Vulnerabilities

TI-2026-79970 CVE-2026-115570 · GHSA-jr5w-w6x2-84p9

Electron does not block compromised eMudhra intermediate certificates

LOW 35

Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS.

CVSS 3.1HIGH 7.4 Network No auth No interaction EPSS 0.00377 Published 2026-10-23 Fixed in 45.0.0-beta.6, 44.9.1 +2 CWE-299

TI-2026-78904 CVE-2026-114124 · GHSA-h3v5-h239-pg29

Out-of-bounds read in Electron macOS off-screen rendering

LOW 18

Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS.

CVSS 3.1LOW 3.9 Local High privileges No interaction EPSS 0.00185 Published 2026-10-21 Fixed in 42.11.6, 43.7.3 +2 CWE-125

TI-2026-78866 CVE-2026-114122 · GHSA-3qxv-5xgr-q7w9

Out-of-bounds read in Electron frame subscription geometry

LOW 18

Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS.

CVSS 3.1LOW 3.9 Local High privileges No interaction EPSS 0.00186 Published 2026-10-21 Fixed in 42.11.6, 43.7.3 +2 CWE-125

TI-2026-78865 CVE-2026-114121 · GHSA-997q-gvvc-jwmx

Electron attributes openExternal permission requests to wrong origin

LOW 24

Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS.

CVSS 3.1MEDIUM 5.4 Network No auth No interaction EPSS 0.00219 Published 2026-10-21 Fixed in 42.11.3, 43.7.0 +2 CWE-346

TI-2026-78864 CVE-2026-113800 · GHSA-fw47-9c62-h3vw

HID and USB permission checks attributed to wrong origin in Electron

LOW 24

Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS.

CVSS 3.1MEDIUM 5.4 Network No auth No interaction EPSS 0.00241 Published 2026-10-21 Fixed in 42.11.3, 43.7.0 +2 CWE-346

TI-2026-78862 CVE-2026-113798 · GHSA-x562-297c-g43g

Electron pointer lock requests can be attributed to the wrong frame

LOW 24

Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS.

CVSS 3.1MEDIUM 5.4 Network No auth User interaction EPSS 0.00244 Published 2026-10-21 Fixed in 42.11.9, 43.7.6 +2 CWE-346

TI-2026-78861 CVE-2026-113797 · GHSA-98mx-cjp9-gchm

Missing authorization in Electron lets extensions read tab URLs and titles

LOW 16

Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS.

CVSS 3.1LOW 3.1 Network No auth User interaction EPSS 0.00586 Published 2026-10-21 Fixed in 42.11.1, 43.5.1 +2 CWE-862

TI-2026-78860 CVE-2026-113796 · GHSA-2p8c-gr87-2676

Electron mishandles SameSite cookies for windows opened from links

LOW 19

Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS.

CVSS 3.1MEDIUM 4.2 Network No auth User interaction EPSS 0.00219 Published 2026-10-21 Fixed in 42.11.3, 43.7.0 +2 CWE-352

TI-2026-71823 CVE-2026-102672

Race condition in Electron Squirrel.Mac update installation on macOS

LOW 30

Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS.

CVSS 3.1MEDIUM 6.7 Local Low privileges User interaction EPSS 0.00093 Published 2026-10-13 Fixed in 39.8.10, 41.10.5 +1 CWE-367

TI-2026-65466 CVE-2026-102677 · GHSA-qmv3-fv6v-rmhq

Electron: Sandboxed preload code cache can be poisoned by a compromised renderer

LOW 39

Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS.

CVSS 3.1HIGH 8.8 Local Low privileges No interaction EPSS 0.00099 Published 2026-09-29 Partial fix · 42.10.0, 43.5.0 +1 CWE-20

TI-2026-65465 CVE-2026-102676 · GHSA-9qh4-3jw8-366w

Electron: <webview> can enable Node.js integration in Web Workers despite embedder restrictions

MEDIUM 43

Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00479 Published 2026-09-29 Partial fix · 41.10.6, 42.9.2 +2 CWE-1188

TI-2026-65464 CVE-2026-102675 · GHSA-j84w-jfhq-vhvj

Electron: File and HTTP protocol handlers allow cross-origin reads without corsEnabled

LOW 32

Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS.

CVSS 3.1HIGH 7.4 Network No auth User interaction EPSS 0.00214 Published 2026-09-29 Partial fix · 41.10.6, 42.9.2 +2 CWE-346

TI-2026-65463 CVE-2026-102674 · GHSA-gr2m-v5gq-v685

Electron: Windows opened from a sandboxed top-level document do not inherit its sandbox restrictions

LOW 35

Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS.

CVSS 3.1HIGH 8.2 Network No auth User interaction EPSS 0.00236 Published 2026-09-29 Partial fix · 41.10.6, 42.9.2 +2 CWE-266

TI-2026-65462 CVE-2026-102673 · GHSA-hq2x-r82h-9wj4

Electron drops inherited HTML sandbox restrictions for popups opened through OpenURLFromTab

LOW 35

Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS.

CVSS 3.1HIGH 8.2 Network No auth User interaction EPSS 0.00132 Published 2026-09-29 Partial fix · 41.10.4, 42.5.2 +1 CWE-346

TI-2026-49329 CVE-2026-70612 · GHSA-p2rr-rvmm-c5fp

Electron: Sandboxed iframes can launch external protocol handlers

LOW 25

Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS.

CVSS 3.1MEDIUM 5.4 Network No auth No interaction EPSS 0.00429 Published 2026-08-05 Fixed in 39.8.8, 40.9.0 +2 CWE-284

TI-2026-49328 CVE-2026-70611 · GHSA-f2r8-jv7c-xqmp

Electron: DevTools embedder handler executes arbitrary files via shell open

LOW 32

Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS.

CVSS 3.1MEDIUM 6.9 Local High privileges User interaction EPSS 0.00186 Published 2026-08-05 Fixed in 39.8.9, 40.9.2 +2 CWE-78

TI-2026-49327 CVE-2026-70610 · GHSA-ff2p-hmqr-hxm4

Electron: contextBridge object copy honors prototype setters

LOW 25

Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS.

CVSS 3.1MEDIUM 5.4 Network No auth No interaction EPSS 0.00564 Published 2026-08-05 Fixed in 39.8.9, 40.9.2 +2 CWE-1321

TI-2026-49326 CVE-2026-70609 · GHSA-4f78-qhmw-8j8m

Electron: DevTools JavaScript Injection via Unsanitized Dock State Parameter

LOW 28

Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS.

CVSS 3.1MEDIUM 5.7 Network High privileges User interaction EPSS 0.00532 Published 2026-08-05 Fixed in 39.8.7, 40.9.0 +2 CWE-116

TI-2026-49325 CVE-2026-70608 · GHSA-9f4c-93c8-jc8g

Electron: Sandboxed iframe can bypass the allow-popups restriction via the OpenURL navigation path

LOW 38

Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS.

CVSS 3.1HIGH 7.2 Network No auth No interaction EPSS 0.00431 Published 2026-08-05 Fixed in 39.8.10, 41.10.3 +1 CWE-1021

TI-2026-49324 CVE-2026-70607 · GHSA-v93f-fgjr-hjrj

Electron: window.open features string controls some window options considered privileged

LOW 31

Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00558 Published 2026-08-05 Fixed in 39.8.8, 40.9.0 +2 CWE-20

TI-2026-49323 CVE-2026-70606 · GHSA-r4w5-6pfg-jxp5

Electron: ProtocolResponse.url reuses the default session cache instead of the registering session

LOW 26

Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS.

CVSS 3.1MEDIUM 5.9 Network No auth User interaction EPSS 0.00255 Published 2026-08-05 Fixed in 40.10.6, 41.9.1 +2 CWE-668

TI-2026-49322 CVE-2026-70605 · GHSA-v64r-4m7r-3mvq

Electron: HTTP redirect followed into local file loader

LOW 26

Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS.

CVSS 3.1MEDIUM 5.9 Network No auth No interaction EPSS 0.00315 Published 2026-08-05 Fixed in 39.8.8, 40.9.0 +3 CWE-918

TI-2026-49321 CVE-2026-70604 · GHSA-v3j7-r9gq-3gjw

Electron: Custom protocol with supportFetchAPI but not corsEnabled allows cross-origin reads

LOW 32

Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS.

CVSS 3.1HIGH 7.4 Network No auth User interaction EPSS 0.00354 Published 2026-08-05 Fixed in 39.8.10, 40.9.3 +2 CWE-942

TI-2026-49320 CVE-2026-70603 · GHSA-5c9j-mhmv-5xgx

Electron: shell.openPath path validation bypass via embedded null byte

LOW 28

Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS.

CVSS 3.1MEDIUM 6.0 Local Low privileges User interaction EPSS 0.00132 Published 2026-08-05 Fixed in 39.8.6, 40.9.0 +2 CWE-158

TI-2026-49319 CVE-2026-70602 · GHSA-m55f-7gqj-fr98

Electron: Extension tab APIs operate across session boundaries

LOW 29

Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS.

CVSS 3.1MEDIUM 6.6 Network High privileges No interaction EPSS 0.00256 Published 2026-08-05 Fixed in 39.8.8, 40.9.0 +2 CWE-284

Vulnerabilities

Filters