE-2026-70605 Fix available 5.9 MediumAugust 5, 2026
• electron Electron: Custom protocol with supportFetchAPI but not corsEnabled allows cross-origin reads CVE-2026-70604 Fix available 7.4 HighAugust 5, 2026
• electron Electron: shell.openPath path validation bypass via embedded null byte CVE-2026-70603 Fix available 6.0 MediumAugust 5, 2026
• electron Electron: Extension tab APIs operate across session boundaries CVE-2026-70602 Fix available 6.6 MediumAugust 5, 2026
• electron Electron: Context isolation bypass via Function.prototype.bind hijack CVE-2026-70601 Fix available 7.5 HighAugust 5, 2026
• electron Electron: Cross-origin iframe can position native autofill popup CVE-2026-70600 Fix available 3.1 LowAugust 5, 2026
• electron Electron: Permission Check Handler Receives Main Frame Origin Instead of Requesting Iframe Origin CVE-2026-70599 Fix available 5.9 MediumAugust 5, 2026
• electron Electron: Off-screen rendering trusts GPU-supplied geometry over shared-memory size CVE-2026-70598 Fix available 3.9 LowAugust 5, 2026
• electron Electron: Parent process code-sign check is spoofable CVE-2026-70597 Fix available 6.3 MediumAugust 5, 2026
• electron Electron crashes in clipboard.readImage() on malformed clipboard image data CVE-2026-34781 Fix available 2.8 LowApril 7, 2026
• electron Electron named window.open targets not scoped to the opener's browsing context CVE-2026-34765 Fix available 6.0 MediumApril 7, 2026
• electron Electron has a use-after-free in offscreen shared texture release() callback CVE-2026-34764 Fix available 2.3 LowApril 3, 2026
• electron, red hat build of podman desktop, build of podman desktop - tech preview +2 more Electron: Context Isolation bypass via contextBridge VideoFrame transfer CVE-2026-34780 Fix available 8.4 HighApril 3, 2026
• electron Electron: AppleScript injection in app.moveToApplicationsFolder on macOS CVE-2026-34779 Fix available 6.5 MediumApril 3, 2026
• electron Electron: Service worker can spoof executeJavaScript IPC replies CVE-2026-34778 Fix available 5.9 MediumApril 3, 2026
• electron Electron: Incorrect origin passed to permission request handler for iframe requests CVE-2026-34777 Fix available 5.4 MediumApril 3, 2026
• electron Electron: Out-of-bounds read in second-instance IPC on macOS and Linux CVE-2026-34776 Fix available 5.3 MediumApril 3, 2026
• electron Electron: nodeIntegrationInWorker not correctly scoped in shared renderer processes CVE-2026-34775 Fix available 6.8 MediumApril 3, 2026
• electron, red hat build of podman desktop, build of podman desktop - tech preview +2 more Electron: Use-after-free in offscreen child window paint callback CVE-2026-34774 Fix available 8.1 HighApril 3, 2026
• electron Electron: Registry key path injection in app.setAsDefaultProtocolClient on Windows CVE-2026-34773 Fix available 4.7 MediumApril 3, 2026
• electron Electron: Use-after-free in download save dialog callback CVE-2026-34772 Fix available 5.8 MediumApril 3, 2026
• electron, red hat build of podman desktop, build of podman desktop - tech preview +2 more Electron: Use-after-free in WebContents fullscreen, pointer-lock, and keyboard-lock permission callbacks CVE-2026-34771 Fix available 7.5 HighApril 3, 2026
• electron Electron: Use-after-free in PowerMonitor on Windows and macOS CVE-2026-34770 Fix available 7.0 HighApril 3, 2026
• electron, red hat build of podman desktop, build of podman desktop - tech preview +2 more Electron: Renderer command-line switch injection via undocumented commandLineSwitches webPreference CVE-2026-34769 Fix available 7.8 HighApril 3, 2026
• electron Electron: Unquoted executable path in app.setLoginItemSettings on Windows CVE-2026-34768 Fix available 3.9 LowApril 3, 2026
• electron Electron: HTTP Response Header Injection in custom protocol handlers and webRequest CVE-2026-34767 Fix available 5.9 MediumApril 3, 2026
• electron Electron: USB device selection not validated against filtered device list CVE-2026-34766 Fix available 3.3 LowApril 3, 2026
• electronjs electroncord kedi ElectronCord's Discord Token is public CVE-2024-26136 7.5 HighFebruary 20, 2024
• electron ASAR Integrity bypass via filetype confusion in electron CVE-2023-44402 Fix available 6.1 MediumDecember 1, 2023
• electron Electron: Out-of-package code execution when launched with arbitrary cwd CVE-2023-39956 Fix available 6.1 MediumSeptember 6, 2023
• electron Context isolation bypass via nested unserializable return value in Electron CVE-2023-29198 Fix available 6.0 MediumSeptember 6, 2023
• atom electron Content-Secrity-Policy disabling eval not applied consistently in renderers with sandbox disabled in Electron CVE-2023-23623 Fix available 7.5 HighSeptember 6, 2023
• electron Electron subject to Exfiltration of hashed SMB credentials on Windows via file:// redirect CVE-2022-36077 Fix available 7.2 HighNovember 8, 2022
• electron Electron's AutoUpdater module fails to validate certain nested components of the bundle CVE-2022-29257 Fix available 6.6 MediumJune 13, 2022
• electron Exposure of Resource to Wrong Sphere in Electron CVE-2022-29247 Fix available 2.2 LowJune 13, 2022
• electron Renderers can obtain access to random bluetooth device without permission in Electron CVE-2022-21718 Fix available 3.4 LowMarch 22, 2022
• electron Sandboxed renderers can obtain thumbnails of arbitrary files through the nativeImage API CVE-2021-39184 Fix available 6.8 MediumOctober 12, 2021
• electron Electron vulnerable to ID collision when routing IPC messages to renderers containing OOPIFs CVE-2020-26272 Fix available 5.4 MediumJanuary 28, 2021
• Show olderLoading…