PatchSiren

electron CVE debriefs

These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.

MEDIUM electron CVE published 2026-08-05

CVE-2026-70612

The Electron framework, used for building cross-platform desktop applications with JavaScript, HTML, and CSS, had a significant vulnerability. Prior to versions 39.8.8, 40.9.0, 41.2.1, and 42.0.0-beta.3, it did not properly account for iframe sandbox restrictions when handling requests to open external protocol URLs from web content. This oversight allowed a sandboxed iframe to launch an OS-registered ext [truncated]

MEDIUM electron CVE published 2026-08-05

CVE-2026-70610

AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-08-05T18:17:15.463Z and has not been modified since then. Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.9, 40.9.2, 41.2.2, and 42.0.0-beta.4, objects copied across the contextBridge boundary from untrusted content could carry an at [truncated]

MEDIUM electron CVE published 2026-08-05

CVE-2026-70609

The CVE-2026-70609 vulnerability affects Electron, a framework for writing cross-platform desktop applications using JavaScript, HTML, and CSS. This vulnerability is due to the mode option of webContents.openDevTools() not being sanitized before use by the DevTools frontend. This allows an attacker to run script under their control in the DevTools context, which in unsandboxed configurations has access to [truncated]

HIGH electron CVE published 2026-08-05

CVE-2026-70608

CVE-2026-70608 is a high-severity vulnerability in Electron, a framework for building cross-platform desktop applications. The issue allows a sandboxed iframe without the allow-popups keyword to open a new window or trigger setWindowOpenHandler with no user interaction. This occurs because new-window navigations taking the OpenURL path do not apply the iframe sandbox popup restriction. Applications embedd [truncated]

MEDIUM electron CVE published 2026-08-05

CVE-2026-70607

The Electron framework, used for writing cross-platform desktop applications with JavaScript, HTML, and CSS, had a vulnerability where untrusted content could control window options. This could potentially lead to unauthorized file or network path access. The issue was fixed in Electron versions 39.8.8, 40.9.0, 41.2.1, and 42.0.0-beta.3. Developers and users of Electron applications, particularly those ha [truncated]

MEDIUM electron CVE published 2026-08-05

CVE-2026-70606

AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-08-05T16:17:04.953Z and has not been modified since then. This vulnerability affects Electron framework versions before 40.10.6, 41.9.1, 42.5.1, and 43.0.0, allowing cached response reuse across isolated session partitions. Developers using Electron framework, especially those relying on separate sessi [truncated]

MEDIUM electron CVE published 2026-08-05

CVE-2026-70605

The Electron framework vulnerability (CVE-2026-70605) allows a remote server to redirect requests to local resources, potentially disclosing local file contents. Versions prior to 39.8.8, 40.9.0, 41.2.1, and 42.0.0-beta.3 are affected. The vulnerability is triggered when following HTTP redirects, and net.fetch() and net.request() do not restrict which schemes a redirect could target. Apps using net.fetch( [truncated]

HIGH electron CVE published 2026-08-05

CVE-2026-70604

Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML, and CSS. A vulnerability in custom schemes registered with supportFetchAPI: true but without corsEnabled: true allows cross-origin data exposure in Electron versions prior to 39.8.10, 40.9.3, 41.4.0, and 42.0.0. This issue can be mitigated by updating Electron to a secure version, assessing applications using c [truncated]

MEDIUM electron CVE published 2026-08-05

CVE-2026-70603

AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-08-05T16:17:04.470Z and has not been modified since then. The Electron framework's shell.openPath() function did not reject paths containing embedded null bytes in versions prior to 39.8.6, 40.9.0, 41.1.1, and 42.0.0-beta.1. This could allow an attacker to bypass string-only validation of file paths, p [truncated]

MEDIUM electron CVE published 2026-08-05

CVE-2026-70602

The CVE-2026-70602 vulnerability affects Electron, a framework for writing cross-platform desktop applications using JavaScript, HTML, and CSS. This vulnerability allows malicious or compromised extensions to access windows from different sessions. Electron applications using session.loadExtension may be affected, especially if they rely on separate sessions to isolate extensions from other content. The i [truncated]

HIGH electron CVE published 2026-08-05

CVE-2026-70601

AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-08-05T16:17:04.203Z and has not been modified since then. Electron framework versions prior to 39.8.9, 40.9.2, 41.2.2, and 42.0.0-beta.5 are vulnerable to context isolation bypass when exposing Promise-returning functions to web content via contextBridge. This could allow untrusted web content to acces [truncated]

MEDIUM electron CVE published 2026-08-05

CVE-2026-70597

The Electron framework vulnerability, identified as CVE-2026-70597, allows a local process to bypass the macOS check, potentially running code inside signed apps with TCC permissions and keychain access. This issue is fixed in multiple versions: 39.8.8, 40.9.0, 41.2.1, and 42.0.0-beta.3. Electron applications using fuse-based hardening may be vulnerable to local code execution. The vulnerability has been [truncated]

LOW electron CVE published 2026-04-07

CVE-2026-34781

CVE-2026-34781 is a denial of service vulnerability in Electron, a framework for writing cross-platform desktop applications using JavaScript, HTML, and CSS. Apps that call clipboard.readImage() may be vulnerable if the system clipboard contains image data that fails to decode, triggering a controlled abort and crashing the process. This issue does not allow memory corruption or code execution. The vulner [truncated]

MEDIUM electron CVE published 2026-04-07

CVE-2026-34765

CVE-2026-34765 is a medium-severity vulnerability in Electron, a framework for writing cross-platform desktop applications using JavaScript, HTML, and CSS. The vulnerability occurs when a renderer calls window.open() with a target name, and Electron does not correctly scope the named-window lookup to the opener's browsing context group. This oversight allows a renderer to navigate an existing child window [truncated]

MEDIUM electron CVE published 2026-04-04

CVE-2026-34777

Electron, a framework for building cross-platform desktop applications, had a vulnerability where the origin passed to session.setPermissionRequestHandler() was incorrectly set to the top-level page's origin instead of the requesting iframe's origin. This could lead to unintended permission grants to embedded third-party content. The issue has been patched in versions 38.8.6, 39.8.1, 40.8.1, and 41.0.0. D [truncated]

HIGH electron CVE published 2026-04-04

CVE-2026-34774

CVE-2026-34774 is a high-severity use-after-free vulnerability in Electron, a framework for building cross-platform desktop applications. The vulnerability affects applications that use offscreen rendering and allow child windows via window.open(). If the parent offscreen WebContents is destroyed while a child window remains open, subsequent paint frames on the child may dereference freed memory, potentia [truncated]

MEDIUM electron CVE published 2026-04-04

CVE-2026-34773

CVE-2026-34773 is a medium-severity vulnerability in the Electron framework that allows protocol handler hijacking on Windows systems. The vulnerability exists in the app.setAsDefaultProtocolClient() function, which did not validate the protocol name before writing to the registry. This allows an attacker to write to arbitrary subkeys under HKCUSoftwareClasses, potentially hijacking existing protocol hand [truncated]

MEDIUM electron CVE published 2026-04-04

CVE-2026-34767

CVE-2026-34767 is a vulnerability in Electron, a framework for writing cross-platform desktop applications, that allows for HTTP response header injection. This vulnerability affects Electron versions prior to 38.8.6, 39.8.3, 40.8.3, and 41.0.3. An attacker who can influence a header value may be able to inject additional response headers, affecting cookies, content security policy, or cross-origin access [truncated]

LOW electron CVE published 2026-04-04

CVE-2026-34766

The Electron framework, used for building cross-platform desktop applications, had a security vulnerability. An issue was found in the select-usb-device event callback where it did not validate the chosen device ID against the filtered list presented to the handler. This could allow an app to gain access to a device that did not match the renderer's requested filters or was listed in exclusionFilters. How [truncated]