Update dependency electron to v39 [SECURITY]

[renovate]

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Change	Age	Confidence
electron	12.0.2 → 39.8.5

---

Electron's sandboxed renderers can obtain thumbnails of arbitrary files through the nativeImage API

CVE-2021-39184 / GHSA-mpjm-v997-c4h4

More information

Details

Impact

This vulnerability allows a sandboxed renderer to request a "thumbnail" image of an arbitrary file on the user's system. The thumbnail can potentially include significant parts of the original file, including textual data in many cases.

All current stable versions of Electron are affected.

Patches

This was fixed with #​30728, and the following Electron versions contain the fix:

• 15.0.0-alpha.10
• 14.0.0
• 13.3.0
• 12.1.0
• 11.5.0

Workarounds

If your app enables contextIsolation, this vulnerability is significantly more difficult for an attacker to exploit.

Further, if your app does not depend on the createThumbnailFromPath API, then you can simply disable the functionality. In the main process, before the 'ready' event:

delete require('electron').nativeImage.createThumbnailFromPath

For more information

If you have any questions or comments about this advisory, email us at security@electronjs.org.

Severity

• CVSS Score: 6.8 / 10 (Medium)
• Vector String: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N

References

• https://github.com/electron/electron/security/advisories/GHSA-mpjm-v997-c4h4
• https://github.com/electron/electron/pull/30728
• https://nvd.nist.gov/vuln/detail/CVE-2021-39184
• https://github.com/electron/electron/pull/30728/commits/8fed645bd671f359ee52d806c075ec4e07eda17f
• https://github.com/advisories/GHSA-mpjm-v997-c4h4

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Renderers can obtain access to random bluetooth device without permission in Electron

CVE-2022-21718 / GHSA-3p22-ghq8-v749

More information

Details

Impact

This vulnerability allows renderers to obtain access to a random bluetooth device via the web bluetooth API if the app has not configured a custom select-bluetooth-device event handler. The device that is accessed is random and the attacker would have no way of selecting a specific device.

All current stable versions of Electron are affected.

Patches

This has been patched and the following Electron versions contain the fix:

• 17.0.0-alpha.6
• 16.0.6
• 15.3.5
• 14.2.4
• 13.6.6

Workarounds

Adding this code to your app can workaround the issue.

app.on('web-contents-created', (event, webContents) => {
  webContents.on('select-bluetooth-device', (event, devices, callback) => {
    // Prevent default behavior
    event.preventDefault();
    // Cancel the request
    callback('');
  });
});

For more information
If you have any questions or comments about this advisory, email us at security@electronjs.org.

Severity

• CVSS Score: 3.4 / 10 (Low)
• Vector String: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:N/A:N

References

• https://github.com/electron/electron/security/advisories/GHSA-3p22-ghq8-v749
• https://nvd.nist.gov/vuln/detail/CVE-2022-21718
• https://github.com/electron/electron/pull/32178
• https://github.com/electron/electron/pull/32240
• https://github.com/advisories/GHSA-3p22-ghq8-v749

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Compromised child renderer processes could obtain IPC access without nodeIntegrationInSubFrames being enabled

CVE-2022-29247 / GHSA-mq8j-3h7h-p8g7

More information

Details

Impact

This vulnerability allows a renderer with JS execution to obtain access to a new renderer process with nodeIntegrationInSubFrames enabled which in turn allows effective access to ipcRenderer.

Please note the misleadingly named nodeIntegrationInSubFrames option does not implicitly grant Node.js access rather it depends on the existing sandbox setting. If your application is sandboxed then nodeIntegrationInSubFrames just gives access to the sandboxed renderer APIs (which includes ipcRenderer).

If your application then additionally exposes IPC messages without IPC senderFrame validation that perform privileged actions or return confidential data this access to ipcRenderer can in turn compromise your application / user even with the sandbox enabled.

Patches

This has been patched and the following Electron versions contain the fix:

• 18.0.0-beta.6
• 17.2.0
• 16.2.6
• 15.5.5

Workarounds

Ensure that all IPC message handlers appropriately validate senderFrame as per our security tutorial here.

For more information

If you have any questions or comments about this advisory, email us at security@electronjs.org.

Severity

• CVSS Score: 2.2 / 10 (Low)
• Vector String: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:N/A:N

References

• https://github.com/electron/electron/security/advisories/GHSA-mq8j-3h7h-p8g7
• https://nvd.nist.gov/vuln/detail/CVE-2022-29247
• https://github.com/advisories/GHSA-mq8j-3h7h-p8g7

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

AutoUpdater module fails to validate certain nested components of the bundle

CVE-2022-29257 / GHSA-77xc-hjv8-ww97

More information

Details

Impact

This vulnerability allows attackers who have control over a given apps update server / update storage to serve maliciously crafted update packages that pass the code signing validation check but contain malicious code in some components.

Please note that this kind of attack would require significant privileges in your own auto updating infrastructure and the ease of that attack entirely depends on your infrastructure security.

Patches

This has been patched and the following Electron versions contain the fix:

• 18.0.0-beta.6
• 17.2.0
• 16.2.0
• 15.5.0

Workarounds

There are no workarounds for this issue, please update to a patched version of Electron.

For more information

If you have any questions or comments about this advisory, email us at security@electronjs.org

Severity

• CVSS Score: 6.6 / 10 (Medium)
• Vector String: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H

References

• https://github.com/electron/electron/security/advisories/GHSA-77xc-hjv8-ww97
• https://nvd.nist.gov/vuln/detail/CVE-2022-29257
• https://github.com/advisories/GHSA-77xc-hjv8-ww97

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Exfiltration of hashed SMB credentials on Windows via file:// redirect

CVE-2022-36077 / GHSA-p2jh-44qj-pf2v

More information

Details

Impact

When following a redirect, Electron delays a check for redirecting to file:// URLs from other schemes. The contents of the file is not available to the renderer following the redirect, but if the redirect target is a SMB URL such as file://some.website.com/, then in some cases, Windows will connect to that server and attempt NTLM authentication, which can include sending hashed credentials.

Patches

This issue has been fixed in all current stable versions of Electron. Specifically, these versions contain the fixes:

• 21.0.0-beta.1
• 20.0.1
• 19.0.11
• 18.3.7

We recommend all apps upgrade to the latest stable version of Electron.

Workarounds

If upgrading isn't possible, this issue can be addressed without upgrading by preventing redirects to file:// URLs in the WebContents.on('will-redirect') event, for all WebContents:

app.on('web-contents-created', (e, webContents) => {
  webContents.on('will-redirect', (e, url) => {
    if (/^file:/.test(url)) e.preventDefault()
  })
})

For more information

If you have any questions or comments about this advisory, email us at security@electronjs.org.

Credit

Thanks to user @​coolcoolnoworries for reporting this issue.

Severity

• CVSS Score: 5.4 / 10 (Medium)
• Vector String: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:N/A:L

References

• https://github.com/electron/electron/security/advisories/GHSA-p2jh-44qj-pf2v
• https://nvd.nist.gov/vuln/detail/CVE-2022-36077
• https://github.com/advisories/GHSA-p2jh-44qj-pf2v

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Electron vulnerable to out-of-package code execution when launched with arbitrary cwd

CVE-2023-39956 / GHSA-7x97-j373-85x5

More information

Details

Impact

Apps that are launched as command line executables are impacted. E.g. if your app exposes itself in the path as myapp --help

Specifically this issue can only be exploited if the following conditions are met:

• Your app is launched with an attacker-controlled working directory
• The attacker has the ability to write files to that working directory

This makes the risk quite low, in fact normally issues of this kind are considered outside of our threat model as similar to Chromium we exclude Physically Local Attacks but given the ability for this issue to bypass certain protections like ASAR Integrity it is being treated with higher importance. Please bear this in mind when reporting similar issues in the future.

Workarounds

There are no app side workarounds, you must update to a patched version of Electron.

Fixed Versions

• 26.0.0-beta.13
• 25.5.0
• 24.7.1
• 23.3.13
• 22.3.19

For more information

If you have any questions or comments about this advisory, email us at security@electronjs.org

Severity

• CVSS Score: 6.1 / 10 (Medium)
• Vector String: CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:H/A:L

References

• https://github.com/electron/electron/security/advisories/GHSA-7x97-j373-85x5
• https://nvd.nist.gov/vuln/detail/CVE-2023-39956
• https://github.com/advisories/GHSA-7x97-j373-85x5

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Electron affected by libvpx's heap buffer overflow in vp8 encoding

CVE-2023-5217 / GHSA-qqvq-6xgj-jw8g

More information

Details

Heap buffer overflow in vp8 encoding in libvpx in Google Chrome prior to 117.0.5938.132 and libvpx 1.13.1 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.

Severity

• CVSS Score: 8.8 / 10 (High)
• Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

References

• https://nvd.nist.gov/vuln/detail/CVE-2023-5217
• https://chromereleases.googleblog.com/2023/09/stable-channel-update-for-desktop_27.html
• https://crbug.com/1486441
• http://www.openwall.com/lists/oss-security/2023/09/28/5
• http://www.openwall.com/lists/oss-security/2023/09/28/6
• http://www.openwall.com/lists/oss-security/2023/09/29/1
• http://www.openwall.com/lists/oss-security/2023/09/29/2
• https://github.com/electron/electron/pull/40022
• https://github.com/electron/electron/pull/40023
• https://github.com/electron/electron/pull/40024
• https://github.com/electron/electron/pull/40025
• https://github.com/electron/electron/pull/40026
• https://github.com/webmproject/libvpx/commit/3fbd1dca6a4d2dad332a2110d646e4ffef36d590
• https://github.com/webmproject/libvpx/commit/af6dedd715f4307669366944cca6e0417b290282
• https://bugzilla.redhat.com/show_bug.cgi?id=2241191
• https://github.com/electron/electron/releases/tag/v22.3.25
• https://github.com/electron/electron/releases/tag/v24.8.5
• https://github.com/electron/electron/releases/tag/v25.8.4
• https://github.com/electron/electron/releases/tag/v26.2.4
• https://github.com/electron/electron/releases/tag/v27.0.0-beta.8
• https://github.com/webmproject/libvpx/releases/tag/v1.13.1
• https://github.com/webmproject/libvpx/tags
• https://lists.debian.org/debian-lts-announce/2023/09/msg00038.html
• https://lists.debian.org/debian-lts-announce/2023/10/msg00001.html
• https://pastebin.com/TdkC4pDv
• https://security-tracker.debian.org/tracker/CVE-2023-5217
• https://security.gentoo.org/glsa/202310-04
• https://twitter.com/maddiestone/status/1707163313711497266
• https://www.debian.org/security/2023/dsa-5508
• https://www.debian.org/security/2023/dsa-5509
• https://www.debian.org/security/2023/dsa-5510
• https://www.openwall.com/lists/oss-security/2023/09/28/5
• http://www.openwall.com/lists/oss-security/2023/09/29/11
• http://www.openwall.com/lists/oss-security/2023/09/29/12
• http://www.openwall.com/lists/oss-security/2023/09/29/14
• http://www.openwall.com/lists/oss-security/2023/09/29/7
• http://www.openwall.com/lists/oss-security/2023/09/29/9
• http://www.openwall.com/lists/oss-security/2023/09/30/1
• http://www.openwall.com/lists/oss-security/2023/09/30/2
• http://www.openwall.com/lists/oss-security/2023/09/30/3
• http://www.openwall.com/lists/oss-security/2023/09/30/4
• http://www.openwall.com/lists/oss-security/2023/09/30/5
• http://www.openwall.com/lists/oss-security/2023/10/01/1
• http://www.openwall.com/lists/oss-security/2023/10/01/2
• http://www.openwall.com/lists/oss-security/2023/10/01/5
• http://www.openwall.com/lists/oss-security/2023/10/02/6
• http://www.openwall.com/lists/oss-security/2023/10/03/11
• http://seclists.org/fulldisclosure/2023/Oct/12
• https://lists.debian.org/debian-lts-announce/2023/10/msg00015.html
• http://seclists.org/fulldisclosure/2023/Oct/16
• https://support.apple.com/kb/HT213961
• https://support.apple.com/kb/HT213972
• https://security.gentoo.org/glsa/202401-34
• https://arstechnica.com/security/2023/09/new-0-day-in-chrome-and-firefox-is-likely-to-plague-other-software
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4MFWDFJSSIFKWKNOCTQCFUNZWAXUCSS4
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/55YVCZNAVY3Y5E4DWPWMX2SPKZ2E5SOV
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/AY642Z6JZODQJE7Z62CFREVUHEGCXGPD
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BCVSHVX2RFBU3RMCUFSATVQEJUFD4Q63
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/CWEJYS5NC7KVFYU3OAMPKQDYN6JQGVK6
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TE7F54W5O5RS4ZMAAC7YK3CZWQXIDSKB
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WTRUIS3564P7ZLM2S2IH4Y4KZ327LI4I
• https://stackdiary.com/google-discloses-a-webm-vp8-bug-tracked-as-cve-2023-5217
• https://www.mozilla.org/en-US/security/advisories/mfsa2023-44
• https://github.com/advisories/GHSA-qqvq-6xgj-jw8g

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

ASAR Integrity bypass via filetype confusion in electron

CVE-2023-44402 / GHSA-7m48-wc93-9g85

More information

Details

Impact

This only impacts apps that have the embeddedAsarIntegrityValidation and onlyLoadAppFromAsar fuses enabled. Apps without these fuses enabled are not impacted. This issue is specific to macOS as these fuses are only currently supported on macOS.

Specifically this issue can only be exploited if your app is launched from a filesystem the attacker has write access too. i.e. the ability to edit files inside the resources folder in your app installation on Windows which these fuses are supposed to protect against.

Workarounds

There are no app side workarounds, you must update to a patched version of Electron.

Fixed Versions

• 27.0.0-alpha.7
• 26.2.1
• 25.8.1
• 24.8.3
• 22.3.24

For more information

If you have any questions or comments about this advisory, email us at security@electronjs.org

Severity

• CVSS Score: 6.1 / 10 (Medium)
• Vector String: CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:H/A:L

References

• https://github.com/electron/electron/security/advisories/GHSA-7m48-wc93-9g85
• https://nvd.nist.gov/vuln/detail/CVE-2023-44402
• https://github.com/electron/electron/pull/39788
• https://www.electronjs.org/docs/latest/tutorial/fuses
• https://github.com/advisories/GHSA-7m48-wc93-9g85

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Electron vulnerable to Heap Buffer Overflow in NativeImage

CVE-2024-46993 / GHSA-6r2x-8pq8-9489

More information

Details

Impact

The nativeImage.createFromPath() and nativeImage.createFromBuffer() functions call a function downstream that is vulnerable to a heap buffer overflow. An Electron program that uses either of the affected functions is vulnerable to a buffer overflow if an attacker is in control of the image's height, width, and contents.

Workaround

There are no app-side workarounds for this issue. You must update your Electron version to be protected.

Patches

• v28.3.2
• v29.3.3
• v30.0.3

For More Information

If you have any questions or comments about this advisory, email us at security@electronjs.org.

Severity

• CVSS Score: 4.4 / 10 (Medium)
• Vector String: CVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U

References

• https://github.com/electron/electron/security/advisories/GHSA-6r2x-8pq8-9489
• https://nvd.nist.gov/vuln/detail/CVE-2024-46993
• https://github.com/advisories/GHSA-6r2x-8pq8-9489

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Electron has ASAR Integrity Bypass via resource modification

CVE-2025-55305 / GHSA-vmqv-hx8q-j7mg

More information

Details

Impact

This only impacts apps that have the embeddedAsarIntegrityValidation and onlyLoadAppFromAsar fuses enabled. Apps without these fuses enabled are not impacted.

Specifically this issue can only be exploited if your app is launched from a filesystem the attacker has write access too. i.e. the ability to edit files inside the resources folder in your app installation on Windows which these fuses are supposed to protect against.

Workarounds

There are no app side workarounds, you must update to a patched version of Electron.

Fixed Versions

• 38.0.0-beta.6
• 37.3.1
• 36.8.1
• 35.7.5

For more information

If you have any questions or comments about this advisory, email us at security@electronjs.org

Severity

• CVSS Score: 6.1 / 10 (Medium)
• Vector String: CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:H/A:L

References

• https://github.com/electron/electron/security/advisories/GHSA-vmqv-hx8q-j7mg
• https://github.com/electron/electron/pull/48101
• https://github.com/electron/electron/pull/48102
• https://github.com/electron/electron/pull/48103
• https://github.com/electron/electron/pull/48104
• https://github.com/electron/electron/commit/23a02934510fcf951428e14573d9b2d2a3c4f28b
• https://github.com/electron/electron/commit/2e5a0b7220ebf955c6785cc5adb2e2b1cf77dac1
• https://github.com/electron/electron/commit/3f92511cdecc39f46b0e86cce40a0c691e301c9d
• https://github.com/electron/electron/commit/fdf29ce83870109d403f5c23ae529dbd0e8f4fee
• https://nvd.nist.gov/vuln/detail/CVE-2025-55305
• https://github.com/advisories/GHSA-vmqv-hx8q-j7mg

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Electron: HTTP Response Header Injection in custom protocol handlers and webRequest

CVE-2026-34767 / GHSA-4p4r-m79c-wq3v

More information

Details

Impact

Apps that register custom protocol handlers via protocol.handle() / protocol.registerSchemesAsPrivileged() or modify response headers via webRequest.onHeadersReceived may be vulnerable to HTTP response header injection if attacker-controlled input is reflected into a response header name or value.

An attacker who can influence a header value may be able to inject additional response headers, affecting cookies, content security policy, or cross-origin access controls.

Apps that do not reflect external input into response headers are not affected.

Workarounds

Validate or sanitize any untrusted input before including it in a response header name or value.

Fixed Versions

• 41.0.3
• 40.8.3
• 39.8.3
• 38.8.6

For more information

If there are any questions or comments about this advisory, send an email to security@electronjs.org

Severity

• CVSS Score: 5.9 / 10 (Medium)
• Vector String: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:H/A:N

References

• https://github.com/electron/electron/security/advisories/GHSA-4p4r-m79c-wq3v
• https://nvd.nist.gov/vuln/detail/CVE-2026-34767
• https://github.com/advisories/GHSA-4p4r-m79c-wq3v

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Electron: USB device selection not validated against filtered device list

CVE-2026-34766 / GHSA-9899-m83m-qhpj

More information

Details

Impact

The select-usb-device event callback did not validate the chosen device ID against the filtered list that was presented to the handler. An app whose handler could be influenced to select a device ID outside the filtered set would grant access to a device that did not match the renderer's requested filters or was listed in exclusionFilters.

The WebUSB security blocklist remained enforced regardless, so security-sensitive devices on the blocklist were not affected. The practical impact is limited to apps with unusual device-selection logic.

Workarounds

There are no app side workarounds, you must update to a patched version of Electron.

Fixed Versions

• 41.0.0-beta.8
• 40.7.0
• 39.8.0
• 38.8.6

For more information

If there are any questions or comments about this advisory, send an email to security@electronjs.org

Severity

• CVSS Score: 3.3 / 10 (Low)
• Vector String: CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:N

References

• https://github.com/electron/electron/security/advisories/GHSA-9899-m83m-qhpj
• https://nvd.nist.gov/vuln/detail/CVE-2026-34766
• https://github.com/advisories/GHSA-9899-m83m-qhpj

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Electron: Unquoted executable path in app.setLoginItemSettings on Windows

CVE-2026-34768 / GHSA-jfqx-fxh3-c62j

More information

Details

Impact

On Windows, app.setLoginItemSettings({openAtLogin: true}) wrote the executable path to the Run registry key without quoting. If the app is installed to a path containing spaces, an attacker with write access to an ancestor directory may be able to cause a different executable to run at login instead of the intended app.

On a default Windows install, standard system directories are protected against writes by standard users, so exploitation typically requires a non-standard install location.

Workarounds

Install the application to a path without spaces, or to a location where all ancestor directories are protected against unauthorized writes.

Fixed Versions

• 41.0.0-beta.8
• 40.8.0
• 39.8.1
• 38.8.6

For more information

If there are any questions or comments about this advisory, send an email to security@electronjs.org

Severity

• CVSS Score: 3.9 / 10 (Low)
• Vector String: CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:L

References

• https://github.com/electron/electron/security/advisories/GHSA-jfqx-fxh3-c62j
• https://nvd.nist.gov/vuln/detail/CVE-2026-34768
• https://github.com/advisories/GHSA-jfqx-fxh3-c62j

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Electron: Use-after-free in PowerMonitor on Windows and macOS

CVE-2026-34770 / GHSA-jjp3-mq3x-295m

More information

Details

Impact

Apps that use the powerMonitor module may be vulnerable to a use-after-free. After the native PowerMonitor object is garbage-collected, the associated OS-level resources (a message window on Windows, a shutdown handler on macOS) retain dangling references. A subsequent session-change event (Windows) or system shutdown (macOS) dereferences freed memory, which may lead to a crash or memory corruption.

All apps that access powerMonitor events (suspend, resume, lock-screen, etc.) are potentially affected. The issue is not directly renderer-controllable.

Workarounds

There are no app side workarounds, you must update to a patched version of Electron.

Fixed Versions

• 41.0.0-beta.8
• 40.8.0
• 39.8.1
• 38.8.6

For more information

If there are any questions or comments about this advisory, please email security@electronjs.org

Severity

• CVSS Score: 7.0 / 10 (High)
• Vector String: CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

References

• https://github.com/electron/electron/security/advisories/GHSA-jjp3-mq3x-295m
• https://nvd.nist.gov/vuln/detail/CVE-2026-34770
• https://github.com/advisories/GHSA-jjp3-mq3x-295m

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Electron: Renderer command-line switch injection via undocumented commandLineSwitches webPreference

CVE-2026-34769 / GHSA-9wfr-w7mm-pc7f

More information

Details

Impact

An undocumented commandLineSwitches webPreference allowed arbitrary switches to be appended to the renderer process command line. Apps that construct webPreferences by spreading untrusted configuration objects may inadvertently allow an attacker to inject switches that disable renderer sandboxing or web security controls.

Apps are only affected if they construct webPreferences from external or untrusted input without an allowlist. Apps that use a fixed, hardcoded webPreferences object are not affected.

Workarounds

Do not spread untrusted input into webPreferences. Use an explicit allowlist of permitted preference keys when constructing BrowserWindow or webContents options from external configuration.

Fixed Versions

• 41.0.0-beta.8
• 40.7.0
• 39.8.0
• 38.8.6

For more information

If there are any questions or comments about this advisory, send an email to security@electronjs.org

Severity

• CVSS Score: 7.8 / 10 (High)
• Vector String: CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

References

• https://github.com/electron/electron/security/advisories/GHSA-9wfr-w7mm-pc7f
• https://nvd.nist.gov/vuln/detail/CVE-2026-34769
• https://github.com/advisories/GHSA-9wfr-w7mm-pc7f

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Electron: Use-after-free in WebContents fullscreen, pointer-lock, and keyboard-lock permission callbacks

CVE-2026-34771 / GHSA-8337-3p73-46f4

More information

Details

Impact

Apps that register an asynchronous session.setPermissionRequestHandler() may be vulnerable to a use-after-free when handling fullscreen, pointer-lock, or keyboard-lock permission requests. If the requesting frame navigates or the window closes while the permission handler is pending, invoking the stored callback dereferences freed memory, which may lead to a crash or memory corruption.

Apps that do not set a permission request handler, or whose handler responds synchronously, are not affected.

Workarounds

Respond to permission requests synchronously, or deny fullscreen, pointer-lock, and keyboard-lock requests if an asynchronous flow is required.

Fixed Versions

• 41.0.0-beta.8
• 40.7.0
• 39.8.0
• 38.8.6

For more information

If there are any questions or comments about this advisory, please email security@electronjs.org

Severity

• CVSS Score: 7.5 / 10 (High)
• Vector String: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

References

• https://github.com/electron/electron/security/advisories/GHSA-8337-3p73-46f4
• https://nvd.nist.gov/vuln/detail/CVE-2026-34771
• https://github.com/advisories/GHSA-8337-3p73-46f4

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Electron: Use-after-free in download save dialog callback

CVE-2026-34772 / GHSA-9w97-2464-8783

More information

Details

Impact

Apps that allow downloads and programmatically destroy sessions may be vulnerable to a use-after-free. If a session is torn down while a native save-file dialog is open for a download, dismissing the dialog dereferences freed memory, which may lead to a crash or memory corruption.

Apps that do not destroy sessions at runtime, or that do not permit downloads, are not affected.

Workarounds

Avoid destroying sessions while a download save dialog may be open. Cancel pending downloads before session teardown.

Fixed Versions

• 41.0.0-beta.7
• 40.7.0
• 39.8.0
• 38.8.6

For more information

If there are any questions or comments about this advisory, please email security@electronjs.org

Severity

• CVSS Score: 5.8 / 10 (Medium)
• Vector String: CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:L/A:L

References

• https://github.com/electron/electron/security/advisories/GHSA-9w97-2464-8783
• https://nvd.nist.gov/vuln/detail/CVE-2026-34772
• https://github.com/advisories/GHSA-9w97-2464-8783

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Electron: Registry key path injection in app.setAsDefaultProtocolClient on Windows

CVE-2026-34773 / GHSA-mwmh-mq4g-g6gr

More information

Details

Impact

On Windows, app.setAsDefaultProtocolClient(protocol) did not validate the protocol name before writing to the registry. Apps that pass untrusted input as the protocol name may allow an attacker to write to arbitrary subkeys under HKCU\Software\Classes\, potentially hijacking existing protocol handlers.

Apps are only affected if they call app.setAsDefaultProtocolClient() with a protocol name derived from external or untrusted input. Apps that use a hardcoded protocol name are not affected.

Workarounds

Validate the protocol name matches /^[a-zA-Z][a-zA-Z0-9+.-]*$/ before passing it to app.setAsDefaultProtocolClient().

Fixed Versions

• 41.0.0
• 40.8.1
• 39.8.1
• 38.8.6

For more information

If there are any questions or comments about this advisory, please email security@electronjs.org

Severity

• CVSS Score: 4.7 / 10 (Medium)
• Vector String: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N

References

• https://github.com/electron/electron/security/advisories/GHSA-mwmh-mq4g-g6gr
• https://nvd.nist.gov/vuln/detail/CVE-2026-34773
• https://github.com/advisories/GHSA-mwmh-mq4g-g6gr

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Electron: nodeIntegrationInWorker not correctly scoped in shared renderer processes

CVE-2026-34775 / GHSA-xwr5-m59h-vwqr

More information

Details

Impact

The nodeIntegrationInWorker webPreference was not correctly scoped in all configurations. In certain process-sharing scenarios, workers spawned in frames configured with nodeIntegrationInWorker: false could still receive Node.js integration.

Apps are only affected if they enable nodeIntegrationInWorker. Apps that do not use nodeIntegrationInWorker are not affected.

Workarounds

Avoid enabling nodeIntegrationInWorker in apps that also open child windows or embed content with differing webPreferences.

Fixed Versions

• 41.0.0
• 40.8.4
• 39.8.4
• 38.8.6

For more information

If there are any questions or comments about this advisory, please email security@electronjs.org

Severity

• CVSS Score: 6.8 / 10 (Medium)
• Vector String: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N

References

• https://github.com/electron/electron/security/advisories/GHSA-xwr5-m59h-vwqr
• https://nvd.nist.gov/vuln/detail/CVE-2026-34775
• https://github.com/advisories/GHSA-xwr5-m59h-vwqr

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Electron: Use-after-free in offscreen child window paint callback

CVE-2026-34774 / GHSA-532v-xpq5-8h95

More information

Details

Impact

Apps that use offscreen rendering and allow child windows via window.open() may be vulnerable to a use-after-free. If the parent offscreen WebContents is destroyed while a child window remains open, subsequent paint frames on the child dereference freed memory, which may lead to a crash or memory corruption.

Apps are only affected if they use offscreen rendering (webPreferences.offscreen: true) and their setWindowOpenHandler permits child windows. Apps that do not use offscreen rendering, or that deny child windows, are not affected.

Workarounds

Deny child window creation from offscreen renderers in your setWindowOpenHandler, or ensure child windows are closed before the parent is destroyed.

Fixed Versions

• 41.0.0
• 40.7.0
• 39.8.1

For more information

If there are any questions or comments about this advisory, please email security@electronjs.org

Severity

• CVSS Score: 8.1 / 10 (High)
• Vector String: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

References

• https://github.com/electron/electron/security/advisories/GHSA-532v-xpq5-8h95
• https://nvd.nist.gov/vuln/detail/CVE-2026-34774
• https://github.com/advisories/GHSA-532v-xpq5-8h95

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Electron: Incorrect origin passed to permission request handler for iframe requests

CVE-2026-34777 / GHSA-r5p7-gp4j-qhrx

More information

Details

Impact

When an iframe requests fullscreen, pointerLock, keyboardLock, openExternal, or media permissions, the origin passed to session.setPermissionRequestHandler() was the top-level page's origin rather than the requesting iframe's origin. Apps that grant permissions based on the origin parameter or webContents.getURL() may inadvertently grant permissions to embedded third-party content.

The correct requesting URL remains available via details.requestingUrl. Apps that already check details.requestingUrl are not affected.

Workarounds

In your setPermissionRequestHandler, inspect details.requestingUrl rather than the origin parameter or webContents.getURL() when deciding whether to grant fullscreen, pointerLock, keyboardLock, openExternal, or media permissions.

Fixed Versions

• 41.0.0
• 40.8.1
• 39.8.1
• 38.8.6

For more information

If there are any questions or comments about this advisory, please email security@electronjs.org

Severity

• CVSS Score: 5.4 / 10 (Medium)
• Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N

References

• https://github.com/electron/electron/security/advisories/GHSA-r5p7-gp4j-qhrx
• https://nvd.nist.gov/vuln/detail/CVE-2026-34777
• https://github.com/advisories/GHSA-r5p7-gp4j-qhrx

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Electron: Out-of-bounds read in second-instance IPC on macOS and Linux

CVE-2026-34776 / GHSA-3c8v-cfp5-9885

More information

Details

Impact

On macOS and Linux, apps that call app.requestSingleInstanceLock() were vulnerable to an out-of-bounds heap read when parsing a crafted second-instance message. Leaked memory could be delivered to the app's second-instance event handler.

This issue is limited to processes running as the same user as the Electron app.

Apps that do not call app.requestSingleInstanceLock() are not affected. Windows is not affected by this issue.

Workarounds

There are no app side workarounds, developers must update to a patched version of Electron.

Fixed Versions

• 41.0.0
• 40.8.1
• 39.8.1
• 38.8.6

For more information

If there are any questions or comments about this advisory, please email security@electronjs.org

Severity

• CVSS Score: 5.3 / 10 (Medium)
• Vector String: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:L

References

• https://github.com/electron/electron/security/advisories/GHSA-3c8v-cfp5-9885
• https://nvd.nist.gov/vuln/detail/CVE-2026-34776
• https://github.com/advisories/GHSA-3c8v-cfp5-9885

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Electron: Service worker can spoof executeJavaScript IPC replies

CVE-2026-34778 / GHSA-xj5x-m3f3-5x3h

More information

Details

Impact

A service worker running in a session could spoof reply messages on the internal IPC channel used by webContents.executeJavaScript() and related methods, causing the main-process promise to resolve with attacker-controlled data.

Apps are only affected if they have service workers registered and use the result of webContents.executeJavaScript() (or webFrameMain.executeJavaScript()) in security-sensitive decisions.

Workarounds

Do not trust the return value of webContents.executeJavaScript() for security decisions. Use dedicated, validated IPC channels for security-relevant communication with renderers.

Fixed Versions

• 41.0.0
• 40.8.1
• 39.8.1
• 38.8.6

For more information

If there are any questions or comments about this advisory, please email security@electronjs.org

Severity

• CVSS Score: 5.9 / 10 (Medium)
• Vector String: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:H/A:N

References

• https://github.com/electron/electron/security/advisories/GHSA-xj5x-m3f3-5x3h
• https://nvd.nist.gov/vuln/detail/CVE-2026-34778
• https://github.com/advisories/GHSA-xj5x-m3f3-5x3h

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Electron: AppleScript injection in app.moveToApplicationsFolder on macOS

CVE-2026-34779 / GHSA-5rqw-r77c-jp79

More information

Details

Impact

On macOS, app.moveToApplicationsFolder() used an AppleScript fallback path that did not properly handle certain characters in the application bundle path. Under specific conditions, a crafted launch path could lead to arbitrary AppleScript execution when the user accepted the move-to-Applications prompt.

Apps are only affected if they call app.moveToApplicationsFolder(). Apps that do not use this API are not affected.

Workarounds

There are no app side workarounds, developers must update to a patched version of Electron.

Fixed Versions

• 41.0.0-beta.8
• 40.8.0
• 39.8.1
• 38.8.6

For more information

If there are any questions or comments about this advisory, please email security@electronjs.org

Severity

• CVSS Score: 6.5 / 10 (Medium)
• Vector String: CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:L

References

• https://github.com/electron/electron/security/advisories/GHSA-5rqw-r77c-jp79
• https://nvd.nist.gov/vuln/detail/CVE-2026-34779
• https://github.com/advisories/GHSA-5rqw-r77c-jp79

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Electron: Crash in clipboard.readImage() on malformed clipboard image data

CVE-2026-34781 / GHSA-f37v-82c4-4x64

More information

Details

Impact

Apps that call clipboard.readImage() may be vulnerable to a denial of service. If the system clipboard contains image data that fails to decode, the resulting null bitmap is passed unchecked to image construction, triggering a controlled abort and crashing the process.

Apps are only affected if they call clipboard.readImage(). Apps that do not read images from the clipboard are not affected. This issue does not allow memory corruption or code execution.

Workarounds

Validate that the clipboard c