Skip to main content
cve.nowby Sazabi
← npm
npmPackage

electron

79 known vulnerabilities (2 critical, 22 high, 36 medium, 11 low), with the versions each affects and the releases that fix them.

Latest release
45.2.3 (Nov 4, 2026): no advisory affects it
Newest unaffected release
45.2.3 (Nov 4, 2026), the latest release
Advisories
79 · 2 critical, 22 high, 36 medium, 11 low
Weekly downloads
11.7M
Dependents
215
Releases
500+ since 32.3.1 (Feb 14, 2025)
Registry
npm
Releases read
Nov 8, 2026

Version timeline

  • CVE-2026-115570
    Affects 32.3.1 to 42.11.15 (42.11.16 is outside it); 43.0.0-alpha.1 to 43.8.0 (43.8.1 is outside it); 44.0.0-alpha.1 to 44.9.0 (44.9.1 is outside it); 45.0.0-alpha.1 to 45.0.0-beta.5 (45.0.0-beta.6 is outside it)
  • CVE-2026-114124
    Affects 32.3.1 to 42.11.5 (42.11.6 is outside it); 43.0.0-alpha.1 to 43.7.2 (43.7.3 is outside it); 44.0.0-alpha.1 to 44.4.2 (44.4.3 is outside it); 45.0.0-alpha.1 to 45.0.0-alpha.8 (45.0.0-alpha.9 is outside it)
  • CVE-2026-114122
    Affects 32.3.1 to 42.11.5 (42.11.6 is outside it); 43.0.0-alpha.1 to 43.7.2 (43.7.3 is outside it); 44.0.0-alpha.1 to 44.4.2 (44.4.3 is outside it); 45.0.0-alpha.1 to 45.0.0-alpha.8 (45.0.0-alpha.9 is outside it)
  • CVE-2026-114121
    Affects 32.3.1 to 42.11.2 (42.11.3 is outside it); 43.0.0-alpha.1 to 43.6.0 (43.7.0 is outside it); 44.0.0-alpha.1 to 44.2.0 (44.3.0 is outside it); 45.0.0-alpha.1 to 45.0.0-alpha.4 (45.0.0-alpha.5 is outside it)
  • CVE-2026-113800
    Affects 32.3.1 to 42.11.2 (42.11.3 is outside it); 43.0.0-alpha.1 to 43.6.0 (43.7.0 is outside it); 44.0.0-alpha.1 to 44.2.0 (44.3.0 is outside it); 45.0.0-alpha.1 to 45.0.0-alpha.4 (45.0.0-alpha.5 is outside it)
  • CVE-2026-113798
    Affects 32.3.1 to 42.11.8 (42.11.9 is outside it); 43.0.0-alpha.1 to 43.7.5 (43.7.6 is outside it); 44.0.0-alpha.1 to 44.4.5 (44.5.0 is outside it); 45.0.0-alpha.1 to 45.0.0-alpha.12 (45.0.0-alpha.13 is outside it)
  • CVE-2026-113797
    Affects 32.3.1 to 42.11.0 (42.11.1 is outside it); 43.0.0-alpha.1 to 43.5.0 (43.5.1 is outside it); 44.0.0-alpha.1 to 44.1.0 (44.1.1 is outside it); 45.0.0-alpha.1 to 45.0.0-alpha.3 (45.0.0-alpha.4 is outside it)
  • CVE-2026-113796
    Affects 32.3.1 to 42.11.2 (42.11.3 is outside it); 43.0.0-alpha.1 to 43.6.0 (43.7.0 is outside it); 44.0.0-alpha.1 to 44.2.0 (44.3.0 is outside it); 45.0.0-alpha.1 to 45.0.0-alpha.5 (45.0.0-alpha.6 is outside it)
  • CVE-2026-102672
    Affects 32.3.1 to 39.8.9 (39.8.10 is outside it); 40.0.0-alpha.2 to 41.10.4 (41.10.5 is outside it); 42.0.0-alpha.1 to 42.0.0-beta.1 (42.0.0-beta.2 is outside it)
  • CVE-2026-102677
    Affects 42.3.3 to 42.9.3 (42.10.0 is outside it); 43.0.0-beta.1 to 43.4.1 (43.5.0 is outside it); 44.0.0-alpha.1 to 44.0.0-beta.5 (44.0.0-beta.6 is outside it)
  • CVE-2026-102676
    Affects 32.3.1 to 41.10.5 (41.10.6 is outside it); 42.0.0-alpha.1 to 42.9.1 (42.9.2 is outside it); 43.0.0-alpha.1 to 43.4.0 (43.4.1 is outside it); 44.0.0-alpha.1 to 44.0.0-beta.4 (44.0.0-beta.5 is outside it)
  • CVE-2026-102675
    Affects 32.3.1 to 41.10.5 (41.10.6 is outside it); 42.0.0-alpha.1 to 42.9.1 (42.9.2 is outside it); 43.0.0-alpha.1 to 43.4.0 (43.4.1 is outside it); 44.0.0-alpha.1 to 44.0.0-beta.4 (44.0.0-beta.5 is outside it)
Show all 79 advisoriesShow fewer advisories
  • CVE-2026-102674
    Affects 32.3.1 to 41.10.5 (41.10.6 is outside it); 42.0.0-alpha.1 to 42.9.1 (42.9.2 is outside it); 43.0.0-alpha.1 to 43.4.0 (43.4.1 is outside it); 44.0.0-alpha.1 to 44.0.0-beta.4 (44.0.0-beta.5 is outside it)
  • CVE-2026-102673
    Affects 32.3.1 to 41.10.3 (41.10.4 is outside it); 42.0.0-alpha.1 to 42.5.1 (42.5.2 is outside it); 43.0.0-alpha.1 to 43.0.0-beta.8 (43.0.0 is outside it)
  • CVE-2026-70612
    Affects 32.3.1 to 39.8.7 (39.8.8 is outside it); 40.0.0-alpha.2 to 40.8.5 (40.9.1 is outside it); 41.0.0-alpha.1 to 41.2.0 (41.2.1 is outside it); 42.0.0-alpha.1 to 42.0.0-beta.2 (42.0.0-beta.3 is outside it)
  • CVE-2026-70611
    Affects 32.3.1 to 39.8.8 (39.8.9 is outside it); 40.0.0-alpha.2 to 40.9.1 (40.9.2 is outside it); 41.0.0-alpha.1 to 41.2.0 (41.2.1 is outside it); 42.0.0-alpha.1 to 42.0.0-beta.2 (42.0.0-beta.3 is outside it)
  • CVE-2026-70610
    Affects 32.3.1 to 39.8.8 (39.8.9 is outside it); 40.0.0-alpha.2 to 40.9.1 (40.9.2 is outside it); 41.0.0-alpha.1 to 41.2.1 (41.2.2 is outside it); 42.0.0-alpha.1 to 42.0.0-beta.3 (42.0.0-beta.4 is outside it)
  • CVE-2026-70609
    Affects 32.3.1 to 39.8.6 (39.8.7 is outside it); 40.0.0-alpha.2 to 40.8.5 (40.9.1 is outside it); 41.0.0-alpha.1 to 41.1.1 (41.2.0 is outside it); 42.0.0-alpha.1 to 42.0.0-alpha.6 (42.0.0-beta.1 is outside it)
  • CVE-2026-70608
    Affects 32.3.1 to 39.8.9 (39.8.10 is outside it); 40.0.0-alpha.2 to 41.10.2 (41.10.3 is outside it); 42.0.0-alpha.1 to 42.0.0 (42.0.1 is outside it)
  • CVE-2026-70607
    Affects 32.3.1 to 39.8.7 (39.8.8 is outside it); 40.0.0-alpha.2 to 40.8.5 (40.9.1 is outside it); 41.0.0-alpha.1 to 41.2.0 (41.2.1 is outside it); 42.0.0-alpha.1 to 42.0.0-beta.2 (42.0.0-beta.3 is outside it)
  • CVE-2026-70606
    Affects 40.0.0-alpha.2 to 40.10.5 (40.10.6 is outside it); 41.0.0-alpha.1 to 41.9.0 (41.9.1 is outside it); 42.0.0-alpha.1 to 42.5.0 (42.5.1 is outside it); 43.0.0-alpha.1 to 43.0.0-beta.8 (43.0.0 is outside it)
  • CVE-2026-70605
    Affects 32.3.1 to 39.8.7 (39.8.8 is outside it); 40.0.0-alpha.2 to 40.8.5 (40.9.1 is outside it); 41.0.0-alpha.1 to 41.2.0 (41.2.1 is outside it); 42.0.0-alpha.1 to 42.0.0-beta.2 (42.0.0-beta.3 is outside it)
  • CVE-2026-70604
    Affects 32.3.1 to 39.8.9 (39.8.10 is outside it); 40.0.0-alpha.2 to 40.9.2 (40.9.3 is outside it); 41.0.0-alpha.1 to 41.3.0 (41.4.0 is outside it); 42.0.0-alpha.1 to 42.0.0-beta.8 (42.0.0 is outside it)
  • CVE-2026-70603
    Affects 32.3.1 to 39.8.5 (39.8.6 is outside it); 40.0.0-alpha.2 to 40.8.5 (40.9.1 is outside it); 41.0.0-alpha.1 to 41.1.0 (41.1.1 is outside it); 42.0.0-alpha.1 to 42.0.0-alpha.6 (42.0.0-beta.1 is outside it)
  • CVE-2026-70602
    Affects 32.3.1 to 39.8.7 (39.8.8 is outside it); 40.0.0-alpha.2 to 40.8.5 (40.9.1 is outside it); 41.0.0-alpha.1 to 41.2.0 (41.2.1 is outside it); 42.0.0-alpha.1 to 42.0.0-beta.2 (42.0.0-beta.3 is outside it)
  • CVE-2026-70601
    Affects 32.3.1 to 39.8.8 (39.8.9 is outside it); 40.0.0-alpha.2 to 40.9.1 (40.9.2 is outside it); 41.0.0-alpha.1 to 41.2.1 (41.2.2 is outside it); 42.0.0-alpha.1 to 42.0.0-beta.4 (42.0.0-beta.5 is outside it)
  • CVE-2026-70600
    Affects 32.3.1 to 39.8.7 (39.8.8 is outside it); 40.0.0-alpha.2 to 40.8.5 (40.9.1 is outside it); 41.0.0-alpha.1 to 41.2.0 (41.2.1 is outside it); 42.0.0-alpha.1 to 42.0.0-beta.2 (42.0.0-beta.3 is outside it)
  • CVE-2026-70599
    Affects 32.3.1 to 39.8.6 (39.8.7 is outside it); 40.0.0-alpha.2 to 40.8.5 (40.9.1 is outside it); 41.0.0-alpha.1 to 41.1.1 (41.2.0 is outside it); 42.0.0-alpha.1 to 42.0.0-alpha.6 (42.0.0-beta.1 is outside it)
  • CVE-2026-70598
    Affects 32.3.1 to 39.8.9 (39.8.10 is outside it); 40.0.0-alpha.2 to 40.8.5 (40.9.1 is outside it); 41.0.0-alpha.1 to 41.2.0 (41.2.1 is outside it); 42.0.0-alpha.1 to 42.0.0-beta.2 (42.0.0-beta.3 is outside it)
  • CVE-2026-70597
    Affects 32.3.1 to 39.8.7 (39.8.8 is outside it); 40.0.0-alpha.2 to 40.8.5 (40.9.1 is outside it); 41.0.0-alpha.1 to 41.2.0 (41.2.1 is outside it); 42.0.0-alpha.1 to 42.0.0-beta.2 (42.0.0-beta.3 is outside it)
  • CVE-2026-54257
    Affects 42.3.1 to 42.3.2 (42.3.3 is outside it)
  • CVE-2026-34781
    Affects 32.3.1 to 39.8.4 (39.8.5 is outside it); 40.0.0-alpha.2 to 40.8.4 (40.8.5 is outside it); 41.0.0-alpha.1 to 41.0.4 (41.1.0 is outside it); 42.0.0-alpha.1 to 42.0.0-alpha.4 (42.0.0-alpha.5 is outside it)
  • CVE-2026-34765
    Affects 32.3.1 to 39.8.4 (39.8.5 is outside it); 40.0.0-alpha.2 to 40.8.4 (40.8.5 is outside it); 41.0.0-alpha.1 to 41.0.4 (41.1.0 is outside it); 42.0.0-alpha.1 to 42.0.0-alpha.4 (42.0.0-alpha.5 is outside it)
  • CVE-2026-34764
    Affects 33.4.0 to 39.8.4 (39.8.5 is outside it); 40.0.0-alpha.2 to 40.8.4 (40.8.5 is outside it); 41.0.0-alpha.1 to 41.0.4 (41.1.0 is outside it); 42.0.0-alpha.1 to 42.0.0-alpha.4 (42.0.0-alpha.5 is outside it)
  • CVE-2026-34780
    Affects 39.0.0-alpha.1 to 39.7.0 (39.8.0 is outside it); 40.0.0-alpha.2 to 40.6.1 (40.7.0 is outside it); 41.0.0-alpha.1 to 41.0.0-beta.7 (41.0.0-beta.8 is outside it)
  • CVE-2026-34779
    Affects 32.3.1 to 38.8.4 (38.8.6 is outside it); 39.0.0-alpha.1 to 39.8.0 (39.8.1 is outside it); 40.0.0-alpha.2 to 40.7.0 (40.8.0 is outside it); 41.0.0-alpha.1 to 41.0.0-beta.7 (41.0.0-beta.8 is outside it)
  • CVE-2026-34778
    Affects 32.3.1 to 38.8.4 (38.8.6 is outside it); 39.0.0-alpha.1 to 39.8.0 (39.8.1 is outside it); 40.0.0-alpha.2 to 40.8.0 (40.8.1 is outside it); 41.0.0-alpha.1 to 41.0.0-beta.8 (41.0.0 is outside it)
  • CVE-2026-34777
    Affects 32.3.1 to 38.8.4 (38.8.6 is outside it); 39.0.0-alpha.1 to 39.8.0 (39.8.1 is outside it); 40.0.0-alpha.2 to 40.8.0 (40.8.1 is outside it); 41.0.0-alpha.1 to 41.0.0-beta.8 (41.0.0 is outside it)
  • CVE-2026-34776
    Affects 32.3.1 to 38.8.4 (38.8.6 is outside it); 39.0.0-alpha.1 to 39.8.0 (39.8.1 is outside it); 40.0.0-alpha.2 to 40.8.0 (40.8.1 is outside it); 41.0.0-alpha.1 to 41.0.0-beta.8 (41.0.0 is outside it)
  • CVE-2026-34775
    Affects 32.3.1 to 38.8.4 (38.8.6 is outside it); 39.0.0-alpha.1 to 39.8.3 (39.8.4 is outside it); 40.0.0-alpha.2 to 40.8.3 (40.8.4 is outside it); 41.0.0-alpha.1 to 41.0.0-beta.8 (41.0.0 is outside it)
  • CVE-2026-34774
    Affects 32.3.1 to 39.8.0 (39.8.1 is outside it); 40.0.0-alpha.2 to 40.6.1 (40.7.0 is outside it); 41.0.0-alpha.1 to 41.0.0-beta.8 (41.0.0 is outside it)
  • CVE-2026-34773
    Affects 32.3.1 to 38.8.4 (38.8.6 is outside it); 39.0.0-alpha.1 to 39.8.0 (39.8.1 is outside it); 40.0.0-alpha.2 to 40.8.0 (40.8.1 is outside it); 41.0.0-alpha.1 to 41.0.0-beta.8 (41.0.0 is outside it)
  • CVE-2026-34772
    Affects 32.3.1 to 38.8.4 (38.8.6 is outside it); 39.0.0-alpha.1 to 39.7.0 (39.8.0 is outside it); 40.0.0-alpha.2 to 40.6.1 (40.7.0 is outside it); 41.0.0-alpha.1 to 41.0.0-beta.6 (41.0.0-beta.7 is outside it)
  • CVE-2026-34771
    Affects 32.3.1 to 38.8.4 (38.8.6 is outside it); 39.0.0-alpha.1 to 39.7.0 (39.8.0 is outside it); 40.0.0-alpha.2 to 40.6.1 (40.7.0 is outside it); 41.0.0-alpha.1 to 41.0.0-beta.7 (41.0.0-beta.8 is outside it)
  • CVE-2026-34770
    Affects 32.3.1 to 38.8.4 (38.8.6 is outside it); 39.0.0-alpha.1 to 39.8.0 (39.8.1 is outside it); 40.0.0-alpha.2 to 40.7.0 (40.8.0 is outside it); 41.0.0-alpha.1 to 41.0.0-beta.7 (41.0.0-beta.8 is outside it)
  • CVE-2026-34768
    Affects 32.3.1 to 38.8.4 (38.8.6 is outside it); 39.0.0-alpha.1 to 39.8.0 (39.8.1 is outside it); 40.0.0-alpha.2 to 40.7.0 (40.8.0 is outside it); 41.0.0-alpha.1 to 41.0.0-beta.7 (41.0.0-beta.8 is outside it)
  • CVE-2026-34767
    Affects 32.3.1 to 38.8.4 (38.8.6 is outside it); 39.0.0-alpha.1 to 39.8.2 (39.8.3 is outside it); 40.0.0-alpha.2 to 40.8.2 (40.8.3 is outside it); 41.0.0-alpha.1 to 41.0.2 (41.0.3 is outside it)
  • CVE-2026-34766
    Affects 32.3.1 to 38.8.4 (38.8.6 is outside it); 39.0.0-alpha.1 to 39.7.0 (39.8.0 is outside it); 40.0.0-alpha.2 to 40.6.1 (40.7.0 is outside it); 41.0.0-alpha.1 to 41.0.0-beta.7 (41.0.0-beta.8 is outside it)
  • CVE-2026-34769
    Affects 32.3.1 to 38.8.4 (38.8.6 is outside it); 39.0.0-alpha.1 to 39.7.0 (39.8.0 is outside it); 40.0.0-alpha.2 to 40.6.1 (40.7.0 is outside it); 41.0.0-alpha.1 to 41.0.0-beta.7 (41.0.0-beta.8 is outside it)
  • CVE-2025-55305
    Affects 32.3.1 to 35.7.4 (35.7.5 is outside it); 36.0.0-alpha.1 to 36.8.0 (36.8.1 is outside it); 37.0.0-alpha.1 to 37.3.0 (37.3.1 is outside it); 38.0.0-alpha.1 to 38.0.0-beta.5 (38.0.0-beta.6 is outside it)
  • CVE-2024-46993
    No published release is affected
    No published release is affected
  • CVE-2024-46992
    No published release is affected
    No published release is affected
  • CVE-2023-44402
    No published release is affected
    No published release is affected
  • CVE-2023-5217
    No published release is affected
    No published release is affected
  • CVE-2023-4863
    No published release is affected
    No published release is affected
  • CVE-2023-23623
    No published release is affected
    No published release is affected
  • CVE-2023-29198
    No published release is affected
    No published release is affected
  • CVE-2023-39956
    No published release is affected
    No published release is affected
  • CVE-2022-4135
    No published release is affected
    No published release is affected
  • CVE-2022-36077
    No published release is affected
    No published release is affected
  • CVE-2022-29257
    No published release is affected
    No published release is affected
  • CVE-2022-29247
    No published release is affected
    No published release is affected
  • CVE-2022-21718
    No published release is affected
    No published release is affected
  • CVE-2021-39184
    No published release is affected
    No published release is affected
  • CVE-2020-26272
    No published release is affected
    No published release is affected
  • CVE-2020-15215
    No published release is affected
    No published release is affected
  • CVE-2020-15174
    No published release is affected
    No published release is affected
  • CVE-2020-15096
    No published release is affected
    No published release is affected
  • CVE-2020-4075
    No published release is affected
    No published release is affected
  • CVE-2020-4076
    No published release is affected
    No published release is affected
  • CVE-2020-4077
    No published release is affected
    No published release is affected
  • CVE-2018-15685
    No published release is affected
    No published release is affected
  • CVE-2017-16151
    No published release is affected
    No published release is affected
  • CVE-2018-1000136
    No published release is affected
    No published release is affected
  • CVE-2018-1000118
    No published release is affected
    No published release is affected
  • CVE-2018-1000006
    No published release is affected
    No published release is affected
  • CVE-2017-1000424
    No published release is affected
    No published release is affected
  • CVE-2017-12581
    No published release is affected
    No published release is affected
  • CVE-2016-1202
    No published release is affected
    No published release is affected
Every release cve.now has on record, lowest version on the left; each bar is a run of versions an advisory affects. Older releases aren't stored, so the earliest spans may start sooner.

Advisories 79

  • Electron: Mitigation for compromised eMudhra intermediate certificates

    Affected: from 45.0.0-alpha.1, fixed in 45.0.0-beta.6; from 44.0.0-alpha.1, fixed in 44.9.1; from 43.0.0-alpha.1, fixed in 43.8.1; fixed in 42.11.16.

    Fixed in 42.11.16 (released Oct 20, 2026, 3 days before disclosure), 43.8.1 (released Oct 20, 2026, 3 days before disclosure), 44.9.1 (released Oct 20, 2026, 3 days before disclosure) and 1 other version.

    The latest release, 45.2.3, is not affected.

    47% of electron downloads last week were affected versions (6.3M).

  • Electron: Off-screen rendering on macOS trusts GPU-supplied frame geometry

    Affected: fixed in 42.11.6; from 43.0.0-alpha.1, fixed in 43.7.3; from 44.0.0-alpha.1, fixed in 44.4.3; from 45.0.0-alpha.1, fixed in 45.0.0-alpha.9.

    Fixed in 42.11.6 (released Sep 18, 2026, 33 days before disclosure), 43.7.3 (released Sep 18, 2026, 33 days before disclosure), 44.4.3 (released Sep 18, 2026, 33 days before disclosure) and 1 other version.

    The latest release, 45.2.3, is not affected.

    38% of electron downloads last week were affected versions (5M).

  • Electron: Frame subscription trusts GPU-supplied frame geometry

    Affected: fixed in 42.11.6; from 43.0.0-alpha.1, fixed in 43.7.3; from 44.0.0-alpha.1, fixed in 44.4.3; from 45.0.0-alpha.1, fixed in 45.0.0-alpha.9.

    Fixed in 42.11.6 (released Sep 18, 2026, 33 days before disclosure), 43.7.3 (released Sep 18, 2026, 33 days before disclosure), 44.4.3 (released Sep 18, 2026, 33 days before disclosure) and 1 other version.

    The latest release, 45.2.3, is not affected.

    38% of electron downloads last week were affected versions (5M).

  • CVE-2026-114121Medium 5.4

    Electron: openExternal permission requests can be attributed to the wrong origin

    Affected: fixed in 42.11.3; from 43.0.0-alpha.1, fixed in 43.7.0; from 44.0.0-alpha.1, fixed in 44.3.0; from 45.0.0-alpha.1, fixed in 45.0.0-alpha.5.

    Fixed in 42.11.3 (released Sep 8, 2026, 43 days before disclosure), 43.7.0 (released Sep 10, 2026, 41 days before disclosure), 44.3.0 (released Sep 8, 2026, 43 days before disclosure) and 1 other version.

    The latest release, 45.2.3, is not affected.

    35% of electron downloads last week were affected versions (4.7M).

  • CVE-2026-113800Medium 5.4

    Electron: HID and USB permission checks can be attributed to the wrong origin

    Affected: from 45.0.0-alpha.1, fixed in 45.0.0-alpha.5; from 44.0.0-alpha.1, fixed in 44.3.0; from 43.0.0-alpha.1, fixed in 43.7.0; fixed in 42.11.3.

    Fixed in 42.11.3 (released Sep 8, 2026, 43 days before disclosure), 43.7.0 (released Sep 10, 2026, 41 days before disclosure), 44.3.0 (released Sep 8, 2026, 43 days before disclosure) and 1 other version.

    The latest release, 45.2.3, is not affected.

    35% of electron downloads last week were affected versions (4.7M).

  • CVE-2026-113798Medium 5.4

    Electron: Pointer lock permission requests can be attributed to the wrong frame

    Affected: from 45.0.0-alpha.1, fixed in 45.0.0-alpha.13; from 44.0.0-alpha.1, fixed in 44.5.0; from 43.0.0-alpha.1, fixed in 43.7.6; fixed in 42.11.9.

    Fixed in 42.11.9 (released Sep 29, 2026, 22 days before disclosure), 43.7.6 (released Sep 29, 2026, 22 days before disclosure), 44.5.0 (released Sep 29, 2026, 22 days before disclosure) and 1 other version.

    The latest release, 45.2.3, is not affected.

    40% of electron downloads last week were affected versions (5.3M).

  • Electron: Extension tabs.query returns tab URLs and titles without the tabs permission

    Affected: from 45.0.0-alpha.1, fixed in 45.0.0-alpha.4; from 44.0.0-alpha.1, fixed in 44.1.1; from 43.0.0-alpha.1, fixed in 43.5.1; fixed in 42.11.1.

    Fixed in 42.11.1 (released Sep 1, 2026, 50 days before disclosure), 43.5.1 (released Sep 1, 2026, 50 days before disclosure), 44.1.1 (released Sep 1, 2026, 50 days before disclosure) and 1 other version.

    The latest release, 45.2.3, is not affected.

    34% of electron downloads last week were affected versions (4.5M).

  • CVE-2026-113796Medium 4.2

    Electron: SameSite cookie restrictions are not applied to windows opened from links

    Affected: from 45.0.0-alpha.1, fixed in 45.0.0-alpha.6; from 44.0.0-alpha.1, fixed in 44.3.0; from 43.0.0-alpha.1, fixed in 43.7.0; fixed in 42.11.3.

    Fixed in 42.11.3 (released Sep 8, 2026, 43 days before disclosure), 43.7.0 (released Sep 10, 2026, 41 days before disclosure), 44.3.0 (released Sep 8, 2026, 43 days before disclosure) and 1 other version.

    The latest release, 45.2.3, is not affected.

    35% of electron downloads last week were affected versions (4.7M).

  • CVE-2026-102672Medium 6.7

    Electron: Local race condition in Squirrel.Mac update installation on macOS

    Affected: fixed in 39.8.10; from 40.0.0-alpha.1, fixed in 41.10.5; from 42.0.0-alpha.1, fixed in 42.0.0-beta.2.

    Fixed in 39.8.10 (released May 5, 2026, 161 days before disclosure), 41.10.5 (released Aug 11, 2026, 63 days before disclosure) and 42.0.0-beta.2 (released Apr 10, 2026, 186 days before disclosure).

    The latest release, 45.2.3, is not affected.

    23% of electron downloads last week were affected versions (3M).

  • Electron: Sandboxed preload code cache can be poisoned by a compromised renderer

    Affected: from 42.3.3, fixed in 42.10.0; from 43.0.0-beta.1, fixed in 43.5.0; from 44.0.0-alpha.1, fixed in 44.0.0-beta.6.

    Fixed in 42.10.0 (released Aug 24, 2026, 36 days before disclosure), 43.5.0 (released Aug 31, 2026, 29 days before disclosure) and 44.0.0-beta.6 (released Aug 20, 2026, 40 days before disclosure).

    The latest release, 45.2.3, is not affected.

    6% of electron downloads last week were affected versions (789.6K).

  • Electron: <webview> can enable Node.js integration in Web Workers despite embedder restrictions

    Affected: fixed in 41.10.6; from 42.0.0-alpha.1, fixed in 42.9.2; from 43.0.0-alpha.1, fixed in 43.4.1; from 44.0.0-alpha.1, fixed in 44.0.0-beta.5.

    Fixed in 41.10.6 (released Aug 18, 2026, 42 days before disclosure), 42.9.2 (released Aug 17, 2026, 43 days before disclosure), 43.4.1 (released Aug 19, 2026, 41 days before disclosure) and 1 other version.

    The latest release, 45.2.3, is not affected.

    31% of electron downloads last week were affected versions (4.1M).

  • Electron: File and HTTP protocol handlers allow cross-origin reads without corsEnabled

    Affected: fixed in 41.10.6; from 42.0.0-alpha.1, fixed in 42.9.2; from 43.0.0-alpha.1, fixed in 43.4.1; from 44.0.0-alpha.1, fixed in 44.0.0-beta.5.

    Fixed in 41.10.6 (released Aug 18, 2026, 42 days before disclosure), 42.9.2 (released Aug 17, 2026, 43 days before disclosure), 43.4.1 (released Aug 19, 2026, 41 days before disclosure) and 1 other version.

    The latest release, 45.2.3, is not affected.

    31% of electron downloads last week were affected versions (4.1M).

  • Electron: Windows opened from a sandboxed top-level document do not inherit its sandbox restrictions

    Affected: fixed in 41.10.6; from 42.0.0-alpha.1, fixed in 42.9.2; from 43.0.0-alpha.1, fixed in 43.4.1; from 44.0.0-alpha.1, fixed in 44.0.0-beta.5.

    Fixed in 41.10.6 (released Aug 18, 2026, 42 days before disclosure), 42.9.2 (released Aug 17, 2026, 43 days before disclosure), 43.4.1 (released Aug 19, 2026, 41 days before disclosure) and 1 other version.

    The latest release, 45.2.3, is not affected.

    31% of electron downloads last week were affected versions (4.1M).

  • Electron drops inherited HTML sandbox restrictions for popups opened through OpenURLFromTab

    Affected: fixed in 41.10.4; from 42.0.0-alpha.1, fixed in 42.5.2; from 43.0.0-alpha.1, fixed in 43.0.0.

    Fixed in 41.10.4 (released Aug 4, 2026, 56 days before disclosure), 42.5.2 (released Jun 30, 2026, 91 days before disclosure) and 43.0.0 (released Jun 30, 2026, 91 days before disclosure).

    The latest release, 45.2.3, is not affected.

    27% of electron downloads last week were affected versions (3.6M).

  • CVE-2026-70612Medium 5.4

    Electron: Sandboxed iframes can launch external protocol handlers

    Affected: fixed in 39.8.8; from 40.0.0-alpha.1, fixed in 40.9.0; from 41.0.0-alpha.1, fixed in 41.2.1; from 42.0.0-alpha.1, fixed in 42.0.0-beta.3.

    Fixed in 39.8.8 (released Apr 16, 2026, 111 days before disclosure), 40.9.1 (released Apr 15, 2026, 112 days before disclosure, the advisory names 40.9.0, which was never published), 41.2.1 (released Apr 16, 2026, 111 days before disclosure) and 1 other version.

    The latest release, 45.2.3, is not affected.

    20% of electron downloads last week were affected versions (2.7M).

Show all 79 advisoriesShow fewer advisories
  • CVE-2026-70611Medium 6.9

    Electron: DevTools embedder handler executes arbitrary files via shell open

    Affected: fixed in 39.8.9; from 40.0.0-alpha.1, fixed in 40.9.2; from 41.0.0-alpha.1, fixed in 41.2.1; from 42.0.0-alpha.1, fixed in 42.0.0-beta.3.

    Fixed in 39.8.9 (released Apr 22, 2026, 105 days before disclosure), 40.9.2 (released Apr 22, 2026, 105 days before disclosure), 41.2.1 (released Apr 16, 2026, 111 days before disclosure) and 1 other version.

    The latest release, 45.2.3, is not affected.

    20% of electron downloads last week were affected versions (2.7M).

  • CVE-2026-70610Medium 5.4

    Electron: contextBridge object copy honors prototype setters

    Affected: fixed in 39.8.9; from 40.0.0-alpha.1, fixed in 40.9.2; from 41.0.0-alpha.1, fixed in 41.2.2; from 42.0.0-alpha.1, fixed in 42.0.0-beta.4.

    Fixed in 39.8.9 (released Apr 22, 2026, 105 days before disclosure), 40.9.2 (released Apr 22, 2026, 105 days before disclosure), 41.2.2 (released Apr 21, 2026, 106 days before disclosure) and 1 other version.

    The latest release, 45.2.3, is not affected.

    21% of electron downloads last week were affected versions (2.7M).

  • CVE-2026-70609Medium 5.7

    Electron: DevTools JavaScript Injection via Unsanitized Dock State Parameter

    Affected: fixed in 39.8.7; from 40.0.0-alpha.1, fixed in 40.9.0; from 41.0.0-alpha.1, fixed in 41.2.0; from 42.0.0-alpha.1, fixed in 42.0.0-beta.1.

    Fixed in 39.8.7 (released Apr 8, 2026, 119 days before disclosure), 40.9.1 (released Apr 15, 2026, 112 days before disclosure, the advisory names 40.9.0, which was never published), 41.2.0 (released Apr 8, 2026, 119 days before disclosure) and 1 other version.

    The latest release, 45.2.3, is not affected.

    20% of electron downloads last week were affected versions (2.7M).

  • Electron: Sandboxed iframe can bypass the allow-popups restriction via the OpenURL navigation path

    Affected: from 42.0.0-alpha.1, fixed in 42.0.1; from 40.0.0-alpha.1, fixed in 41.10.3; fixed in 39.8.10.

    Fixed in 39.8.10 (released May 5, 2026, 92 days before disclosure), 41.10.3 (released Jul 21, 2026, 15 days before disclosure) and 42.0.1 (released May 8, 2026, 89 days before disclosure).

    The latest release, 45.2.3, is not affected.

    22% of electron downloads last week were affected versions (3M).

  • CVE-2026-70607Medium 5.3

    Electron: window.open features string controls some window options considered privileged

    Affected: fixed in 39.8.8; from 40.0.0-alpha.1, fixed in 40.9.0; from 41.0.0-alpha.1, fixed in 41.2.1; from 42.0.0-alpha.1, fixed in 42.0.0-beta.3.

    Fixed in 39.8.8 (released Apr 16, 2026, 111 days before disclosure), 40.9.1 (released Apr 15, 2026, 112 days before disclosure, the advisory names 40.9.0, which was never published), 41.2.1 (released Apr 16, 2026, 111 days before disclosure) and 1 other version.

    The latest release, 45.2.3, is not affected.

    20% of electron downloads last week were affected versions (2.7M).

  • CVE-2026-70606Medium 5.9

    Electron: ProtocolResponse.url reuses the default session cache instead of the registering session

    Affected: from 43.0.0-alpha.1, fixed in 43.0.0; from 42.0.0-alpha.1, fixed in 42.5.1; from 41.0.0-alpha.1, fixed in 41.9.1; from 40.0.0-alpha.1, fixed in 40.10.6.

    Fixed in 40.10.6 (released Jul 1, 2026, 35 days before disclosure), 41.9.1 (released Jun 29, 2026, 37 days before disclosure), 42.5.1 (released Jun 29, 2026, 37 days before disclosure) and 1 other version.

    The latest release, 45.2.3, is not affected.

    5.1% of electron downloads last week were affected versions (671.9K).

  • CVE-2026-70605Medium 5.9

    Electron: HTTP redirect followed into local file loader

    Affected: fixed in 39.8.8; from 40.0.0-alpha.1, fixed in 40.9.1; from 41.0.0-alpha.1, fixed in 41.2.1; from 42.0.0-alpha.1, fixed in 42.0.0-beta.3.

    Fixed in 39.8.8 (released Apr 16, 2026, 111 days before disclosure), 40.9.1 (released Apr 15, 2026, 112 days before disclosure), 41.2.1 (released Apr 16, 2026, 111 days before disclosure) and 1 other version.

    The latest release, 45.2.3, is not affected.

    20% of electron downloads last week were affected versions (2.7M).

  • Electron: Custom protocol with supportFetchAPI but not corsEnabled allows cross-origin reads

    Affected: from 42.0.0-alpha.1, fixed in 42.0.0; from 41.0.0-alpha.1, fixed in 41.4.0; from 40.0.0-alpha.1, fixed in 40.9.3; fixed in 39.8.10.

    Fixed in 39.8.10 (released May 5, 2026, 92 days before disclosure), 40.9.3 (released Apr 30, 2026, 97 days before disclosure), 41.4.0 (released May 1, 2026, 96 days before disclosure) and 1 other version.

    The latest release, 45.2.3, is not affected.

    21% of electron downloads last week were affected versions (2.8M).

  • CVE-2026-70603Medium 6.0

    Electron: shell.openPath path validation bypass via embedded null byte

    Affected: from 42.0.0-alpha.1, fixed in 42.0.0-beta.1; from 41.0.0-alpha.1, fixed in 41.1.1; from 40.0.0-alpha.1, fixed in 40.9.0; fixed in 39.8.6.

    Fixed in 39.8.6 (released Apr 1, 2026, 126 days before disclosure), 40.9.1 (released Apr 15, 2026, 112 days before disclosure, the advisory names 40.9.0, which was never published), 41.1.1 (released Apr 1, 2026, 126 days before disclosure) and 1 other version.

    The latest release, 45.2.3, is not affected.

    20% of electron downloads last week were affected versions (2.6M).

  • CVE-2026-70602Medium 6.6

    Electron: Extension tab APIs operate across session boundaries

    Affected: fixed in 39.8.8; from 40.0.0-alpha.1, fixed in 40.9.0; from 41.0.0-alpha.1, fixed in 41.2.1; from 42.0.0-alpha.1, fixed in 42.0.0-beta.3.

    Fixed in 39.8.8 (released Apr 16, 2026, 111 days before disclosure), 40.9.1 (released Apr 15, 2026, 112 days before disclosure, the advisory names 40.9.0, which was never published), 41.2.1 (released Apr 16, 2026, 111 days before disclosure) and 1 other version.

    The latest release, 45.2.3, is not affected.

    20% of electron downloads last week were affected versions (2.7M).

  • Electron: Context isolation bypass via Function.prototype.bind hijack

    Affected: fixed in 39.8.9; from 40.0.0-alpha.1, fixed in 40.9.2; from 41.0.0-alpha.1, fixed in 41.2.2; from 42.0.0-alpha.1, fixed in 42.0.0-beta.5.

    Fixed in 39.8.9 (released Apr 22, 2026, 105 days before disclosure), 40.9.2 (released Apr 22, 2026, 105 days before disclosure), 41.2.2 (released Apr 21, 2026, 106 days before disclosure) and 1 other version.

    The latest release, 45.2.3, is not affected.

    21% of electron downloads last week were affected versions (2.7M).

  • Electron: Cross-origin iframe can position native autofill popup

    Affected: fixed in 39.8.8; from 40.0.0-alpha.1, fixed in 40.9.1; from 41.0.0-alpha.1, fixed in 41.2.1; from 42.0.0-alpha.1, fixed in 42.0.0-beta.3.

    Fixed in 39.8.8 (released Apr 16, 2026, 111 days before disclosure), 40.9.1 (released Apr 15, 2026, 112 days before disclosure), 41.2.1 (released Apr 16, 2026, 111 days before disclosure) and 1 other version.

    The latest release, 45.2.3, is not affected.

    20% of electron downloads last week were affected versions (2.7M).

  • CVE-2026-70599Medium 5.9

    Electron: Permission Check Handler Receives Main Frame Origin Instead of Requesting Iframe Origin

    Affected: fixed in 39.8.7; from 40.0.0-alpha.1, fixed in 40.9.0; from 41.0.0-alpha.1, fixed in 41.2.0; from 42.0.0-alpha.1, fixed in 42.0.0-beta.1.

    Fixed in 39.8.7 (released Apr 8, 2026, 119 days before disclosure), 40.9.1 (released Apr 15, 2026, 112 days before disclosure, the advisory names 40.9.0, which was never published), 41.2.0 (released Apr 8, 2026, 119 days before disclosure) and 1 other version.

    The latest release, 45.2.3, is not affected.

    20% of electron downloads last week were affected versions (2.7M).

  • Electron: Off-screen rendering trusts GPU-supplied geometry over shared-memory size

    Affected: fixed in 39.8.10; from 40.0.0-alpha.1, fixed in 40.9.0; from 41.0.0-alpha.1, fixed in 41.2.1; from 42.0.0-alpha.1, fixed in 42.0.0-beta.3.

    Fixed in 39.8.10 (released May 5, 2026, 92 days before disclosure), 40.9.1 (released Apr 15, 2026, 112 days before disclosure, the advisory names 40.9.0, which was never published), 41.2.1 (released Apr 16, 2026, 111 days before disclosure) and 1 other version.

    The latest release, 45.2.3, is not affected.

    20% of electron downloads last week were affected versions (2.7M).

  • CVE-2026-70597Medium 6.3

    Electron: Parent process code-sign check is spoofable

    Affected: fixed in 39.8.8; from 40.0.0-alpha.1, fixed in 40.9.1; from 41.0.0-alpha.1, fixed in 41.2.1; from 42.0.0-alpha.1, fixed in 42.0.0-beta.3.

    Fixed in 39.8.8 (released Apr 16, 2026, 111 days before disclosure), 40.9.1 (released Apr 15, 2026, 112 days before disclosure), 41.2.1 (released Apr 16, 2026, 111 days before disclosure) and 1 other version.

    The latest release, 45.2.3, is not affected.

    20% of electron downloads last week were affected versions (2.7M).

  • CVE-2026-54257Critical 9.3

    Electron: Buffer performs incorrect byte length calculations resulting in heap buffer under/overflow

    Affected: from 42.3.1, fixed in 42.3.3.

    Fixed in 42.3.3 (released Jun 3, 2026, 20 days before disclosure).

    The latest release, 45.2.3, is not affected.

    <0.1% of electron downloads last week were affected versions (1.4K).

  • Electron crashes in clipboard.readImage() on malformed clipboard image data

    Affected: fixed in 39.8.5; from 40.0.0-alpha.1, fixed in 40.8.5; from 41.0.0-alpha.1, fixed in 41.1.0; from 42.0.0-alpha.1, fixed in 42.0.0-alpha.5.

    Fixed in 39.8.5 (released Mar 27, 2026, 11 days before disclosure), 40.8.5 (released Mar 26, 2026, 12 days before disclosure), 41.1.0 (released Mar 27, 2026, 11 days before disclosure) and 1 other version.

    The latest release, 45.2.3, is not affected.

    20% of electron downloads last week were affected versions (2.6M).

  • CVE-2026-34765Medium 6.0

    Electron named window.open targets not scoped to the opener's browsing context

    Affected: fixed in 39.8.5; from 40.0.0-alpha.1, fixed in 40.8.5; from 41.0.0-alpha.1, fixed in 41.1.0; from 42.0.0-alpha.1, fixed in 42.0.0-alpha.5.

    Fixed in 39.8.5 (released Mar 27, 2026, 11 days before disclosure), 40.8.5 (released Mar 26, 2026, 12 days before disclosure), 41.1.0 (released Mar 27, 2026, 11 days before disclosure) and 1 other version.

    The latest release, 45.2.3, is not affected.

    20% of electron downloads last week were affected versions (2.6M).

  • Electron has a use-after-free in offscreen shared texture release() callback

    Affected: from 33.0.0-alpha.1, fixed in 39.8.5; from 40.0.0-alpha.1, fixed in 40.8.5; from 41.0.0-alpha.1, fixed in 41.1.0; from 42.0.0-alpha.1, fixed in 42.0.0-alpha.5.

    Fixed in 39.8.5 (released Mar 27, 2026, 10 days before disclosure), 40.8.5 (released Mar 26, 2026, 11 days before disclosure), 41.1.0 (released Mar 27, 2026, 10 days before disclosure) and 1 other version.

    The latest release, 45.2.3, is not affected.

    11% of electron downloads last week were affected versions (1.5M).

  • Electron: Context Isolation bypass via contextBridge VideoFrame transfer

    Affected: from 39.0.0-alpha.1, fixed in 39.8.0; from 40.0.0-alpha.1, fixed in 40.7.0; from 41.0.0-alpha.1, fixed in 41.0.0-beta.8.

    Fixed in 39.8.0 (released Mar 4, 2026, 31 days before disclosure), 40.7.0 (released Mar 4, 2026, 31 days before disclosure) and 41.0.0-beta.8 (released Mar 6, 2026, 29 days before disclosure).

    The latest release, 45.2.3, is not affected.

    1% of electron downloads last week were affected versions (136.2K).

  • CVE-2026-34779Medium 6.5

    Electron: AppleScript injection in app.moveToApplicationsFolder on macOS

    Affected: fixed in 38.8.6; from 39.0.0-alpha.1, fixed in 39.8.1; from 40.0.0-alpha.1, fixed in 40.8.0; from 41.0.0-alpha.1, fixed in 41.0.0-beta.8.

    Fixed in 38.8.6 (released Mar 11, 2026, 24 days before disclosure), 39.8.1 (released Mar 12, 2026, 23 days before disclosure), 40.8.0 (released Mar 5, 2026, 30 days before disclosure) and 1 other version.

    The latest release, 45.2.3, is not affected.

    18% of electron downloads last week were affected versions (2.4M).

  • CVE-2026-34778Medium 5.9

    Electron: Service worker can spoof executeJavaScript IPC replies

    Affected: fixed in 38.8.6; from 39.0.0-alpha.1, fixed in 39.8.1; from 40.0.0-alpha.1, fixed in 40.8.1; from 41.0.0-alpha.1, fixed in 41.0.0.

    Fixed in 38.8.6 (released Mar 11, 2026, 23 days before disclosure), 39.8.1 (released Mar 12, 2026, 22 days before disclosure), 40.8.1 (released Mar 12, 2026, 22 days before disclosure) and 1 other version.

    The latest release, 45.2.3, is not affected.

    18% of electron downloads last week were affected versions (2.4M).

  • CVE-2026-34777Medium 5.4

    Electron: Incorrect origin passed to permission request handler for iframe requests

    Affected: fixed in 38.8.6; from 39.0.0-alpha.1, fixed in 39.8.1; from 40.0.0-alpha.1, fixed in 40.8.1; from 41.0.0-alpha.1, fixed in 41.0.0.

    Fixed in 38.8.6 (released Mar 11, 2026, 23 days before disclosure), 39.8.1 (released Mar 12, 2026, 22 days before disclosure), 40.8.1 (released Mar 12, 2026, 22 days before disclosure) and 1 other version.

    The latest release, 45.2.3, is not affected.

    18% of electron downloads last week were affected versions (2.4M).

  • CVE-2026-34776Medium 5.3

    Electron: Out-of-bounds read in second-instance IPC on macOS and Linux

    Affected: fixed in 38.8.6; from 39.0.0-alpha.1, fixed in 39.8.1; from 40.0.0-alpha.1, fixed in 40.8.1; from 41.0.0-alpha.1, fixed in 41.0.0.

    Fixed in 38.8.6 (released Mar 11, 2026, 23 days before disclosure), 39.8.1 (released Mar 12, 2026, 22 days before disclosure), 40.8.1 (released Mar 12, 2026, 22 days before disclosure) and 1 other version.

    The latest release, 45.2.3, is not affected.

    18% of electron downloads last week were affected versions (2.4M).

  • CVE-2026-34775Medium 6.8

    Electron: nodeIntegrationInWorker not correctly scoped in shared renderer processes

    Affected: fixed in 38.8.6; from 39.0.0-alpha.1, fixed in 39.8.4; from 40.0.0-alpha.1, fixed in 40.8.4; from 41.0.0-alpha.1, fixed in 41.0.0.

    Fixed in 38.8.6 (released Mar 11, 2026, 23 days before disclosure), 39.8.4 (released Mar 25, 2026, 9 days before disclosure), 40.8.4 (released Mar 25, 2026, 9 days before disclosure) and 1 other version.

    The latest release, 45.2.3, is not affected.

    19% of electron downloads last week were affected versions (2.5M).

  • Electron: Use-after-free in offscreen child window paint callback

    Affected: fixed in 39.8.1; from 40.0.0-alpha.1, fixed in 40.7.0; from 41.0.0-alpha.1, fixed in 41.0.0.

    Fixed in 39.8.1 (released Mar 12, 2026, 22 days before disclosure), 40.7.0 (released Mar 4, 2026, 30 days before disclosure) and 41.0.0 (released Mar 11, 2026, 23 days before disclosure).

    The latest release, 45.2.3, is not affected.

    19% of electron downloads last week were affected versions (2.5M).

  • CVE-2026-34773Medium 4.7

    Electron: Registry key path injection in app.setAsDefaultProtocolClient on Windows

    Affected: fixed in 38.8.6; from 39.0.0-alpha.1, fixed in 39.8.1; from 40.0.0-alpha.1, fixed in 40.8.1; from 41.0.0-alpha.1, fixed in 41.0.0.

    Fixed in 38.8.6 (released Mar 11, 2026, 23 days before disclosure), 39.8.1 (released Mar 12, 2026, 22 days before disclosure), 40.8.1 (released Mar 12, 2026, 22 days before disclosure) and 1 other version.

    The latest release, 45.2.3, is not affected.

    18% of electron downloads last week were affected versions (2.4M).

  • CVE-2026-34772Medium 5.8

    Electron: Use-after-free in download save dialog callback

    Affected: fixed in 38.8.6; from 39.0.0-alpha.1, fixed in 39.8.0; from 40.0.0-alpha.1, fixed in 40.7.0; from 41.0.0-alpha.1, fixed in 41.0.0-beta.7.

    Fixed in 38.8.6 (released Mar 11, 2026, 23 days before disclosure), 39.8.0 (released Mar 4, 2026, 30 days before disclosure), 40.7.0 (released Mar 4, 2026, 30 days before disclosure) and 1 other version.

    The latest release, 45.2.3, is not affected.

    18% of electron downloads last week were affected versions (2.4M).

  • Electron: Use-after-free in WebContents fullscreen, pointer-lock, and keyboard-lock permission callbacks

    Affected: fixed in 38.8.6; from 39.0.0-alpha.1, fixed in 39.8.0; from 40.0.0-alpha.1, fixed in 40.7.0; from 41.0.0-alpha.1, fixed in 41.0.0-beta.8.

    Fixed in 38.8.6 (released Mar 11, 2026, 23 days before disclosure), 39.8.0 (released Mar 4, 2026, 30 days before disclosure), 40.7.0 (released Mar 4, 2026, 30 days before disclosure) and 1 other version.

    The latest release, 45.2.3, is not affected.

    18% of electron downloads last week were affected versions (2.4M).

  • Electron: Use-after-free in PowerMonitor on Windows and macOS

    Affected: fixed in 38.8.6; from 39.0.0-alpha.1, fixed in 39.8.1; from 40.0.0-alpha.1, fixed in 40.8.0; from 41.0.0-alpha.1, fixed in 41.0.0-beta.8.

    Fixed in 38.8.6 (released Mar 11, 2026, 23 days before disclosure), 39.8.1 (released Mar 12, 2026, 22 days before disclosure), 40.8.0 (released Mar 5, 2026, 29 days before disclosure) and 1 other version.

    The latest release, 45.2.3, is not affected.

    18% of electron downloads last week were affected versions (2.4M).

  • Electron: Unquoted executable path in app.setLoginItemSettings on Windows

    Affected: fixed in 38.8.6; from 39.0.0-alpha.1, fixed in 39.8.1; from 40.0.0-alpha.1, fixed in 40.8.0; from 41.0.0-alpha.1, fixed in 41.0.0-beta.8.

    Fixed in 38.8.6 (released Mar 11, 2026, 23 days before disclosure), 39.8.1 (released Mar 12, 2026, 22 days before disclosure), 40.8.0 (released Mar 5, 2026, 29 days before disclosure) and 1 other version.

    The latest release, 45.2.3, is not affected.

    18% of electron downloads last week were affected versions (2.4M).

  • CVE-2026-34767Medium 5.9

    Electron: HTTP Response Header Injection in custom protocol handlers and webRequest

    Affected: fixed in 38.8.6; from 39.0.0-alpha.1, fixed in 39.8.3; from 40.0.0-alpha.1, fixed in 40.8.3; from 41.0.0-alpha.1, fixed in 41.0.3.

    Fixed in 38.8.6 (released Mar 11, 2026, 23 days before disclosure), 39.8.3 (released Mar 17, 2026, 17 days before disclosure), 40.8.3 (released Mar 17, 2026, 17 days before disclosure) and 1 other version.

    The latest release, 45.2.3, is not affected.

    19% of electron downloads last week were affected versions (2.5M).

  • Electron: USB device selection not validated against filtered device list

    Affected: fixed in 38.8.6; from 39.0.0-alpha.1, fixed in 39.8.0; from 40.0.0-alpha.1, fixed in 40.7.0; from 41.0.0-alpha.1, fixed in 41.0.0-beta.8.

    Fixed in 38.8.6 (released Mar 11, 2026, 23 days before disclosure), 39.8.0 (released Mar 4, 2026, 30 days before disclosure), 40.7.0 (released Mar 4, 2026, 30 days before disclosure) and 1 other version.

    The latest release, 45.2.3, is not affected.

    18% of electron downloads last week were affected versions (2.4M).

  • Electron: Renderer command-line switch injection via undocumented commandLineSwitches webPreference

    Affected: fixed in 38.8.6; from 39.0.0-alpha.1, fixed in 39.8.0; from 40.0.0-alpha.1, fixed in 40.7.0; from 41.0.0-alpha.1, fixed in 41.0.0-beta.8.

    Fixed in 38.8.6 (released Mar 11, 2026, 23 days before disclosure), 39.8.0 (released Mar 4, 2026, 30 days before disclosure), 40.7.0 (released Mar 4, 2026, 30 days before disclosure) and 1 other version.

    The latest release, 45.2.3, is not affected.

    18% of electron downloads last week were affected versions (2.4M).

  • CVE-2025-55305Medium 6.1

    Electron is vulnerable to Code Injection via resource modification

    Affected: fixed in 35.7.5; from 36.0.0-alpha.1, fixed in 36.8.1; from 37.0.0-alpha.1, fixed in 37.3.1; from 38.0.0-alpha.1, fixed in 38.0.0-beta.6.

    Fixed in 35.7.5 (released Aug 19, 2025, 16 days before disclosure), 36.8.1 (released Aug 19, 2025, 16 days before disclosure), 37.3.1 (released Aug 19, 2025, 16 days before disclosure) and 1 other version.

    The latest release, 45.2.3, is not affected.

    14% of electron downloads last week were affected versions (1.8M).

  • CVE-2024-46993Medium 4.4

    Electron Vulnerable to Heap Buffer Overflow in NativeImage::CreateFromPath

    Affected: fixed in 28.3.2; from 29.0.0-alpha.1, fixed in 29.3.3; from 30.0.0-alpha.1, fixed in 30.0.3.

    Fixed in 28.3.2, 29.3.3 and 30.0.3.

    The latest release, 45.2.3, is not affected.

    5.6% of electron downloads last week were affected versions (742.1K).

  • Electron ASAR Integrity bypass by just modifying the content

    Affected: from 30.0.0-alpha.1, fixed in 30.0.5; from 31.0.0-alpha.1, fixed in 31.0.0-beta.1.

    Fixed in 30.0.5 and 31.0.0-beta.1.

    The latest release, 45.2.3, is not affected.

    <0.1% of electron downloads last week were affected versions (5.2K).

  • CVE-2023-44402Medium 6.1

    ASAR Integrity bypass via filetype confusion in electron

    Affected: fixed in 22.3.24; from 24.0.0-alpha.1, fixed in 24.8.3; from 25.0.0-alpha.1, fixed in 25.8.1; from 26.0.0-alpha.1, fixed in 26.2.1; from 27.0.0-alpha.1, fixed in 27.0.0-alpha.7; from 23.0.0-alpha.1, through 23.3.13.

    Fixed in 22.3.24, 24.8.3, 25.8.1 and 2 other versions.

    The latest release, 45.2.3, is not affected.

    4.6% of electron downloads last week were affected versions (606.1K).

  • CVE-2023-5217High 8.8 · KEV

    Heap buffer overflow in vp8 encoding in libvpx in Google Chrome prior to 117.0.5938.132 and libvpx 1.13.1 allowed a remote attacker to poten

    Affected: fixed in 22.3.25; from 24.0.0, fixed in 24.8.5; from 25.0.0, fixed in 25.8.4; from 26.0.0, fixed in 26.2.4; from 27.0.0-alpha.1, fixed in 27.0.0-beta.8.

    Fixed in 22.3.25, 24.8.5, 25.8.4 and 2 other versions.

    The latest release, 45.2.3, is not affected.

    2.3% of electron downloads last week were affected versions (298.3K).

  • CVE-2023-4863High 8.8 · KEV

    Heap buffer overflow in libwebp in Google Chrome prior to 116.0.5845.187 and libwebp 1.3.2 allowed a remote attacker to perform an out of bo

    Affected: from 22.0.0, fixed in 22.3.24; from 24.0.0, fixed in 24.8.3; from 25.0.0, fixed in 25.8.1; from 26.0.0, fixed in 26.2.1; from 27.0.0-beta.1, fixed in 27.0.0-beta.2.

    Fixed in 22.3.24, 24.8.3, 25.8.1 and 2 other versions.

    The latest release, 45.2.3, is not affected.

    0.1% of electron downloads last week were affected versions (17.2K).

  • Content-Secrity-Policy disabling eval not applied consistently in renderers with sandbox disabled in Electron

    Affected: from 22.0.0-beta.1, fixed in 22.0.1; from 23.0.0-alpha.1, fixed in 23.0.0-alpha.2.

    Fixed in 22.0.1 and 23.0.0-alpha.2.

    The latest release, 45.2.3, is not affected.

    <0.1% of electron downloads last week were affected versions (2.6K).

  • CVE-2023-29198Medium 6.0

    Context isolation bypass via nested unserializable return value in Electron

    Affected: fixed in 22.3.6; from 23.0.0-alpha.1, fixed in 23.2.3; from 24.0.0-alpha.1, fixed in 24.0.1; from 25.0.0-alpha.1, fixed in 25.0.0-alpha.2.

    Fixed in 22.3.6, 23.2.3, 24.0.1 and 1 other version.

    The latest release, 45.2.3, is not affected.

    2.3% of electron downloads last week were affected versions (300.1K).

  • CVE-2023-39956Medium 6.1

    Electron: Out-of-package code execution when launched with arbitrary cwd

    Affected: fixed in 22.3.19; from 23.0.0-alpha.1, fixed in 23.3.13; from 24.0.0-alpha.1, fixed in 24.7.1; from 25.0.0-alpha.1, fixed in 25.5.0; from 26.0.0-alpha.1, fixed in 26.0.0-beta.13.

    Fixed in 22.3.19, 23.3.13, 24.7.1 and 2 other versions.

    The latest release, 45.2.3, is not affected.

    2.5% of electron downloads last week were affected versions (336.7K).

  • CVE-2022-4135Critical 9.6 · KEV

    Heap buffer overflow in GPU in Google Chrome prior to 107.0.5304.121 allowed a remote attacker who had compromised the renderer process to p

    Affected: from 19.0.0, fixed in 19.1.8.

    Fixed in 19.1.8.

    The latest release, 45.2.3, is not affected.

    <0.1% of electron downloads last week were affected versions (9.2K).

  • Electron subject to Exfiltration of hashed SMB credentials on Windows via file:// redirect

    Affected: fixed in 18.3.7; from 20.0.0-beta.1, fixed in 20.0.1; from 19.0.0-beta.1, fixed in 19.0.11.

    Fixed in 18.3.7, 19.0.11 and 20.0.1.

    The latest release, 45.2.3, is not affected.

    1.9% of electron downloads last week were affected versions (245.6K).

  • CVE-2022-29257Medium 6.6

    Electron's AutoUpdater module fails to validate certain nested components of the bundle

    Affected: fixed in 15.5.0; from 16.0.0, fixed in 16.2.0; from 17.0.0, fixed in 17.2.0; from 18.0.0-beta.1, fixed in 18.0.0-beta.6.

    Fixed in 15.5.0, 16.2.0, 17.2.0 and 1 other version.

    The latest release, 45.2.3, is not affected.

    1.6% of electron downloads last week were affected versions (218.2K).

  • Exposure of Resource to Wrong Sphere in Electron

    Affected: fixed in 15.5.5; from 16.0.0, fixed in 16.2.6; from 17.0.0, fixed in 17.2.0; from 18.0.0-beta.1, fixed in 18.0.0-beta.6.

    Fixed in 15.5.5, 16.2.6, 17.2.0 and 1 other version.

    The latest release, 45.2.3, is not affected.

    1.6% of electron downloads last week were affected versions (218.6K).

  • Renderers can obtain access to random bluetooth device without permission in Electron

    Affected: fixed in 13.6.6; from 14.0.0-beta.1, fixed in 14.2.4; from 15.0.0-beta.1, fixed in 15.3.5; from 16.0.0-beta.1, fixed in 16.0.6; from 17.0.0-alpha.1, fixed in 17.0.0-alpha.6.

    Fixed in 13.6.6, 14.2.4, 15.3.5 and 2 other versions.

    The latest release, 45.2.3, is not affected.

    1.6% of electron downloads last week were affected versions (205.7K).

  • CVE-2021-39184Medium 6.8

    Sandboxed renderers can obtain thumbnails of arbitrary files through the nativeImage API

    Affected: fixed in 11.5.0; from 12.0.0, fixed in 12.1.0; from 13.0.0, fixed in 13.3.0.

    Fixed in 11.5.0, 12.1.0 and 13.3.0.

    The latest release, 45.2.3, is not affected.

    1% of electron downloads last week were affected versions (138.7K).

  • CVE-2020-26272Medium 5.4

    Electron vulnerable to ID collision when routing IPC messages to renderers containing OOPIFs

    Affected: fixed in 9.4.0; from 10.0.0, fixed in 10.2.0; from 11.0.0, fixed in 11.1.0.

    Fixed in 9.4.0, 10.2.0 and 11.1.0.

    The latest release, 45.2.3, is not affected.

    0.8% of electron downloads last week were affected versions (106.5K).

  • CVE-2020-15215Medium 5.6

    Context isolation bypass in Electron

    Affected: from 8.0.0-beta.0, fixed in 8.5.2; from 9.0.0-beta.0, fixed in 9.3.1; from 10.0.0-beta.0, fixed in 10.1.2; from 11.0.0-beta.0, fixed in 11.0.0-beta.6.

    Fixed in 8.5.2, 9.3.1, 10.1.2 and 1 other version.

    The latest release, 45.2.3, is not affected.

    <0.1% of electron downloads last week were affected versions (9.7K).

  • Unpreventable top-level navigation in Electron

    Affected: from 8.0.0-beta.0, fixed in 8.5.1; from 9.0.0-beta.0, fixed in 9.3.0; from 10.0.0-beta.0, fixed in 10.0.1.

    Fixed in 8.5.1, 9.3.0 and 10.0.1.

    The latest release, 45.2.3, is not affected.

    <0.1% of electron downloads last week were affected versions (9.1K).

  • CVE-2020-15096Medium 6.8

    Context isolation bypass via Promise in Electron

    Affected: fixed in 6.1.11; from 7.0.0, fixed in 7.2.4; from 8.0.0, fixed in 8.2.4.

    Fixed in 6.1.11, 7.2.4 and 8.2.4.

    The latest release, 45.2.3, is not affected.

    0.7% of electron downloads last week were affected versions (86.9K).

  • CVE-2020-4075Medium 6.8

    Arbitrary file read via window-open IPC in Electron

    Affected: fixed in 7.2.4; from 8.0.0, fixed in 8.2.4.

    Fixed in 7.2.4 and 8.2.4.

    The latest release, 45.2.3, is not affected.

    0.7% of electron downloads last week were affected versions (88.6K).

  • Context isolation bypass via leaked cross-context objects in Electron

    Affected: fixed in 7.2.4; from 8.0.0, fixed in 8.2.4.

    Fixed in 7.2.4 and 8.2.4.

    The latest release, 45.2.3, is not affected.

    0.7% of electron downloads last week were affected versions (88.6K).

  • Context isolation bypass via contextBridge in Electron

    Affected: fixed in 7.2.4; from 8.0.0, fixed in 8.2.4.

    Fixed in 7.2.4 and 8.2.4.

    The latest release, 45.2.3, is not affected.

    0.7% of electron downloads last week were affected versions (88.6K).

  • GitHub Electron 1.7.15, 1.8.7, 2.0.7, and 3.0.0-beta.6, in certain scenarios involving IFRAME elements and "nativeWindowOpen: true" or…

    Affected: from 1.7.0, fixed in 1.7.16; from 1.8.0, fixed in 1.8.8; from 2.0.0, fixed in 2.0.8; from 3.0.0-beta.1, fixed in 3.0.0-beta.7.

    Fixed in 1.7.16, 1.8.8, 2.0.8 and 1 other version.

    The latest release, 45.2.3, is not affected.

    <0.1% of electron downloads last week were affected versions (11.4K).

  • Based on details posted by the ElectronJS team; A remote code execution vulnerability has been discovered in Google Chromium that affects…

    Affected: fixed in 1.6.14; from 1.7.0, fixed in 1.7.8.

    Fixed in 1.6.14 and 1.7.8.

    The latest release, 45.2.3, is not affected.

    0.1% of electron downloads last week were affected versions (14.7K).

  • Electron version 1.7 up to 1.7.12; 1.8 up to 1.8.3 and 2.0.0 up to 2.0.0-beta.3 contains an improper handling of values vulnerability in…

    Affected: from 1.7.0, fixed in 1.7.13; from 1.8.0, fixed in 1.8.4; from 2.0.0-beta.1, fixed in 2.0.0-beta.5.

    Fixed in 1.7.13, 1.8.4 and 2.0.0-beta.5.

    The latest release, 45.2.3, is not affected.

    <0.1% of electron downloads last week were affected versions (6.5K).

  • Github Electron version Electron 1.8.2-beta.4 and earlier contains a Command Injection vulnerability in Protocol Handler that can result…

    Affected: fixed in 1.8.2-beta5.

    Fixed in 1.8.2-beta5.

    The latest release, 45.2.3, is not affected.

    0.1% of electron downloads last week were affected versions (19.8K).

  • GitHub Electron versions 1.8.2-beta.3 and earlier, 1.7.10 and earlier, 1.6.15 and earlier has a vulnerability in the protocol handler…

    Affected: from 1.7.0, fixed in 1.7.11; from 1.6.0, fixed in 1.6.16; from 1.8.0, fixed in 1.8.2-beta.4.

    Fixed in 1.6.16, 1.7.11 and 1.8.2-beta.4.

    The latest release, 45.2.3, is not affected.

    <0.1% of electron downloads last week were affected versions (6.6K).

  • Github Electron version 1.6.4 - 1.6.11 and 1.7.0 - 1.7.5 is vulnerable to a URL Spoofing problem when opening PDFs in PDFium resulting…

    Affected: from 1.7.0, fixed in 1.7.6.

    Fixed in 1.7.6.

    The latest release, 45.2.3, is not affected.

    <0.1% of electron downloads last week were affected versions (669).

  • GitHub Electron before 1.6.8 allows remote command execution because of a nodeIntegration bypass vulnerability.

    Affected: fixed in 1.6.8.

    Fixed in 1.6.8.

    The latest release, 45.2.3, is not affected.

    <0.1% of electron downloads last week were affected versions (12.6K).

  • Untrusted search path vulnerability in Atom Electron before 0.33.5 allows local users to gain privileges via a Trojan horse Node.js module…

    Affected: fixed in 0.33.5.

    Fixed in 0.33.5.

    The latest release, 45.2.3, is not affected.

    <0.1% of electron downloads last week were affected versions (9.2K).