Skip to content
This repository was archived by the owner on Aug 7, 2026. It is now read-only.

chore(deps): Update dependency electron to v41 [SECURITY] - #257

Open
renovate[bot] wants to merge 1 commit into
mainfrom
update/renovate-npm-electron-vulnerability
Open

chore(deps): Update dependency electron to v41 [SECURITY]#257
renovate[bot] wants to merge 1 commit into
mainfrom
update/renovate-npm-electron-vulnerability

Conversation

@renovate

@renovate renovate Bot commented Aug 6, 2026

Copy link
Copy Markdown
Contributor

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package Change Age Confidence
electron ^39.2.7 → ^41.0.0 age confidence
electron ^40.0.0 → ^41.0.0 age confidence

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

Electron: USB device selection not validated against filtered device list

CVE-2026-34766 / GHSA-9899-m83m-qhpj

More information

Details

Impact

The select-usb-device event callback did not validate the chosen device ID against the filtered list that was presented to the handler. An app whose handler could be influenced to select a device ID outside the filtered set would grant access to a device that did not match the renderer's requested filters or was listed in exclusionFilters.

The WebUSB security blocklist remained enforced regardless, so security-sensitive devices on the blocklist were not affected. The practical impact is limited to apps with unusual device-selection logic.

Workarounds

There are no app side workarounds, you must update to a patched version of Electron.

Fixed Versions
  • 41.0.0-beta.8
  • 40.7.0
  • 39.8.0
  • 38.8.6
For more information

If there are any questions or comments about this advisory, send an email to security@electronjs.org

Severity

  • CVSS Score: 3.3 / 10 (Low)
  • Vector String: CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:N

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

Electron: HTTP Response Header Injection in custom protocol handlers and webRequest

CVE-2026-34767 / GHSA-4p4r-m79c-wq3v

More information

Details

Impact

Apps that register custom protocol handlers via protocol.handle() / protocol.registerSchemesAsPrivileged() or modify response headers via webRequest.onHeadersReceived may be vulnerable to HTTP response header injection if attacker-controlled input is reflected into a response header name or value.

An attacker who can influence a header value may be able to inject additional response headers, affecting cookies, content security policy, or cross-origin access controls.

Apps that do not reflect external input into response headers are not affected.

Workarounds

Validate or sanitize any untrusted input before including it in a response header name or value.

Fixed Versions
  • 41.0.3
  • 40.8.3
  • 39.8.3
  • 38.8.6
For more information

If there are any questions or comments about this advisory, send an email to security@electronjs.org

Severity

  • CVSS Score: 5.9 / 10 (Medium)
  • Vector String: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:H/A:N

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

Electron: Unquoted executable path in app.setLoginItemSettings on Windows

CVE-2026-34768 / GHSA-jfqx-fxh3-c62j

More information

Details

Impact

On Windows, app.setLoginItemSettings({openAtLogin: true}) wrote the executable path to the Run registry key without quoting. If the app is installed to a path containing spaces, an attacker with write access to an ancestor directory may be able to cause a different executable to run at login instead of the intended app.

On a default Windows install, standard system directories are protected against writes by standard users, so exploitation typically requires a non-standard install location.

Workarounds

Install the application to a path without spaces, or to a location where all ancestor directories are protected against unauthorized writes.

Fixed Versions
  • 41.0.0-beta.8
  • 40.8.0
  • 39.8.1
  • 38.8.6
For more information

If there are any questions or comments about this advisory, send an email to security@electronjs.org

Severity

  • CVSS Score: 3.9 / 10 (Low)
  • Vector String: CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:L

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

Electron: Renderer command-line switch injection via undocumented commandLineSwitches webPreference

CVE-2026-34769 / GHSA-9wfr-w7mm-pc7f

More information

Details

Impact

An undocumented commandLineSwitches webPreference allowed arbitrary switches to be appended to the renderer process command line. Apps that construct webPreferences by spreading untrusted configuration objects may inadvertently allow an attacker to inject switches that disable renderer sandboxing or web security controls.

Apps are only affected if they construct webPreferences from external or untrusted input without an allowlist. Apps that use a fixed, hardcoded webPreferences object are not affected.

Workarounds

Do not spread untrusted input into webPreferences. Use an explicit allowlist of permitted preference keys when constructing BrowserWindow or webContents options from external configuration.

Fixed Versions
  • 41.0.0-beta.8
  • 40.7.0
  • 39.8.0
  • 38.8.6
For more information

If there are any questions or comments about this advisory, send an email to security@electronjs.org

Severity

  • CVSS Score: 7.7 / 10 (High)
  • Vector String: CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

Electron: Use-after-free in PowerMonitor on Windows and macOS

CVE-2026-34770 / GHSA-jjp3-mq3x-295m

More information

Details

Impact

Apps that use the powerMonitor module may be vulnerable to a use-after-free. After the native PowerMonitor object is garbage-collected, the associated OS-level resources (a message window on Windows, a shutdown handler on macOS) retain dangling references. A subsequent session-change event (Windows) or system shutdown (macOS) dereferences freed memory, which may lead to a crash or memory corruption.

All apps that access powerMonitor events (suspend, resume, lock-screen, etc.) are potentially affected. The issue is not directly renderer-controllable.

Workarounds

There are no app side workarounds, you must update to a patched version of Electron.

Fixed Versions
  • 41.0.0-beta.8
  • 40.8.0
  • 39.8.1
  • 38.8.6
For more information

If there are any questions or comments about this advisory, please email security@electronjs.org

Severity

  • CVSS Score: 7.0 / 10 (High)
  • Vector String: CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

Electron: Use-after-free in WebContents fullscreen, pointer-lock, and keyboard-lock permission callbacks

CVE-2026-34771 / GHSA-8337-3p73-46f4

More information

Details

Impact

Apps that register an asynchronous session.setPermissionRequestHandler() may be vulnerable to a use-after-free when handling fullscreen, pointer-lock, or keyboard-lock permission requests. If the requesting frame navigates or the window closes while the permission handler is pending, invoking the stored callback dereferences freed memory, which may lead to a crash or memory corruption.

Apps that do not set a permission request handler, or whose handler responds synchronously, are not affected.

Workarounds

Respond to permission requests synchronously, or deny fullscreen, pointer-lock, and keyboard-lock requests if an asynchronous flow is required.

Fixed Versions
  • 41.0.0-beta.8
  • 40.7.0
  • 39.8.0
  • 38.8.6
For more information

If there are any questions or comments about this advisory, please email security@electronjs.org

Severity

  • CVSS Score: 7.5 / 10 (High)
  • Vector String: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

Electron: Use-after-free in download save dialog callback

CVE-2026-34772 / GHSA-9w97-2464-8783

More information

Details

Impact

Apps that allow downloads and programmatically destroy sessions may be vulnerable to a use-after-free. If a session is torn down while a native save-file dialog is open for a download, dismissing the dialog dereferences freed memory, which may lead to a crash or memory corruption.

Apps that do not destroy sessions at runtime, or that do not permit downloads, are not affected.

Workarounds

Avoid destroying sessions while a download save dialog may be open. Cancel pending downloads before session teardown.

Fixed Versions
  • 41.0.0-beta.7
  • 40.7.0
  • 39.8.0
  • 38.8.6
For more information

If there are any questions or comments about this advisory, please email security@electronjs.org

Severity

  • CVSS Score: 5.8 / 10 (Medium)
  • Vector String: CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:L/A:L

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

Electron: Registry key path injection in app.setAsDefaultProtocolClient on Windows

CVE-2026-34773 / GHSA-mwmh-mq4g-g6gr

More information

Details

Impact

On Windows, app.setAsDefaultProtocolClient(protocol) did not validate the protocol name before writing to the registry. Apps that pass untrusted input as the protocol name may allow an attacker to write to arbitrary subkeys under HKCU\Software\Classes\, potentially hijacking existing protocol handlers.

Apps are only affected if they call app.setAsDefaultProtocolClient() with a protocol name derived from external or untrusted input. Apps that use a hardcoded protocol name are not affected.

Workarounds

Validate the protocol name matches /^[a-zA-Z][a-zA-Z0-9+.-]*$/ before passing it to app.setAsDefaultProtocolClient().

Fixed Versions
  • 41.0.0
  • 40.8.1
  • 39.8.1
  • 38.8.6
For more information

If there are any questions or comments about this advisory, please email security@electronjs.org

Severity

  • CVSS Score: 4.7 / 10 (Medium)
  • Vector String: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

Electron: Use-after-free in offscreen child window paint callback

CVE-2026-34774 / GHSA-532v-xpq5-8h95

More information

Details

Impact

Apps that use offscreen rendering and allow child windows via window.open() may be vulnerable to a use-after-free. If the parent offscreen WebContents is destroyed while a child window remains open, subsequent paint frames on the child dereference freed memory, which may lead to a crash or memory corruption.

Apps are only affected if they use offscreen rendering (webPreferences.offscreen: true) and their setWindowOpenHandler permits child windows. Apps that do not use offscreen rendering, or that deny child windows, are not affected.

Workarounds

Deny child window creation from offscreen renderers in your setWindowOpenHandler, or ensure child windows are closed before the parent is destroyed.

Fixed Versions
  • 41.0.0
  • 40.7.0
  • 39.8.1
For more information

If there are any questions or comments about this advisory, please email security@electronjs.org

Severity

  • CVSS Score: 8.1 / 10 (High)
  • Vector String: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

Electron: nodeIntegrationInWorker not correctly scoped in shared renderer processes

CVE-2026-34775 / GHSA-xwr5-m59h-vwqr

More information

Details

Impact

The nodeIntegrationInWorker webPreference was not correctly scoped in all configurations. In certain process-sharing scenarios, workers spawned in frames configured with nodeIntegrationInWorker: false could still receive Node.js integration.

Apps are only affected if they enable nodeIntegrationInWorker. Apps that do not use nodeIntegrationInWorker are not affected.

Workarounds

Avoid enabling nodeIntegrationInWorker in apps that also open child windows or embed content with differing webPreferences.

Fixed Versions
  • 41.0.0
  • 40.8.4
  • 39.8.4
  • 38.8.6
For more information

If there are any questions or comments about this advisory, please email security@electronjs.org

Severity

  • CVSS Score: 6.8 / 10 (Medium)
  • Vector String: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

Electron: Out-of-bounds read in second-instance IPC on macOS and Linux

CVE-2026-34776 / GHSA-3c8v-cfp5-9885

More information

Details

Impact

On macOS and Linux, apps that call app.requestSingleInstanceLock() were vulnerable to an out-of-bounds heap read when parsing a crafted second-instance message. Leaked memory could be delivered to the app's second-instance event handler.

This issue is limited to processes running as the same user as the Electron app.

Apps that do not call app.requestSingleInstanceLock() are not affected. Windows is not affected by this issue.

Workarounds

There are no app side workarounds, developers must update to a patched version of Electron.

Fixed Versions
  • 41.0.0
  • 40.8.1
  • 39.8.1
  • 38.8.6
For more information

If there are any questions or comments about this advisory, please email security@electronjs.org

Severity

  • CVSS Score: 5.3 / 10 (Medium)
  • Vector String: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:L

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

Electron: Incorrect origin passed to permission request handler for iframe requests

CVE-2026-34777 / GHSA-r5p7-gp4j-qhrx

More information

Details

Impact

When an iframe requests fullscreen, pointerLock, keyboardLock, openExternal, or media permissions, the origin passed to session.setPermissionRequestHandler() was the top-level page's origin rather than the requesting iframe's origin. Apps that grant permissions based on the origin parameter or webContents.getURL() may inadvertently grant permissions to embedded third-party content.

The correct requesting URL remains available via details.requestingUrl. Apps that already check details.requestingUrl are not affected.

Workarounds

In your setPermissionRequestHandler, inspect details.requestingUrl rather than the origin parameter or webContents.getURL() when deciding whether to grant fullscreen, pointerLock, keyboardLock, openExternal, or media permissions.

Fixed Versions
  • 41.0.0
  • 40.8.1
  • 39.8.1
  • 38.8.6
For more information

If there are any questions or comments about this advisory, please email security@electronjs.org

Severity

  • CVSS Score: 5.4 / 10 (Medium)
  • Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

Electron: Service worker can spoof executeJavaScript IPC replies

CVE-2026-34778 / GHSA-xj5x-m3f3-5x3h

More information

Details

Impact

A service worker running in a session could spoof reply messages on the internal IPC channel used by webContents.executeJavaScript() and related methods, causing the main-process promise to resolve with attacker-controlled data.

Apps are only affected if they have service workers registered and use the result of webContents.executeJavaScript() (or webFrameMain.executeJavaScript()) in security-sensitive decisions.

Workarounds

Do not trust the return value of webContents.executeJavaScript() for security decisions. Use dedicated, validated IPC channels for security-relevant communication with renderers.

Fixed Versions
  • 41.0.0
  • 40.8.1
  • 39.8.1
  • 38.8.6
For more information

If there are any questions or comments about this advisory, please email security@electronjs.org

Severity

  • CVSS Score: 5.9 / 10 (Medium)
  • Vector String: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:H/A:N

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

Electron: AppleScript injection in app.moveToApplicationsFolder on macOS

CVE-2026-34779 / GHSA-5rqw-r77c-jp79

More information

Details

Impact

On macOS, app.moveToApplicationsFolder() used an AppleScript fallback path that did not properly handle certain characters in the application bundle path. Under specific conditions, a crafted launch path could lead to arbitrary AppleScript execution when the user accepted the move-to-Applications prompt.

Apps are only affected if they call app.moveToApplicationsFolder(). Apps that do not use this API are not affected.

Workarounds

There are no app side workarounds, developers must update to a patched version of Electron.

Fixed Versions
  • 41.0.0-beta.8
  • 40.8.0
  • 39.8.1
  • 38.8.6
For more information

If there are any questions or comments about this advisory, please email security@electronjs.org

Severity

  • CVSS Score: 6.5 / 10 (Medium)
  • Vector String: CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:L

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

Electron: Context Isolation bypass via contextBridge VideoFrame transfer

CVE-2026-34780 / GHSA-jfqg-hf23-qpw2

More information

Details

Impact

Apps that pass VideoFrame objects (from the WebCodecs API) across the contextBridge are vulnerable to a context isolation bypass. An attacker who can execute JavaScript in the main world (for example, via XSS) can use a bridged VideoFrame to gain access to the isolated world, including any Node.js APIs exposed to the preload script.

Apps are only affected if a preload script returns, resolves, or passes a VideoFrame object to the main world via contextBridge.exposeInMainWorld(). Apps that do not bridge VideoFrame objects are not affected.

Workarounds

Do not pass VideoFrame objects across contextBridge. If an app needs to transfer video frame data, serialize it to an ArrayBuffer or ImageBitmap before bridging.

Fixed Versions
  • 41.0.0-beta.8
  • 40.7.0
  • 39.8.0
For more information

If there are any questions or comments about this advisory, please email security@electronjs.org

Severity

  • CVSS Score: 8.3 / 10 (High)
  • Vector String: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

Electron: Use-after-free in offscreen shared texture release() callback

CVE-2026-34764 / GHSA-8x5q-pvf5-64mp

More information

Details

Impact

Apps that use offscreen rendering with GPU shared textures may be vulnerable to a use-after-free. Under certain conditions, the release() callback provided on a paint event texture can outlive its backing native state, and invoking it after that point dereferences freed memory in the main process, which may lead to a crash or memory corruption.

Apps are only affected if they use offscreen rendering with webPreferences.offscreen: { useSharedTexture: true }. Apps that do not enable shared-texture offscreen rendering are not affected.

Workarounds

Ensure texture.release() is called promptly after the texture has been consumed, before the texture object becomes unreachable.

Fixed Versions
  • 42.0.0-alpha.5
  • 41.1.0
  • 40.8.5
  • 39.8.5
For more information

If there are any questions or comments about this advisory, send an email to security@electronjs.org

Severity

  • CVSS Score: 2.3 / 10 (Low)
  • Vector String: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:L

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

Electron: Crash in clipboard.readImage() on malformed clipboard image data

CVE-2026-34781 / GHSA-f37v-82c4-4x64

More information

Details

Impact

Apps that call clipboard.readImage() may be vulnerable to a denial of service. If the system clipboard contains image data that fails to decode, the resulting null bitmap is passed unchecked to image construction, triggering a controlled abort and crashing the process.

Apps are only affected if they call clipboard.readImage(). Apps that do not read images from the clipboard are not affected. This issue does not allow memory corruption or code execution.

Workarounds

Validate that the clipboard contains image data via clipboard.availableFormats() before calling clipboard.readImage(). Note this only narrows the window — upgrading to a fixed version is recommended.

Fixed Versions
  • 42.0.0-alpha.5
  • 41.1.0
  • 40.8.5
  • 39.8.5
For more information

If you have any questions or comments about this advisory, email us at security@electronjs.org

Severity

  • CVSS Score: 2.8 / 10 (Low)
  • Vector String: CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:L

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

Electron: Parent process code-sign check is spoofable

CVE-2026-70597 / GHSA-jm7p-cc5g-qwxx

More information

Details

Impact

On macOS, the check Electron uses to confirm it was launched by a same-signed parent process could be bypassed by a local process. Apps that enable the fuse-based hardening restricting ELECTRON_RUN_AS_NODE and NODE_OPTIONS to same-signed parents rely on this check; a local attacker could bypass it and run their own code inside the signed app, inheriting its TCC permissions and keychain access.

Apps are only affected if they enable those macOS fuse-based restrictions. Apps that do not enable them are not affected.

Workarounds

There are no app side workarounds, you must update to a patched version of Electron.

Fixed Versions
  • 42.0.0-beta.3
  • 41.2.1
  • 40.9.0
  • 39.8.8
For more information

If you have any questions or comments about this advisory, email us at security@electronjs.org

Severity

  • CVSS Score: 6.3 / 10 (Medium)
  • Vector String: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

Electron: Off-screen rendering trusts GPU-supplied geometry over shared-memory size

CVE-2026-70598 / GHSA-pfmc-3mgc-p6fp

More information

Details

Impact

In offscreen rendering mode, frame data received from the GPU process was not fully validated by the main process. A compromised GPU process could cause the main process to read out-of-bounds memory while producing paint event images, disclosing memory or crashing the app.

Apps are only affected if they use offscreen rendering (webPreferences.offscreen) and an attacker has separately gained code execution in the GPU process. Apps that do not use offscreen rendering are not affected.

Workarounds

There are no app side workarounds, you must update to a patched version of Electron.

Fixed Versions
  • 42.0.0-beta.3
  • 41.2.1
  • 40.9.0
  • 39.8.10
For more information

If you have any questions or comments about this advisory, email us at security@electronjs.org

Severity

  • CVSS Score: 3.9 / 10 (Low)
  • Vector String: CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:L/I:N/A:L

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

Electron: Permission Check Handler Receives Main Frame Origin Instead of Requesting Iframe Origin

CVE-2026-70599 / GHSA-9pf5-hg6p-4pwp

More information

Details

Impact

For serial-port and media (camera / microphone) permission checks made from an iframe, the requestingOrigin passed to session.setPermissionCheckHandler was the top-level frame's origin rather than the requesting frame's. Origin-based handler logic could therefore grant a cross-origin iframe device access intended only for the top-level origin.

Apps are only affected if they use setPermissionCheckHandler with origin-based logic and embed cross-origin iframes with delegated device permissions. Apps that base the decision on details.securityOrigin, or that do not embed such iframes, are not affected.

Workarounds

Check details.securityOrigin instead of requestingOrigin for these permissions, or do not delegate device permissions to untrusted iframes.

Fixed Versions
  • 42.0.0-beta.1
  • 41.2.0
  • 40.9.0
  • 39.8.7
For more information

If you have any questions or comments about this advisory, email Electron at security@electronjs.org

Severity

  • CVSS Score: 5.9 / 10 (Medium)
  • Vector String: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

Electron: Cross-origin iframe can position native autofill popup

CVE-2026-70600 / GHSA-x8rc-wpg4-grpf

More information

Details

Impact

The native autofill popup could be positioned by a cross-origin iframe outside that iframe's bounds, over the embedding page's UI, enabling clickjacking or spoofing of trusted UI.

Apps are only affected if they embed untrusted content in iframes within windows that also display trusted UI. Apps that do not embed untrusted third-party content are not affected.

Workarounds

Do not embed untrusted content in iframes inside windows that display trusted UI.

Fixed Versions
  • 42.0.0-beta.3
  • 41.2.1
  • 40.9.0
  • 39.8.8
For more information

If you have any questions or comments about this advisory, email Electron at security@electronjs.org

Severity

  • CVSS Score: 3.1 / 10 (Low)
  • Vector String: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

Electron: Context isolation bypass via Function.prototype.bind hijack

CVE-2026-70601 / GHSA-h7rp-cf8h-j98x

More information

Details

Impact

Apps that expose Promise-returning functions to web content via contextBridge may be vulnerable to a context isolation bypass. Untrusted web content could obtain access to the isolated preload world and, through it, every capability the preload script has. In renderers without a sandbox, or with nodeIntegration enabled, this may escalate to Node.js access.

Apps are affected if they expose Promise-returning functions via contextBridge — the standard pattern for wrapping ipcRenderer.invoke — in windows that load untrusted content. Apps that never load untrusted content in those windows are not affected.

Workarounds

There are no app side workarounds, you must update to a patched version of Electron.

Fixed Versions
  • 42.0.0-beta.5
  • 41.2.2
  • 40.9.2
  • 39.8.9
For more information

If you have any questions or comments about this advisory, email Electron at security@electronjs.org

Severity

  • CVSS Score: 7.5 / 10 (High)
  • Vector String: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:L/A:N

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

Electron: shell.openPath path validation bypass via embedded null byte

CVE-2026-70603 / GHSA-5c9j-mhmv-5xgx

More information

Details

Impact

shell.openPath() did not reject paths containing embedded null bytes. Apps that perform string-only validation of file paths (for example, checking the file extension) before passing them to shell.openPath() could be bypassed, allowing an attacker-controlled path to open a different file than the one that passed validation.

Apps are only affected if they pass paths derived from untrusted input to shell.openPath() and rely on string-based validation without a filesystem check. Node's fs APIs already reject paths containing null bytes, so apps that call fs.existsSync(), fs.stat(), or similar before shell.openPath() are not affected. Apps that do not call shell.openPath() with untrusted input are not affected.

Workarounds

Reject any path containing a null byte before passing it to shell.openPath():

if (filePath.includes('\0')) throw new Error('invalid path');
Fixed Versions
  • 42.0.0-beta.1
  • 41.1.1
  • 40.9.0
  • 39.8.6
For more information

If you have any questions or comments about this advisory, email us at security@electronjs.org

Severity

  • CVSS Score: 6.0 / 10 (Medium)
  • Vector String: CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:N

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

Electron: Extension tab APIs operate across session boundaries

CVE-2026-70602 / GHSA-m55f-7gqj-fr98

More information

Details

Impact

Extension tab and scripting APIs were not scoped to the extension's own session. A malicious or compromised extension loaded into one session could navigate, script, and read from windows belonging to a different session.

Apps are only affected if they load Chrome extensions via session.loadExtension and rely on separate sessions to isolate that extension from other content. Apps that do not load extensions, or that use a single session, are not affected.

Workarounds

Only load extensions from sources you trust; do not rely on session separation alone to contain an extension.

Fixed Versions
  • 42.0.0-beta.3
  • 41.2.1
  • 40.9.0
  • 39.8.8
For more information

If you have any questions or comments about this advisory, email Electron at security@electronjs.org

Severity

  • CVSS Score: 6.6 / 10 (Medium)
  • Vector String: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:L/A:N

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

Electron: Custom protocol with supportFetchAPI but not corsEnabled allows cross-origin reads

CVE-2026-70604 / GHSA-v3j7-r9gq-3gjw

More information

Details

Impact

A custom scheme registered with supportFetchAPI: true but without corsEnabled: true was not subject to CORS enforcement. A page loaded from a remote origin could therefore fetch() or XMLHttpRequest that scheme cross-origin and read the full response body, rather than the read being blocked.

Apps that serve sensitive data from such a scheme and load remote or untrusted content in a renderer are affected. Apps that set corsEnabled: true, or that do not load untrusted content, are not affected.

Workarounds

Set corsEnabled: true on schemes that must enforce CORS, and validate the request Origin in your protocol handler before returning sensitive data.

Fixed Versions
  • 42.0.0
  • 41.4.0
  • 40.9.3
  • 39.8.10
For more information

If you have any questions or comments about this advisory, email Electron at security@electronjs.org

Severity

  • CVSS Score: 7.4 / 10 (High)
  • Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

Electron: HTTP redirect followed into local file loader

CVE-2026-70605 / GHSA-v64r-4m7r-3mvq

More information

Details

Impact

When following HTTP redirects, net.fetch() and net.request() did not restrict which schemes a redirect could target. A remote server could redirect a request to a local resource, and if the app returns or forwards the response body, local file contents could be disclosed.

Apps are only affected if they make net requests to attacker-influenced URLs with redirects followed (the default) and expose the response body. Apps that only request fixed, trusted URLs are not affected.

Workarounds

Set redirect: 'error' or redirect: 'manual' on requests to untrusted URLs and validate any redirect target before following it.

Fixed Versions
  • 42.0.0-beta.3
  • 41.2.1
  • 40.9.0
  • 39.8.8
For more information

If you have any questions or comments about this advisory, email Electron at security@electronjs.org

Severity

  • CVSS Score: 5.9 / 10 (Medium)
  • Vector String: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

Electron: window.open features string controls some window options considered privileged

CVE-2026-70607 / GHSA-v93f-fgjr-hjrj

More information

Details

Impact

Some window options supplied by web content in the window.open() features string were applied to the new BrowserWindow without an allowlist. Untrusted content could set window options it should not control, including options that cause the main process to access attacker-chosen file or network paths.

Apps are only affected if untrusted content can call window.open() and the app does not override child window options via setWindowOpenHandler. Apps that deny window.open() for untrusted content, or set overrideBrowserWindowOptions explicitly, are not affected.

Workarounds

Return { action: 'deny' } from setWindowOpenHandler for untrusted content, or supply overrideBrowserWindowOptions so every window option is set explicitly.

Fixed Versions
  • 42.0.0-beta.3
  • 41.2.1
  • 40.9.0
  • 39.8.8
For more information

If you have any questions or comments about this advisory, email Electron at security@electronjs.org

Severity

  • CVSS Score: 5.3 / 10 (Medium)
  • Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

Electron: Sandboxed iframe can bypass the allow-popups restriction via the OpenURL navigation path

CVE-2026-70608 / GHSA-9f4c-93c8-jc8g

More information

Details

Impact

A sandboxed iframe without the allow-popups keyword could still open a new window (or trigger setWindowOpenHandler) with no user interaction, because new-window navigations taking the OpenURL path did not apply the iframe sandbox popup restriction.

Apps that embed untrusted content in sandboxed iframes and rely on the absence of allow-popups to prevent window creation are affected. Apps that deny window creation in setWindowOpenHandler, or that do not embed untrusted content in sandboxed iframes, are not affected.

Workarounds

Return { action: 'deny' } from setWindowOpenHandler for any content you do not trust, rather than relying on the iframe sandbox alone.

Fixed Versions
  • 42.0.1
  • 41.10.3
  • 39.8.10
For more information

If you have any questions or comments about this advisory, email Electron at security@electronjs.org

Severity

  • CVSS Score: 7.2 / 10 (High)
  • Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

References

✂ Note

PR body was truncated to here.

@renovate renovate Bot added dependencies Pull requests that update a dependency file desktop labels Aug 6, 2026
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file desktop

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants