Vulnerabilities

TI-2026-65466 CVE-2026-102677 · GHSA-qmv3-fv6v-rmhq

Electron: Sandboxed preload code cache can be poisoned by a compromised renderer

LOW 39

Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS.

CVSS 3.1HIGH 8.8 Local Low privileges No interaction EPSS 0.00099 Published 2026-09-29 Partial fix · 42.10.0, 43.5.0 +1 CWE-20

TI-2026-65465 CVE-2026-102676 · GHSA-9qh4-3jw8-366w

Electron: <webview> can enable Node.js integration in Web Workers despite embedder restrictions

MEDIUM 43

Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00479 Published 2026-09-29 Partial fix · 41.10.6, 42.9.2 +2 CWE-1188

TI-2026-65464 CVE-2026-102675 · GHSA-j84w-jfhq-vhvj

Electron: File and HTTP protocol handlers allow cross-origin reads without corsEnabled

LOW 32

Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS.

CVSS 3.1HIGH 7.4 Network No auth User interaction EPSS 0.00214 Published 2026-09-29 Partial fix · 41.10.6, 42.9.2 +2 CWE-346

TI-2026-65463 CVE-2026-102674 · GHSA-gr2m-v5gq-v685

Electron: Windows opened from a sandboxed top-level document do not inherit its sandbox restrictions

LOW 35

Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS.

CVSS 3.1HIGH 8.2 Network No auth User interaction EPSS 0.00236 Published 2026-09-29 Partial fix · 41.10.6, 42.9.2 +2 CWE-266

TI-2026-65462 CVE-2026-102673 · GHSA-hq2x-r82h-9wj4

Electron drops inherited HTML sandbox restrictions for popups opened through OpenURLFromTab

LOW 35

Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS.

CVSS 3.1HIGH 8.2 Network No auth User interaction EPSS 0.00132 Published 2026-09-29 Partial fix · 41.10.4, 42.5.2 +1 CWE-346

TI-2026-49329 CVE-2026-70612 · GHSA-p2rr-rvmm-c5fp

Electron: Sandboxed iframes can launch external protocol handlers

LOW 25

Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS.

CVSS 3.1MEDIUM 5.4 Network No auth No interaction EPSS 0.00429 Published 2026-08-05 Fixed in 39.8.8, 40.9.0 +2 CWE-284

TI-2026-49328 CVE-2026-70611 · GHSA-f2r8-jv7c-xqmp

Electron: DevTools embedder handler executes arbitrary files via shell open

LOW 32

Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS.

CVSS 3.1MEDIUM 6.9 Local High privileges User interaction EPSS 0.00186 Published 2026-08-05 Fixed in 39.8.9, 40.9.2 +2 CWE-78

TI-2026-49327 CVE-2026-70610 · GHSA-ff2p-hmqr-hxm4

Electron: contextBridge object copy honors prototype setters

LOW 25

Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS.

CVSS 3.1MEDIUM 5.4 Network No auth No interaction EPSS 0.00564 Published 2026-08-05 Fixed in 39.8.9, 40.9.2 +2 CWE-1321

TI-2026-49326 CVE-2026-70609 · GHSA-4f78-qhmw-8j8m

Electron: DevTools JavaScript Injection via Unsanitized Dock State Parameter

LOW 28

Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS.

CVSS 3.1MEDIUM 5.7 Network High privileges User interaction EPSS 0.00532 Published 2026-08-05 Fixed in 39.8.7, 40.9.0 +2 CWE-116

TI-2026-49325 CVE-2026-70608 · GHSA-9f4c-93c8-jc8g

Electron: Sandboxed iframe can bypass the allow-popups restriction via the OpenURL navigation path

LOW 38

Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS.

CVSS 3.1HIGH 7.2 Network No auth No interaction EPSS 0.00431 Published 2026-08-05 Fixed in 39.8.10, 41.10.3 +1 CWE-1021

TI-2026-49324 CVE-2026-70607 · GHSA-v93f-fgjr-hjrj

Electron: window.open features string controls some window options considered privileged

LOW 31

Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00558 Published 2026-08-05 Fixed in 39.8.8, 40.9.0 +2 CWE-20

TI-2026-49323 CVE-2026-70606 · GHSA-r4w5-6pfg-jxp5

Electron: ProtocolResponse.url reuses the default session cache instead of the registering session

LOW 26

Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS.

CVSS 3.1MEDIUM 5.9 Network No auth User interaction EPSS 0.00255 Published 2026-08-05 Fixed in 40.10.6, 41.9.1 +2 CWE-668

TI-2026-49322 CVE-2026-70605 · GHSA-v64r-4m7r-3mvq

Electron: HTTP redirect followed into local file loader

LOW 26

Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS.

CVSS 3.1MEDIUM 5.9 Network No auth No interaction EPSS 0.00315 Published 2026-08-05 Fixed in 39.8.8, 40.9.0 +3 CWE-918

TI-2026-49321 CVE-2026-70604 · GHSA-v3j7-r9gq-3gjw

Electron: Custom protocol with supportFetchAPI but not corsEnabled allows cross-origin reads

LOW 32

Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS.

CVSS 3.1HIGH 7.4 Network No auth User interaction EPSS 0.00354 Published 2026-08-05 Fixed in 39.8.10, 40.9.3 +2 CWE-942

TI-2026-49320 CVE-2026-70603 · GHSA-5c9j-mhmv-5xgx

Electron: shell.openPath path validation bypass via embedded null byte

LOW 28

Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS.

CVSS 3.1MEDIUM 6.0 Local Low privileges User interaction EPSS 0.00132 Published 2026-08-05 Fixed in 39.8.6, 40.9.0 +2 CWE-158

TI-2026-49319 CVE-2026-70602 · GHSA-m55f-7gqj-fr98

Electron: Extension tab APIs operate across session boundaries

LOW 29

Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS.

CVSS 3.1MEDIUM 6.6 Network High privileges No interaction EPSS 0.00256 Published 2026-08-05 Fixed in 39.8.8, 40.9.0 +2 CWE-284

TI-2026-49318 CVE-2026-70601 · GHSA-h7rp-cf8h-j98x

Electron: Context isolation bypass via Function.prototype.bind hijack

LOW 33

Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00285 Published 2026-08-05 Fixed in 39.8.9, 40.9.2 +2 CWE-693

TI-2026-49317 CVE-2026-70600 · GHSA-x8rc-wpg4-grpf

Electron: Cross-origin iframe can position native autofill popup

LOW 19

Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS.

CVSS 3.1MEDIUM 4.3 Network No auth User interaction EPSS 0.00179 Published 2026-08-05 Fixed in 39.8.8, 40.9.0 +3 CWE-1021

TI-2026-49316 CVE-2026-70599 · GHSA-9pf5-hg6p-4pwp

Electron: Permission Check Handler Receives Main Frame Origin Instead of Requesting Iframe Origin

LOW 26

Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS.

CVSS 3.1MEDIUM 5.9 Network No auth No interaction EPSS 0.00193 Published 2026-08-05 Fixed in 39.8.7, 40.9.0 +2 CWE-346

TI-2026-49315 CVE-2026-70598 · GHSA-pfmc-3mgc-p6fp

Electron: Off-screen rendering trusts GPU-supplied geometry over shared-memory size

LOW 17

Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS.

CVSS 3.1LOW 3.9 Local High privileges No interaction EPSS 0.00136 Published 2026-08-05 Fixed in 39.8.10, 40.9.0 +2 CWE-125

TI-2026-49314 CVE-2026-70597 · GHSA-jm7p-cc5g-qwxx

Electron: Parent process code-sign check is spoofable

LOW 29

Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS.

CVSS 3.1MEDIUM 6.3 Local Low privileges No interaction EPSS 0.00104 Published 2026-08-05 Fixed in 39.8.8, 40.9.0 +3 CWE-367

TI-2026-27025 CVE-2026-34781 · GHSA-f37v-82c4-4x64

Electron crashes in clipboard.readImage() on malformed clipboard image data

LOW 15

Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS.

CVSS 3.1LOW 3.3 Local No auth User interaction EPSS 0.0015 Published 2026-04-07 Partial fix · 39.8.5, 40.8.5 +2 CWE-476

TI-2026-27009 CVE-2026-34765 · GHSA-f3pv-wv63-48x8

Electron named window.open targets not scoped to the opener's browsing context

MEDIUM 40

Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00305 Published 2026-04-07 Partial fix · 39.8.5, 40.8.5 +2 CWE-668

TI-2026-27008 CVE-2026-34764 · GHSA-8x5q-pvf5-64mp

Electron has a use-after-free in offscreen shared texture release() callback

LOW 24

Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS.

CVSS 3.1MEDIUM 5.5 Local Low privileges No interaction EPSS 0.00103 Published 2026-04-06 Partial fix · 39.8.5, 40.8.5 +2 CWE-416

TI-2026-27024 CVE-2026-34780 · GHSA-jfqg-hf23-qpw2

Electron: Context Isolation bypass via contextBridge VideoFrame transfer

LOW 38

Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS.

CVSS 3.1HIGH 8.4 Network No auth User interaction EPSS 0.00333 Published 2026-04-04 Partial fix · 39.8.0, 40.7.0 +1 CWE-1188

Vulnerabilities

Filters