PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-34765 electron CVE debrief

CVE-2026-34765 is a medium-severity vulnerability in Electron, a framework for writing cross-platform desktop applications using JavaScript, HTML, and CSS. The vulnerability occurs when a renderer calls window.open() with a target name, and Electron does not correctly scope the named-window lookup to the opener's browsing context group. This oversight allows a renderer to navigate an existing child window opened by a different, unrelated renderer if both use the same target name. If the existing child was created with more permissive webPreferences (via setWindowOpenHandler's overrideBrowserWindowOptions), content loaded by the second renderer inherits those permissions. Developers and users of Electron applications, particularly those that open multiple top-level windows with differing trust levels and use setWindowOpenHandler to grant child windows elevated webPreferences, should be aware of this vulnerability. The vulnerability is fixed in Electron versions 39.8.5, 40.8.5, 41.1.0, and 42.0.0-alpha.5.

Vendor
electron
Product
Unknown
CVSS
MEDIUM 6
CISA KEV
Not listed in stored evidence
Original CVE published
2026-04-07
Original CVE updated
2026-07-24
Advisory published
2026-04-07
Advisory updated
2026-07-24

Who should care

Developers and users of Electron applications, particularly those that open multiple top-level windows with differing trust levels and use setWindowOpenHandler to grant child windows elevated webPreferences.

Technical summary

Prior to Electron versions 39.8.5, 40.8.5, 41.1.0, and 42.0.0-alpha.5, when a renderer calls window.open() with a target name, Electron did not correctly scope the named-window lookup to the opener's browsing context group. A renderer could navigate an existing child window that was opened by a different, unrelated renderer if both used the same target name. If that existing child was created with more permissive webPreferences (via setWindowOpenHandler's overrideBrowserWindowOptions), content loaded by the second renderer inherits those permissions.

Defensive priority

Medium priority, as the vulnerability requires specific conditions to be exploited, such as the presence of multiple top-level windows with differing trust levels and the use of setWindowOpenHandler to grant child windows elevated webPreferences.

Recommended defensive actions

  • Update Electron to version 39.8.5, 40.8.5, 41.1.0, or 42.0.0-alpha.5 or later
  • Review and adjust the use of setWindowOpenHandler to ensure child windows are not granted elevated webPreferences unnecessarily
  • Monitor Electron applications for unusual activity, particularly those that open multiple top-level windows with differing trust levels
  • Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
  • Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
  • Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
  • Check relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

The vulnerability is fixed in Electron versions 39.8.5, 40.8.5, 41.1.0, and 42.0.0-alpha.5. The CVE record was published on 2026-04-07T22:16:22.960Z and last modified on 2026-07-24T22:10:00.140Z. Evidence of exploitation is limited, and defenders should verify the presence of affected Electron versions in their environments. The CVE record and NVD detail page provide additional context for understanding the vulnerability.

Official resources

AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-04-07T22:16:22.960Z and has not been modified since then.