CVE-2026-34773 electron CVE debrief

Who should care

Developers and administrators using Electron framework for building cross-platform desktop applications, especially those using Windows systems, should be aware of this vulnerability. Apps that pass untrusted input as the protocol name to app.setAsDefaultProtocolClient() are potentially affected.

Technical summary

The vulnerability is caused by the lack of validation of the protocol name in the app.setAsDefaultProtocolClient() function. This allows an attacker to write to arbitrary subkeys under HKCUSoftwareClasses, potentially hijacking existing protocol handlers. The vulnerability has a CVSS score of 4.7 and is classified as CWE-74. Affected applications are those that pass untrusted input as the protocol name to app.setAsDefaultProtocolClient(). The issue has been patched in Electron versions 38.8.6, 39.8.1, 40.8.1, and 41.0.0. Developers should validate protocol names and consider implementing compensating controls.

Defensive priority

Medium priority should be given to patching or mitigating this vulnerability, as it can be used for protocol handler hijacking.

Recommended defensive actions

• Apply patches: Upgrade to Electron versions 38.8.6, 39.8.1, 40.8.1, or 41.0.0 or later.
• Validate protocol names: Ensure that protocol names passed to app.setAsDefaultProtocolClient() are validated and sanitized.
• Monitor registry changes: Monitor registry changes to detect potential protocol handler hijacking attempts.
• Use compensating controls: Implement compensating controls, such as using a whitelist of allowed protocol handlers.
• Review asset inventory: Identify and review Electron-based applications in your environment.
• Perform exposure review: Assess the potential impact of this vulnerability on your systems.
• Track exceptions: Monitor and track exceptions related to protocol handler hijacking attempts.

Evidence notes

The vulnerability is documented in the Electron security advisory GHSA-mwmh-mq4g-g6gr. The CVE record and NVD detail provide additional information on the vulnerability. The issue was patched in Electron versions 38.8.6, 39.8.1, 40.8.1, and 41.0.0. No additional information on exploitation or affected scope is available. Defenders should verify patched versions are deployed and monitor for unusual registry changes.

Official resources