CVE-2026-113797 Electron CVE debrief

Who should care

Developers and administrators of Electron applications that load extensions, especially those that do not fully trust the extensions they load, should assess their exposure and take necessary actions to mitigate the vulnerability.

Why it matters

CVE-2026-113797 allows untrusted extensions in Electron applications to access tab URLs and titles without proper permissions, potentially leading to unauthorized data exposure. Developers and administrators should assess exposure, verify version updates, and restrict loading of untrusted extensions.

• Untrusted extensions can access sensitive tab information
• Potential for unauthorized data exposure
• Need to verify Electron version and update to fixed versions
• Requires review of extension permissions and host permissions

Technical summary

The Electron application framework has a vulnerability where the chrome.tabs.query() function returns tab URLs and titles to extensions without the tabs permission or matching host permissions. This allows any loaded extension to read the URL and title of every webContents in its session. The vulnerability affects applications that load extensions they do not fully trust. Developers and administrators should assess exposure, verify version updates, and restrict loading of untrusted extensions. The vulnerability can be mitigated by verifying Electron version updates to affected versions, restricting loading of untrusted or unvalidated extensions, and reviewing and updating extension permissions and host.

Defensive priority

Assess exposure of Electron applications loading untrusted extensions and verify version updates.

Recommended defensive actions

• Assess exposure of Electron applications loading untrusted extensions
• Verify Electron version updates to affected versions
• Restrict loading of untrusted or unvalidated extensions
• Review and update extension permissions and host permissions
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE record and source item detail the vulnerability in Electron's extension handling, specifically with the tabs.query function. Electron applications loading untrusted extensions may be affected.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.