# electron (npm) vulnerabilities

79 known vulnerabilities (2 critical, 22 high, 36 medium, 11 low), with the versions each affects and the releases that fix them.

## At a glance

- Latest release: 45.2.3 (Nov 4, 2026): no advisory affects it
- Newest unaffected release: 45.2.3 (Nov 4, 2026), the latest release
- Weekly downloads: 11.7M
- Dependents: 215
- Releases: 500+ since 32.3.1 (Feb 14, 2025)
- Registry: https://www.npmjs.com/package/electron
- Releases read: Nov 8, 2026

## Version timeline

Affected versions per advisory, in version order:

- CVE-2026-115570: 32.3.1 to 42.11.15 (42.11.16 is outside it); 43.0.0-alpha.1 to 43.8.0 (43.8.1 is outside it); 44.0.0-alpha.1 to 44.9.0 (44.9.1 is outside it); 45.0.0-alpha.1 to 45.0.0-beta.5 (45.0.0-beta.6 is outside it)
- CVE-2026-114124: 32.3.1 to 42.11.5 (42.11.6 is outside it); 43.0.0-alpha.1 to 43.7.2 (43.7.3 is outside it); 44.0.0-alpha.1 to 44.4.2 (44.4.3 is outside it); 45.0.0-alpha.1 to 45.0.0-alpha.8 (45.0.0-alpha.9 is outside it)
- CVE-2026-114122: 32.3.1 to 42.11.5 (42.11.6 is outside it); 43.0.0-alpha.1 to 43.7.2 (43.7.3 is outside it); 44.0.0-alpha.1 to 44.4.2 (44.4.3 is outside it); 45.0.0-alpha.1 to 45.0.0-alpha.8 (45.0.0-alpha.9 is outside it)
- CVE-2026-114121: 32.3.1 to 42.11.2 (42.11.3 is outside it); 43.0.0-alpha.1 to 43.6.0 (43.7.0 is outside it); 44.0.0-alpha.1 to 44.2.0 (44.3.0 is outside it); 45.0.0-alpha.1 to 45.0.0-alpha.4 (45.0.0-alpha.5 is outside it)
- CVE-2026-113800: 32.3.1 to 42.11.2 (42.11.3 is outside it); 43.0.0-alpha.1 to 43.6.0 (43.7.0 is outside it); 44.0.0-alpha.1 to 44.2.0 (44.3.0 is outside it); 45.0.0-alpha.1 to 45.0.0-alpha.4 (45.0.0-alpha.5 is outside it)
- CVE-2026-113798: 32.3.1 to 42.11.8 (42.11.9 is outside it); 43.0.0-alpha.1 to 43.7.5 (43.7.6 is outside it); 44.0.0-alpha.1 to 44.4.5 (44.5.0 is outside it); 45.0.0-alpha.1 to 45.0.0-alpha.12 (45.0.0-alpha.13 is outside it)
- CVE-2026-113797: 32.3.1 to 42.11.0 (42.11.1 is outside it); 43.0.0-alpha.1 to 43.5.0 (43.5.1 is outside it); 44.0.0-alpha.1 to 44.1.0 (44.1.1 is outside it); 45.0.0-alpha.1 to 45.0.0-alpha.3 (45.0.0-alpha.4 is outside it)
- CVE-2026-113796: 32.3.1 to 42.11.2 (42.11.3 is outside it); 43.0.0-alpha.1 to 43.6.0 (43.7.0 is outside it); 44.0.0-alpha.1 to 44.2.0 (44.3.0 is outside it); 45.0.0-alpha.1 to 45.0.0-alpha.5 (45.0.0-alpha.6 is outside it)
- CVE-2026-102672: 32.3.1 to 39.8.9 (39.8.10 is outside it); 40.0.0-alpha.2 to 41.10.4 (41.10.5 is outside it); 42.0.0-alpha.1 to 42.0.0-beta.1 (42.0.0-beta.2 is outside it)
- CVE-2026-102677: 42.3.3 to 42.9.3 (42.10.0 is outside it); 43.0.0-beta.1 to 43.4.1 (43.5.0 is outside it); 44.0.0-alpha.1 to 44.0.0-beta.5 (44.0.0-beta.6 is outside it)
- CVE-2026-102676: 32.3.1 to 41.10.5 (41.10.6 is outside it); 42.0.0-alpha.1 to 42.9.1 (42.9.2 is outside it); 43.0.0-alpha.1 to 43.4.0 (43.4.1 is outside it); 44.0.0-alpha.1 to 44.0.0-beta.4 (44.0.0-beta.5 is outside it)
- CVE-2026-102675: 32.3.1 to 41.10.5 (41.10.6 is outside it); 42.0.0-alpha.1 to 42.9.1 (42.9.2 is outside it); 43.0.0-alpha.1 to 43.4.0 (43.4.1 is outside it); 44.0.0-alpha.1 to 44.0.0-beta.4 (44.0.0-beta.5 is outside it)
- CVE-2026-102674: 32.3.1 to 41.10.5 (41.10.6 is outside it); 42.0.0-alpha.1 to 42.9.1 (42.9.2 is outside it); 43.0.0-alpha.1 to 43.4.0 (43.4.1 is outside it); 44.0.0-alpha.1 to 44.0.0-beta.4 (44.0.0-beta.5 is outside it)
- CVE-2026-102673: 32.3.1 to 41.10.3 (41.10.4 is outside it); 42.0.0-alpha.1 to 42.5.1 (42.5.2 is outside it); 43.0.0-alpha.1 to 43.0.0-beta.8 (43.0.0 is outside it)
- CVE-2026-70612: 32.3.1 to 39.8.7 (39.8.8 is outside it); 40.0.0-alpha.2 to 40.8.5 (40.9.1 is outside it); 41.0.0-alpha.1 to 41.2.0 (41.2.1 is outside it); 42.0.0-alpha.1 to 42.0.0-beta.2 (42.0.0-beta.3 is outside it)
- CVE-2026-70611: 32.3.1 to 39.8.8 (39.8.9 is outside it); 40.0.0-alpha.2 to 40.9.1 (40.9.2 is outside it); 41.0.0-alpha.1 to 41.2.0 (41.2.1 is outside it); 42.0.0-alpha.1 to 42.0.0-beta.2 (42.0.0-beta.3 is outside it)
- CVE-2026-70610: 32.3.1 to 39.8.8 (39.8.9 is outside it); 40.0.0-alpha.2 to 40.9.1 (40.9.2 is outside it); 41.0.0-alpha.1 to 41.2.1 (41.2.2 is outside it); 42.0.0-alpha.1 to 42.0.0-beta.3 (42.0.0-beta.4 is outside it)
- CVE-2026-70609: 32.3.1 to 39.8.6 (39.8.7 is outside it); 40.0.0-alpha.2 to 40.8.5 (40.9.1 is outside it); 41.0.0-alpha.1 to 41.1.1 (41.2.0 is outside it); 42.0.0-alpha.1 to 42.0.0-alpha.6 (42.0.0-beta.1 is outside it)
- CVE-2026-70608: 32.3.1 to 39.8.9 (39.8.10 is outside it); 40.0.0-alpha.2 to 41.10.2 (41.10.3 is outside it); 42.0.0-alpha.1 to 42.0.0 (42.0.1 is outside it)
- CVE-2026-70607: 32.3.1 to 39.8.7 (39.8.8 is outside it); 40.0.0-alpha.2 to 40.8.5 (40.9.1 is outside it); 41.0.0-alpha.1 to 41.2.0 (41.2.1 is outside it); 42.0.0-alpha.1 to 42.0.0-beta.2 (42.0.0-beta.3 is outside it)
- CVE-2026-70606: 40.0.0-alpha.2 to 40.10.5 (40.10.6 is outside it); 41.0.0-alpha.1 to 41.9.0 (41.9.1 is outside it); 42.0.0-alpha.1 to 42.5.0 (42.5.1 is outside it); 43.0.0-alpha.1 to 43.0.0-beta.8 (43.0.0 is outside it)
- CVE-2026-70605: 32.3.1 to 39.8.7 (39.8.8 is outside it); 40.0.0-alpha.2 to 40.8.5 (40.9.1 is outside it); 41.0.0-alpha.1 to 41.2.0 (41.2.1 is outside it); 42.0.0-alpha.1 to 42.0.0-beta.2 (42.0.0-beta.3 is outside it)
- CVE-2026-70604: 32.3.1 to 39.8.9 (39.8.10 is outside it); 40.0.0-alpha.2 to 40.9.2 (40.9.3 is outside it); 41.0.0-alpha.1 to 41.3.0 (41.4.0 is outside it); 42.0.0-alpha.1 to 42.0.0-beta.8 (42.0.0 is outside it)
- CVE-2026-70603: 32.3.1 to 39.8.5 (39.8.6 is outside it); 40.0.0-alpha.2 to 40.8.5 (40.9.1 is outside it); 41.0.0-alpha.1 to 41.1.0 (41.1.1 is outside it); 42.0.0-alpha.1 to 42.0.0-alpha.6 (42.0.0-beta.1 is outside it)
- CVE-2026-70602: 32.3.1 to 39.8.7 (39.8.8 is outside it); 40.0.0-alpha.2 to 40.8.5 (40.9.1 is outside it); 41.0.0-alpha.1 to 41.2.0 (41.2.1 is outside it); 42.0.0-alpha.1 to 42.0.0-beta.2 (42.0.0-beta.3 is outside it)
- CVE-2026-70601: 32.3.1 to 39.8.8 (39.8.9 is outside it); 40.0.0-alpha.2 to 40.9.1 (40.9.2 is outside it); 41.0.0-alpha.1 to 41.2.1 (41.2.2 is outside it); 42.0.0-alpha.1 to 42.0.0-beta.4 (42.0.0-beta.5 is outside it)
- CVE-2026-70600: 32.3.1 to 39.8.7 (39.8.8 is outside it); 40.0.0-alpha.2 to 40.8.5 (40.9.1 is outside it); 41.0.0-alpha.1 to 41.2.0 (41.2.1 is outside it); 42.0.0-alpha.1 to 42.0.0-beta.2 (42.0.0-beta.3 is outside it)
- CVE-2026-70599: 32.3.1 to 39.8.6 (39.8.7 is outside it); 40.0.0-alpha.2 to 40.8.5 (40.9.1 is outside it); 41.0.0-alpha.1 to 41.1.1 (41.2.0 is outside it); 42.0.0-alpha.1 to 42.0.0-alpha.6 (42.0.0-beta.1 is outside it)
- CVE-2026-70598: 32.3.1 to 39.8.9 (39.8.10 is outside it); 40.0.0-alpha.2 to 40.8.5 (40.9.1 is outside it); 41.0.0-alpha.1 to 41.2.0 (41.2.1 is outside it); 42.0.0-alpha.1 to 42.0.0-beta.2 (42.0.0-beta.3 is outside it)
- CVE-2026-70597: 32.3.1 to 39.8.7 (39.8.8 is outside it); 40.0.0-alpha.2 to 40.8.5 (40.9.1 is outside it); 41.0.0-alpha.1 to 41.2.0 (41.2.1 is outside it); 42.0.0-alpha.1 to 42.0.0-beta.2 (42.0.0-beta.3 is outside it)
- CVE-2026-54257: 42.3.1 to 42.3.2 (42.3.3 is outside it)
- CVE-2026-34781: 32.3.1 to 39.8.4 (39.8.5 is outside it); 40.0.0-alpha.2 to 40.8.4 (40.8.5 is outside it); 41.0.0-alpha.1 to 41.0.4 (41.1.0 is outside it); 42.0.0-alpha.1 to 42.0.0-alpha.4 (42.0.0-alpha.5 is outside it)
- CVE-2026-34765: 32.3.1 to 39.8.4 (39.8.5 is outside it); 40.0.0-alpha.2 to 40.8.4 (40.8.5 is outside it); 41.0.0-alpha.1 to 41.0.4 (41.1.0 is outside it); 42.0.0-alpha.1 to 42.0.0-alpha.4 (42.0.0-alpha.5 is outside it)
- CVE-2026-34764: 33.4.0 to 39.8.4 (39.8.5 is outside it); 40.0.0-alpha.2 to 40.8.4 (40.8.5 is outside it); 41.0.0-alpha.1 to 41.0.4 (41.1.0 is outside it); 42.0.0-alpha.1 to 42.0.0-alpha.4 (42.0.0-alpha.5 is outside it)
- CVE-2026-34780: 39.0.0-alpha.1 to 39.7.0 (39.8.0 is outside it); 40.0.0-alpha.2 to 40.6.1 (40.7.0 is outside it); 41.0.0-alpha.1 to 41.0.0-beta.7 (41.0.0-beta.8 is outside it)
- CVE-2026-34779: 32.3.1 to 38.8.4 (38.8.6 is outside it); 39.0.0-alpha.1 to 39.8.0 (39.8.1 is outside it); 40.0.0-alpha.2 to 40.7.0 (40.8.0 is outside it); 41.0.0-alpha.1 to 41.0.0-beta.7 (41.0.0-beta.8 is outside it)
- CVE-2026-34778: 32.3.1 to 38.8.4 (38.8.6 is outside it); 39.0.0-alpha.1 to 39.8.0 (39.8.1 is outside it); 40.0.0-alpha.2 to 40.8.0 (40.8.1 is outside it); 41.0.0-alpha.1 to 41.0.0-beta.8 (41.0.0 is outside it)
- CVE-2026-34777: 32.3.1 to 38.8.4 (38.8.6 is outside it); 39.0.0-alpha.1 to 39.8.0 (39.8.1 is outside it); 40.0.0-alpha.2 to 40.8.0 (40.8.1 is outside it); 41.0.0-alpha.1 to 41.0.0-beta.8 (41.0.0 is outside it)
- CVE-2026-34776: 32.3.1 to 38.8.4 (38.8.6 is outside it); 39.0.0-alpha.1 to 39.8.0 (39.8.1 is outside it); 40.0.0-alpha.2 to 40.8.0 (40.8.1 is outside it); 41.0.0-alpha.1 to 41.0.0-beta.8 (41.0.0 is outside it)
- CVE-2026-34775: 32.3.1 to 38.8.4 (38.8.6 is outside it); 39.0.0-alpha.1 to 39.8.3 (39.8.4 is outside it); 40.0.0-alpha.2 to 40.8.3 (40.8.4 is outside it); 41.0.0-alpha.1 to 41.0.0-beta.8 (41.0.0 is outside it)
- CVE-2026-34774: 32.3.1 to 39.8.0 (39.8.1 is outside it); 40.0.0-alpha.2 to 40.6.1 (40.7.0 is outside it); 41.0.0-alpha.1 to 41.0.0-beta.8 (41.0.0 is outside it)
- CVE-2026-34773: 32.3.1 to 38.8.4 (38.8.6 is outside it); 39.0.0-alpha.1 to 39.8.0 (39.8.1 is outside it); 40.0.0-alpha.2 to 40.8.0 (40.8.1 is outside it); 41.0.0-alpha.1 to 41.0.0-beta.8 (41.0.0 is outside it)
- CVE-2026-34772: 32.3.1 to 38.8.4 (38.8.6 is outside it); 39.0.0-alpha.1 to 39.7.0 (39.8.0 is outside it); 40.0.0-alpha.2 to 40.6.1 (40.7.0 is outside it); 41.0.0-alpha.1 to 41.0.0-beta.6 (41.0.0-beta.7 is outside it)
- CVE-2026-34771: 32.3.1 to 38.8.4 (38.8.6 is outside it); 39.0.0-alpha.1 to 39.7.0 (39.8.0 is outside it); 40.0.0-alpha.2 to 40.6.1 (40.7.0 is outside it); 41.0.0-alpha.1 to 41.0.0-beta.7 (41.0.0-beta.8 is outside it)
- CVE-2026-34770: 32.3.1 to 38.8.4 (38.8.6 is outside it); 39.0.0-alpha.1 to 39.8.0 (39.8.1 is outside it); 40.0.0-alpha.2 to 40.7.0 (40.8.0 is outside it); 41.0.0-alpha.1 to 41.0.0-beta.7 (41.0.0-beta.8 is outside it)
- CVE-2026-34768: 32.3.1 to 38.8.4 (38.8.6 is outside it); 39.0.0-alpha.1 to 39.8.0 (39.8.1 is outside it); 40.0.0-alpha.2 to 40.7.0 (40.8.0 is outside it); 41.0.0-alpha.1 to 41.0.0-beta.7 (41.0.0-beta.8 is outside it)
- CVE-2026-34767: 32.3.1 to 38.8.4 (38.8.6 is outside it); 39.0.0-alpha.1 to 39.8.2 (39.8.3 is outside it); 40.0.0-alpha.2 to 40.8.2 (40.8.3 is outside it); 41.0.0-alpha.1 to 41.0.2 (41.0.3 is outside it)
- CVE-2026-34766: 32.3.1 to 38.8.4 (38.8.6 is outside it); 39.0.0-alpha.1 to 39.7.0 (39.8.0 is outside it); 40.0.0-alpha.2 to 40.6.1 (40.7.0 is outside it); 41.0.0-alpha.1 to 41.0.0-beta.7 (41.0.0-beta.8 is outside it)
- CVE-2026-34769: 32.3.1 to 38.8.4 (38.8.6 is outside it); 39.0.0-alpha.1 to 39.7.0 (39.8.0 is outside it); 40.0.0-alpha.2 to 40.6.1 (40.7.0 is outside it); 41.0.0-alpha.1 to 41.0.0-beta.7 (41.0.0-beta.8 is outside it)
- CVE-2025-55305: 32.3.1 to 35.7.4 (35.7.5 is outside it); 36.0.0-alpha.1 to 36.8.0 (36.8.1 is outside it); 37.0.0-alpha.1 to 37.3.0 (37.3.1 is outside it); 38.0.0-alpha.1 to 38.0.0-beta.5 (38.0.0-beta.6 is outside it)
- CVE-2024-46993: no published release is affected
- CVE-2024-46992: no published release is affected
- CVE-2023-44402: no published release is affected
- CVE-2023-5217: no published release is affected
- CVE-2023-4863: no published release is affected
- CVE-2023-23623: no published release is affected
- CVE-2023-29198: no published release is affected
- CVE-2023-39956: no published release is affected
- CVE-2022-4135: no published release is affected
- CVE-2022-36077: no published release is affected
- CVE-2022-29257: no published release is affected
- CVE-2022-29247: no published release is affected
- CVE-2022-21718: no published release is affected
- CVE-2021-39184: no published release is affected
- CVE-2020-26272: no published release is affected
- CVE-2020-15215: no published release is affected
- CVE-2020-15174: no published release is affected
- CVE-2020-15096: no published release is affected
- CVE-2020-4075: no published release is affected
- CVE-2020-4076: no published release is affected
- CVE-2020-4077: no published release is affected
- CVE-2018-15685: no published release is affected
- CVE-2017-16151: no published release is affected
- CVE-2018-1000136: no published release is affected
- CVE-2018-1000118: no published release is affected
- CVE-2018-1000006: no published release is affected
- CVE-2017-1000424: no published release is affected
- CVE-2017-12581: no published release is affected
- CVE-2016-1202: no published release is affected

Older releases aren't stored, so the earliest spans may start sooner.

## Advisories (79)

### [CVE-2026-115570](https://cve.now/CVE-2026-115570): Electron: Mitigation for compromised eMudhra intermediate certificates

- Severity: High 7.4
- Published: Oct 23, 2026
- Affected: from 45.0.0-alpha.1, fixed in 45.0.0-beta.6; from 44.0.0-alpha.1, fixed in 44.9.1; from 43.0.0-alpha.1, fixed in 43.8.1; fixed in 42.11.16.
- Fixed in 42.11.16 (released Oct 20, 2026, 3 days before disclosure), 43.8.1 (released Oct 20, 2026, 3 days before disclosure), 44.9.1 (released Oct 20, 2026, 3 days before disclosure) and 1 other version.
- The latest release, 45.2.3, is not affected.
- 47% of electron downloads last week were affected versions (6.3M).

### [CVE-2026-114124](https://cve.now/CVE-2026-114124): Electron: Off-screen rendering on macOS trusts GPU-supplied frame geometry

- Severity: Low 3.9
- Published: Oct 21, 2026
- Affected: fixed in 42.11.6; from 43.0.0-alpha.1, fixed in 43.7.3; from 44.0.0-alpha.1, fixed in 44.4.3; from 45.0.0-alpha.1, fixed in 45.0.0-alpha.9.
- Fixed in 42.11.6 (released Sep 18, 2026, 33 days before disclosure), 43.7.3 (released Sep 18, 2026, 33 days before disclosure), 44.4.3 (released Sep 18, 2026, 33 days before disclosure) and 1 other version.
- The latest release, 45.2.3, is not affected.
- 38% of electron downloads last week were affected versions (5M).

### [CVE-2026-114122](https://cve.now/CVE-2026-114122): Electron: Frame subscription trusts GPU-supplied frame geometry

- Severity: Low 3.9
- Published: Oct 21, 2026
- Affected: fixed in 42.11.6; from 43.0.0-alpha.1, fixed in 43.7.3; from 44.0.0-alpha.1, fixed in 44.4.3; from 45.0.0-alpha.1, fixed in 45.0.0-alpha.9.
- Fixed in 42.11.6 (released Sep 18, 2026, 33 days before disclosure), 43.7.3 (released Sep 18, 2026, 33 days before disclosure), 44.4.3 (released Sep 18, 2026, 33 days before disclosure) and 1 other version.
- The latest release, 45.2.3, is not affected.
- 38% of electron downloads last week were affected versions (5M).

### [CVE-2026-114121](https://cve.now/CVE-2026-114121): Electron: openExternal permission requests can be attributed to the wrong origin

- Severity: Medium 5.4
- Published: Oct 21, 2026
- Affected: fixed in 42.11.3; from 43.0.0-alpha.1, fixed in 43.7.0; from 44.0.0-alpha.1, fixed in 44.3.0; from 45.0.0-alpha.1, fixed in 45.0.0-alpha.5.
- Fixed in 42.11.3 (released Sep 8, 2026, 43 days before disclosure), 43.7.0 (released Sep 10, 2026, 41 days before disclosure), 44.3.0 (released Sep 8, 2026, 43 days before disclosure) and 1 other version.
- The latest release, 45.2.3, is not affected.
- 35% of electron downloads last week were affected versions (4.7M).

### [CVE-2026-113800](https://cve.now/CVE-2026-113800): Electron: HID and USB permission checks can be attributed to the wrong origin

- Severity: Medium 5.4
- Published: Oct 21, 2026
- Affected: from 45.0.0-alpha.1, fixed in 45.0.0-alpha.5; from 44.0.0-alpha.1, fixed in 44.3.0; from 43.0.0-alpha.1, fixed in 43.7.0; fixed in 42.11.3.
- Fixed in 42.11.3 (released Sep 8, 2026, 43 days before disclosure), 43.7.0 (released Sep 10, 2026, 41 days before disclosure), 44.3.0 (released Sep 8, 2026, 43 days before disclosure) and 1 other version.
- The latest release, 45.2.3, is not affected.
- 35% of electron downloads last week were affected versions (4.7M).

### [CVE-2026-113798](https://cve.now/CVE-2026-113798): Electron: Pointer lock permission requests can be attributed to the wrong frame

- Severity: Medium 5.4
- Published: Oct 21, 2026
- Affected: from 45.0.0-alpha.1, fixed in 45.0.0-alpha.13; from 44.0.0-alpha.1, fixed in 44.5.0; from 43.0.0-alpha.1, fixed in 43.7.6; fixed in 42.11.9.
- Fixed in 42.11.9 (released Sep 29, 2026, 22 days before disclosure), 43.7.6 (released Sep 29, 2026, 22 days before disclosure), 44.5.0 (released Sep 29, 2026, 22 days before disclosure) and 1 other version.
- The latest release, 45.2.3, is not affected.
- 40% of electron downloads last week were affected versions (5.3M).

### [CVE-2026-113797](https://cve.now/CVE-2026-113797): Electron: Extension tabs.query returns tab URLs and titles without the tabs permission

- Severity: Low 3.1
- Published: Oct 21, 2026
- Affected: from 45.0.0-alpha.1, fixed in 45.0.0-alpha.4; from 44.0.0-alpha.1, fixed in 44.1.1; from 43.0.0-alpha.1, fixed in 43.5.1; fixed in 42.11.1.
- Fixed in 42.11.1 (released Sep 1, 2026, 50 days before disclosure), 43.5.1 (released Sep 1, 2026, 50 days before disclosure), 44.1.1 (released Sep 1, 2026, 50 days before disclosure) and 1 other version.
- The latest release, 45.2.3, is not affected.
- 34% of electron downloads last week were affected versions (4.5M).

### [CVE-2026-113796](https://cve.now/CVE-2026-113796): Electron: SameSite cookie restrictions are not applied to windows opened from links

- Severity: Medium 4.2
- Published: Oct 21, 2026
- Affected: from 45.0.0-alpha.1, fixed in 45.0.0-alpha.6; from 44.0.0-alpha.1, fixed in 44.3.0; from 43.0.0-alpha.1, fixed in 43.7.0; fixed in 42.11.3.
- Fixed in 42.11.3 (released Sep 8, 2026, 43 days before disclosure), 43.7.0 (released Sep 10, 2026, 41 days before disclosure), 44.3.0 (released Sep 8, 2026, 43 days before disclosure) and 1 other version.
- The latest release, 45.2.3, is not affected.
- 35% of electron downloads last week were affected versions (4.7M).

### [CVE-2026-102672](https://cve.now/CVE-2026-102672): Electron: Local race condition in Squirrel.Mac update installation on macOS

- Severity: Medium 6.7
- Published: Oct 13, 2026
- Affected: fixed in 39.8.10; from 40.0.0-alpha.1, fixed in 41.10.5; from 42.0.0-alpha.1, fixed in 42.0.0-beta.2.
- Fixed in 39.8.10 (released May 5, 2026, 161 days before disclosure), 41.10.5 (released Aug 11, 2026, 63 days before disclosure) and 42.0.0-beta.2 (released Apr 10, 2026, 186 days before disclosure).
- The latest release, 45.2.3, is not affected.
- 23% of electron downloads last week were affected versions (3M).

### [CVE-2026-102677](https://cve.now/CVE-2026-102677): Electron: Sandboxed preload code cache can be poisoned by a compromised renderer

- Severity: High 7.8
- Published: Sep 29, 2026
- Affected: from 42.3.3, fixed in 42.10.0; from 43.0.0-beta.1, fixed in 43.5.0; from 44.0.0-alpha.1, fixed in 44.0.0-beta.6.
- Fixed in 42.10.0 (released Aug 24, 2026, 36 days before disclosure), 43.5.0 (released Aug 31, 2026, 29 days before disclosure) and 44.0.0-beta.6 (released Aug 20, 2026, 40 days before disclosure).
- The latest release, 45.2.3, is not affected.
- 6% of electron downloads last week were affected versions (789.6K).

### [CVE-2026-102676](https://cve.now/CVE-2026-102676): Electron: \<webview\> can enable Node.js integration in Web Workers despite embedder restrictions

- Severity: High 8.3
- Published: Sep 29, 2026
- Affected: fixed in 41.10.6; from 42.0.0-alpha.1, fixed in 42.9.2; from 43.0.0-alpha.1, fixed in 43.4.1; from 44.0.0-alpha.1, fixed in 44.0.0-beta.5.
- Fixed in 41.10.6 (released Aug 18, 2026, 42 days before disclosure), 42.9.2 (released Aug 17, 2026, 43 days before disclosure), 43.4.1 (released Aug 19, 2026, 41 days before disclosure) and 1 other version.
- The latest release, 45.2.3, is not affected.
- 31% of electron downloads last week were affected versions (4.1M).

### [CVE-2026-102675](https://cve.now/CVE-2026-102675): Electron: File and HTTP protocol handlers allow cross-origin reads without corsEnabled

- Severity: High 7.4
- Published: Sep 29, 2026
- Affected: fixed in 41.10.6; from 42.0.0-alpha.1, fixed in 42.9.2; from 43.0.0-alpha.1, fixed in 43.4.1; from 44.0.0-alpha.1, fixed in 44.0.0-beta.5.
- Fixed in 41.10.6 (released Aug 18, 2026, 42 days before disclosure), 42.9.2 (released Aug 17, 2026, 43 days before disclosure), 43.4.1 (released Aug 19, 2026, 41 days before disclosure) and 1 other version.
- The latest release, 45.2.3, is not affected.
- 31% of electron downloads last week were affected versions (4.1M).

### [CVE-2026-102674](https://cve.now/CVE-2026-102674): Electron: Windows opened from a sandboxed top-level document do not inherit its sandbox restrictions

- Severity: High 8.2
- Published: Sep 29, 2026
- Affected: fixed in 41.10.6; from 42.0.0-alpha.1, fixed in 42.9.2; from 43.0.0-alpha.1, fixed in 43.4.1; from 44.0.0-alpha.1, fixed in 44.0.0-beta.5.
- Fixed in 41.10.6 (released Aug 18, 2026, 42 days before disclosure), 42.9.2 (released Aug 17, 2026, 43 days before disclosure), 43.4.1 (released Aug 19, 2026, 41 days before disclosure) and 1 other version.
- The latest release, 45.2.3, is not affected.
- 31% of electron downloads last week were affected versions (4.1M).

### [CVE-2026-102673](https://cve.now/CVE-2026-102673): Electron drops inherited HTML sandbox restrictions for popups opened through OpenURLFromTab

- Severity: High 8.2
- Published: Sep 29, 2026
- Affected: fixed in 41.10.4; from 42.0.0-alpha.1, fixed in 42.5.2; from 43.0.0-alpha.1, fixed in 43.0.0.
- Fixed in 41.10.4 (released Aug 4, 2026, 56 days before disclosure), 42.5.2 (released Jun 30, 2026, 91 days before disclosure) and 43.0.0 (released Jun 30, 2026, 91 days before disclosure).
- The latest release, 45.2.3, is not affected.
- 27% of electron downloads last week were affected versions (3.6M).

### [CVE-2026-70612](https://cve.now/CVE-2026-70612): Electron: Sandboxed iframes can launch external protocol handlers

- Severity: Medium 5.4
- Published: Aug 5, 2026
- Affected: fixed in 39.8.8; from 40.0.0-alpha.1, fixed in 40.9.0; from 41.0.0-alpha.1, fixed in 41.2.1; from 42.0.0-alpha.1, fixed in 42.0.0-beta.3.
- Fixed in 39.8.8 (released Apr 16, 2026, 111 days before disclosure), 40.9.1 (released Apr 15, 2026, 112 days before disclosure, the advisory names 40.9.0, which was never published), 41.2.1 (released Apr 16, 2026, 111 days before disclosure) and 1 other version.
- The latest release, 45.2.3, is not affected.
- 20% of electron downloads last week were affected versions (2.7M).

### [CVE-2026-70611](https://cve.now/CVE-2026-70611): Electron: DevTools embedder handler executes arbitrary files via shell open

- Severity: Medium 6.9
- Published: Aug 5, 2026
- Affected: fixed in 39.8.9; from 40.0.0-alpha.1, fixed in 40.9.2; from 41.0.0-alpha.1, fixed in 41.2.1; from 42.0.0-alpha.1, fixed in 42.0.0-beta.3.
- Fixed in 39.8.9 (released Apr 22, 2026, 105 days before disclosure), 40.9.2 (released Apr 22, 2026, 105 days before disclosure), 41.2.1 (released Apr 16, 2026, 111 days before disclosure) and 1 other version.
- The latest release, 45.2.3, is not affected.
- 20% of electron downloads last week were affected versions (2.7M).

### [CVE-2026-70610](https://cve.now/CVE-2026-70610): Electron: contextBridge object copy honors prototype setters

- Severity: Medium 5.4
- Published: Aug 5, 2026
- Affected: fixed in 39.8.9; from 40.0.0-alpha.1, fixed in 40.9.2; from 41.0.0-alpha.1, fixed in 41.2.2; from 42.0.0-alpha.1, fixed in 42.0.0-beta.4.
- Fixed in 39.8.9 (released Apr 22, 2026, 105 days before disclosure), 40.9.2 (released Apr 22, 2026, 105 days before disclosure), 41.2.2 (released Apr 21, 2026, 106 days before disclosure) and 1 other version.
- The latest release, 45.2.3, is not affected.
- 21% of electron downloads last week were affected versions (2.7M).

### [CVE-2026-70609](https://cve.now/CVE-2026-70609): Electron: DevTools JavaScript Injection via Unsanitized Dock State Parameter

- Severity: Medium 5.7
- Published: Aug 5, 2026
- Affected: fixed in 39.8.7; from 40.0.0-alpha.1, fixed in 40.9.0; from 41.0.0-alpha.1, fixed in 41.2.0; from 42.0.0-alpha.1, fixed in 42.0.0-beta.1.
- Fixed in 39.8.7 (released Apr 8, 2026, 119 days before disclosure), 40.9.1 (released Apr 15, 2026, 112 days before disclosure, the advisory names 40.9.0, which was never published), 41.2.0 (released Apr 8, 2026, 119 days before disclosure) and 1 other version.
- The latest release, 45.2.3, is not affected.
- 20% of electron downloads last week were affected versions (2.7M).

### [CVE-2026-70608](https://cve.now/CVE-2026-70608): Electron: Sandboxed iframe can bypass the allow-popups restriction via the OpenURL navigation path

- Severity: High 7.2
- Published: Aug 5, 2026
- Affected: from 42.0.0-alpha.1, fixed in 42.0.1; from 40.0.0-alpha.1, fixed in 41.10.3; fixed in 39.8.10.
- Fixed in 39.8.10 (released May 5, 2026, 92 days before disclosure), 41.10.3 (released Jul 21, 2026, 15 days before disclosure) and 42.0.1 (released May 8, 2026, 89 days before disclosure).
- The latest release, 45.2.3, is not affected.
- 22% of electron downloads last week were affected versions (3M).

### [CVE-2026-70607](https://cve.now/CVE-2026-70607): Electron: window.open features string controls some window options considered privileged

- Severity: Medium 5.3
- Published: Aug 5, 2026
- Affected: fixed in 39.8.8; from 40.0.0-alpha.1, fixed in 40.9.0; from 41.0.0-alpha.1, fixed in 41.2.1; from 42.0.0-alpha.1, fixed in 42.0.0-beta.3.
- Fixed in 39.8.8 (released Apr 16, 2026, 111 days before disclosure), 40.9.1 (released Apr 15, 2026, 112 days before disclosure, the advisory names 40.9.0, which was never published), 41.2.1 (released Apr 16, 2026, 111 days before disclosure) and 1 other version.
- The latest release, 45.2.3, is not affected.
- 20% of electron downloads last week were affected versions (2.7M).

### [CVE-2026-70606](https://cve.now/CVE-2026-70606): Electron: ProtocolResponse.url reuses the default session cache instead of the registering session

- Severity: Medium 5.9
- Published: Aug 5, 2026
- Affected: from 43.0.0-alpha.1, fixed in 43.0.0; from 42.0.0-alpha.1, fixed in 42.5.1; from 41.0.0-alpha.1, fixed in 41.9.1; from 40.0.0-alpha.1, fixed in 40.10.6.
- Fixed in 40.10.6 (released Jul 1, 2026, 35 days before disclosure), 41.9.1 (released Jun 29, 2026, 37 days before disclosure), 42.5.1 (released Jun 29, 2026, 37 days before disclosure) and 1 other version.
- The latest release, 45.2.3, is not affected.
- 5.1% of electron downloads last week were affected versions (671.9K).

### [CVE-2026-70605](https://cve.now/CVE-2026-70605): Electron: HTTP redirect followed into local file loader

- Severity: Medium 5.9
- Published: Aug 5, 2026
- Affected: fixed in 39.8.8; from 40.0.0-alpha.1, fixed in 40.9.1; from 41.0.0-alpha.1, fixed in 41.2.1; from 42.0.0-alpha.1, fixed in 42.0.0-beta.3.
- Fixed in 39.8.8 (released Apr 16, 2026, 111 days before disclosure), 40.9.1 (released Apr 15, 2026, 112 days before disclosure), 41.2.1 (released Apr 16, 2026, 111 days before disclosure) and 1 other version.
- The latest release, 45.2.3, is not affected.
- 20% of electron downloads last week were affected versions (2.7M).

### [CVE-2026-70604](https://cve.now/CVE-2026-70604): Electron: Custom protocol with supportFetchAPI but not corsEnabled allows cross-origin reads

- Severity: High 7.4
- Published: Aug 5, 2026
- Affected: from 42.0.0-alpha.1, fixed in 42.0.0; from 41.0.0-alpha.1, fixed in 41.4.0; from 40.0.0-alpha.1, fixed in 40.9.3; fixed in 39.8.10.
- Fixed in 39.8.10 (released May 5, 2026, 92 days before disclosure), 40.9.3 (released Apr 30, 2026, 97 days before disclosure), 41.4.0 (released May 1, 2026, 96 days before disclosure) and 1 other version.
- The latest release, 45.2.3, is not affected.
- 21% of electron downloads last week were affected versions (2.8M).

### [CVE-2026-70603](https://cve.now/CVE-2026-70603): Electron: shell.openPath path validation bypass via embedded null byte

- Severity: Medium 6.0
- Published: Aug 5, 2026
- Affected: from 42.0.0-alpha.1, fixed in 42.0.0-beta.1; from 41.0.0-alpha.1, fixed in 41.1.1; from 40.0.0-alpha.1, fixed in 40.9.0; fixed in 39.8.6.
- Fixed in 39.8.6 (released Apr 1, 2026, 126 days before disclosure), 40.9.1 (released Apr 15, 2026, 112 days before disclosure, the advisory names 40.9.0, which was never published), 41.1.1 (released Apr 1, 2026, 126 days before disclosure) and 1 other version.
- The latest release, 45.2.3, is not affected.
- 20% of electron downloads last week were affected versions (2.6M).

### [CVE-2026-70602](https://cve.now/CVE-2026-70602): Electron: Extension tab APIs operate across session boundaries

- Severity: Medium 6.6
- Published: Aug 5, 2026
- Affected: fixed in 39.8.8; from 40.0.0-alpha.1, fixed in 40.9.0; from 41.0.0-alpha.1, fixed in 41.2.1; from 42.0.0-alpha.1, fixed in 42.0.0-beta.3.
- Fixed in 39.8.8 (released Apr 16, 2026, 111 days before disclosure), 40.9.1 (released Apr 15, 2026, 112 days before disclosure, the advisory names 40.9.0, which was never published), 41.2.1 (released Apr 16, 2026, 111 days before disclosure) and 1 other version.
- The latest release, 45.2.3, is not affected.
- 20% of electron downloads last week were affected versions (2.7M).

### [CVE-2026-70601](https://cve.now/CVE-2026-70601): Electron: Context isolation bypass via Function.prototype.bind hijack

- Severity: High 7.5
- Published: Aug 5, 2026
- Affected: fixed in 39.8.9; from 40.0.0-alpha.1, fixed in 40.9.2; from 41.0.0-alpha.1, fixed in 41.2.2; from 42.0.0-alpha.1, fixed in 42.0.0-beta.5.
- Fixed in 39.8.9 (released Apr 22, 2026, 105 days before disclosure), 40.9.2 (released Apr 22, 2026, 105 days before disclosure), 41.2.2 (released Apr 21, 2026, 106 days before disclosure) and 1 other version.
- The latest release, 45.2.3, is not affected.
- 21% of electron downloads last week were affected versions (2.7M).

### [CVE-2026-70600](https://cve.now/CVE-2026-70600): Electron: Cross-origin iframe can position native autofill popup

- Severity: Low 3.1
- Published: Aug 5, 2026
- Affected: fixed in 39.8.8; from 40.0.0-alpha.1, fixed in 40.9.1; from 41.0.0-alpha.1, fixed in 41.2.1; from 42.0.0-alpha.1, fixed in 42.0.0-beta.3.
- Fixed in 39.8.8 (released Apr 16, 2026, 111 days before disclosure), 40.9.1 (released Apr 15, 2026, 112 days before disclosure), 41.2.1 (released Apr 16, 2026, 111 days before disclosure) and 1 other version.
- The latest release, 45.2.3, is not affected.
- 20% of electron downloads last week were affected versions (2.7M).

### [CVE-2026-70599](https://cve.now/CVE-2026-70599): Electron: Permission Check Handler Receives Main Frame Origin Instead of Requesting Iframe Origin

- Severity: Medium 5.9
- Published: Aug 5, 2026
- Affected: fixed in 39.8.7; from 40.0.0-alpha.1, fixed in 40.9.0; from 41.0.0-alpha.1, fixed in 41.2.0; from 42.0.0-alpha.1, fixed in 42.0.0-beta.1.
- Fixed in 39.8.7 (released Apr 8, 2026, 119 days before disclosure), 40.9.1 (released Apr 15, 2026, 112 days before disclosure, the advisory names 40.9.0, which was never published), 41.2.0 (released Apr 8, 2026, 119 days before disclosure) and 1 other version.
- The latest release, 45.2.3, is not affected.
- 20% of electron downloads last week were affected versions (2.7M).

### [CVE-2026-70598](https://cve.now/CVE-2026-70598): Electron: Off-screen rendering trusts GPU-supplied geometry over shared-memory size

- Severity: Low 3.9
- Published: Aug 5, 2026
- Affected: fixed in 39.8.10; from 40.0.0-alpha.1, fixed in 40.9.0; from 41.0.0-alpha.1, fixed in 41.2.1; from 42.0.0-alpha.1, fixed in 42.0.0-beta.3.
- Fixed in 39.8.10 (released May 5, 2026, 92 days before disclosure), 40.9.1 (released Apr 15, 2026, 112 days before disclosure, the advisory names 40.9.0, which was never published), 41.2.1 (released Apr 16, 2026, 111 days before disclosure) and 1 other version.
- The latest release, 45.2.3, is not affected.
- 20% of electron downloads last week were affected versions (2.7M).

### [CVE-2026-70597](https://cve.now/CVE-2026-70597): Electron: Parent process code-sign check is spoofable

- Severity: Medium 6.3
- Published: Aug 5, 2026
- Affected: fixed in 39.8.8; from 40.0.0-alpha.1, fixed in 40.9.1; from 41.0.0-alpha.1, fixed in 41.2.1; from 42.0.0-alpha.1, fixed in 42.0.0-beta.3.
- Fixed in 39.8.8 (released Apr 16, 2026, 111 days before disclosure), 40.9.1 (released Apr 15, 2026, 112 days before disclosure), 41.2.1 (released Apr 16, 2026, 111 days before disclosure) and 1 other version.
- The latest release, 45.2.3, is not affected.
- 20% of electron downloads last week were affected versions (2.7M).

### [CVE-2026-54257](https://cve.now/CVE-2026-54257): Electron: Buffer performs incorrect byte length calculations resulting in heap buffer under/overflow

- Severity: Critical 9.3
- Published: Jun 23, 2026
- Affected: from 42.3.1, fixed in 42.3.3.
- Fixed in 42.3.3 (released Jun 3, 2026, 20 days before disclosure).
- The latest release, 45.2.3, is not affected.
- <0.1% of electron downloads last week were affected versions (1.4K).

### [CVE-2026-34781](https://cve.now/CVE-2026-34781): Electron crashes in clipboard.readImage() on malformed clipboard image data

- Severity: Low 2.8
- Published: Apr 7, 2026
- Affected: fixed in 39.8.5; from 40.0.0-alpha.1, fixed in 40.8.5; from 41.0.0-alpha.1, fixed in 41.1.0; from 42.0.0-alpha.1, fixed in 42.0.0-alpha.5.
- Fixed in 39.8.5 (released Mar 27, 2026, 11 days before disclosure), 40.8.5 (released Mar 26, 2026, 12 days before disclosure), 41.1.0 (released Mar 27, 2026, 11 days before disclosure) and 1 other version.
- The latest release, 45.2.3, is not affected.
- 20% of electron downloads last week were affected versions (2.6M).

### [CVE-2026-34765](https://cve.now/CVE-2026-34765): Electron named window.open targets not scoped to the opener's browsing context

- Severity: Medium 6.0
- Published: Apr 7, 2026
- Affected: fixed in 39.8.5; from 40.0.0-alpha.1, fixed in 40.8.5; from 41.0.0-alpha.1, fixed in 41.1.0; from 42.0.0-alpha.1, fixed in 42.0.0-alpha.5.
- Fixed in 39.8.5 (released Mar 27, 2026, 11 days before disclosure), 40.8.5 (released Mar 26, 2026, 12 days before disclosure), 41.1.0 (released Mar 27, 2026, 11 days before disclosure) and 1 other version.
- The latest release, 45.2.3, is not affected.
- 20% of electron downloads last week were affected versions (2.6M).

### [CVE-2026-34764](https://cve.now/CVE-2026-34764): Electron has a use-after-free in offscreen shared texture release() callback

- Severity: Low 2.3
- Published: Apr 6, 2026
- Affected: from 33.0.0-alpha.1, fixed in 39.8.5; from 40.0.0-alpha.1, fixed in 40.8.5; from 41.0.0-alpha.1, fixed in 41.1.0; from 42.0.0-alpha.1, fixed in 42.0.0-alpha.5.
- Fixed in 39.8.5 (released Mar 27, 2026, 10 days before disclosure), 40.8.5 (released Mar 26, 2026, 11 days before disclosure), 41.1.0 (released Mar 27, 2026, 10 days before disclosure) and 1 other version.
- The latest release, 45.2.3, is not affected.
- 11% of electron downloads last week were affected versions (1.5M).

### [CVE-2026-34780](https://cve.now/CVE-2026-34780): Electron: Context Isolation bypass via contextBridge VideoFrame transfer

- Severity: High 8.4
- Published: Apr 4, 2026
- Affected: from 39.0.0-alpha.1, fixed in 39.8.0; from 40.0.0-alpha.1, fixed in 40.7.0; from 41.0.0-alpha.1, fixed in 41.0.0-beta.8.
- Fixed in 39.8.0 (released Mar 4, 2026, 31 days before disclosure), 40.7.0 (released Mar 4, 2026, 31 days before disclosure) and 41.0.0-beta.8 (released Mar 6, 2026, 29 days before disclosure).
- The latest release, 45.2.3, is not affected.
- 1% of electron downloads last week were affected versions (136.2K).

### [CVE-2026-34779](https://cve.now/CVE-2026-34779): Electron: AppleScript injection in app.moveToApplicationsFolder on macOS

- Severity: Medium 6.5
- Published: Apr 4, 2026
- Affected: fixed in 38.8.6; from 39.0.0-alpha.1, fixed in 39.8.1; from 40.0.0-alpha.1, fixed in 40.8.0; from 41.0.0-alpha.1, fixed in 41.0.0-beta.8.
- Fixed in 38.8.6 (released Mar 11, 2026, 24 days before disclosure), 39.8.1 (released Mar 12, 2026, 23 days before disclosure), 40.8.0 (released Mar 5, 2026, 30 days before disclosure) and 1 other version.
- The latest release, 45.2.3, is not affected.
- 18% of electron downloads last week were affected versions (2.4M).

### [CVE-2026-34778](https://cve.now/CVE-2026-34778): Electron: Service worker can spoof executeJavaScript IPC replies

- Severity: Medium 5.9
- Published: Apr 3, 2026
- Affected: fixed in 38.8.6; from 39.0.0-alpha.1, fixed in 39.8.1; from 40.0.0-alpha.1, fixed in 40.8.1; from 41.0.0-alpha.1, fixed in 41.0.0.
- Fixed in 38.8.6 (released Mar 11, 2026, 23 days before disclosure), 39.8.1 (released Mar 12, 2026, 22 days before disclosure), 40.8.1 (released Mar 12, 2026, 22 days before disclosure) and 1 other version.
- The latest release, 45.2.3, is not affected.
- 18% of electron downloads last week were affected versions (2.4M).

### [CVE-2026-34777](https://cve.now/CVE-2026-34777): Electron: Incorrect origin passed to permission request handler for iframe requests

- Severity: Medium 5.4
- Published: Apr 3, 2026
- Affected: fixed in 38.8.6; from 39.0.0-alpha.1, fixed in 39.8.1; from 40.0.0-alpha.1, fixed in 40.8.1; from 41.0.0-alpha.1, fixed in 41.0.0.
- Fixed in 38.8.6 (released Mar 11, 2026, 23 days before disclosure), 39.8.1 (released Mar 12, 2026, 22 days before disclosure), 40.8.1 (released Mar 12, 2026, 22 days before disclosure) and 1 other version.
- The latest release, 45.2.3, is not affected.
- 18% of electron downloads last week were affected versions (2.4M).

### [CVE-2026-34776](https://cve.now/CVE-2026-34776): Electron: Out-of-bounds read in second-instance IPC on macOS and Linux

- Severity: Medium 5.3
- Published: Apr 3, 2026
- Affected: fixed in 38.8.6; from 39.0.0-alpha.1, fixed in 39.8.1; from 40.0.0-alpha.1, fixed in 40.8.1; from 41.0.0-alpha.1, fixed in 41.0.0.
- Fixed in 38.8.6 (released Mar 11, 2026, 23 days before disclosure), 39.8.1 (released Mar 12, 2026, 22 days before disclosure), 40.8.1 (released Mar 12, 2026, 22 days before disclosure) and 1 other version.
- The latest release, 45.2.3, is not affected.
- 18% of electron downloads last week were affected versions (2.4M).

### [CVE-2026-34775](https://cve.now/CVE-2026-34775): Electron: nodeIntegrationInWorker not correctly scoped in shared renderer processes

- Severity: Medium 6.8
- Published: Apr 3, 2026
- Affected: fixed in 38.8.6; from 39.0.0-alpha.1, fixed in 39.8.4; from 40.0.0-alpha.1, fixed in 40.8.4; from 41.0.0-alpha.1, fixed in 41.0.0.
- Fixed in 38.8.6 (released Mar 11, 2026, 23 days before disclosure), 39.8.4 (released Mar 25, 2026, 9 days before disclosure), 40.8.4 (released Mar 25, 2026, 9 days before disclosure) and 1 other version.
- The latest release, 45.2.3, is not affected.
- 19% of electron downloads last week were affected versions (2.5M).

### [CVE-2026-34774](https://cve.now/CVE-2026-34774): Electron: Use-after-free in offscreen child window paint callback

- Severity: High 8.1
- Published: Apr 3, 2026
- Affected: fixed in 39.8.1; from 40.0.0-alpha.1, fixed in 40.7.0; from 41.0.0-alpha.1, fixed in 41.0.0.
- Fixed in 39.8.1 (released Mar 12, 2026, 22 days before disclosure), 40.7.0 (released Mar 4, 2026, 30 days before disclosure) and 41.0.0 (released Mar 11, 2026, 23 days before disclosure).
- The latest release, 45.2.3, is not affected.
- 19% of electron downloads last week were affected versions (2.5M).

### [CVE-2026-34773](https://cve.now/CVE-2026-34773): Electron: Registry key path injection in app.setAsDefaultProtocolClient on Windows

- Severity: Medium 4.7
- Published: Apr 3, 2026
- Affected: fixed in 38.8.6; from 39.0.0-alpha.1, fixed in 39.8.1; from 40.0.0-alpha.1, fixed in 40.8.1; from 41.0.0-alpha.1, fixed in 41.0.0.
- Fixed in 38.8.6 (released Mar 11, 2026, 23 days before disclosure), 39.8.1 (released Mar 12, 2026, 22 days before disclosure), 40.8.1 (released Mar 12, 2026, 22 days before disclosure) and 1 other version.
- The latest release, 45.2.3, is not affected.
- 18% of electron downloads last week were affected versions (2.4M).

### [CVE-2026-34772](https://cve.now/CVE-2026-34772): Electron: Use-after-free in download save dialog callback

- Severity: Medium 5.8
- Published: Apr 3, 2026
- Affected: fixed in 38.8.6; from 39.0.0-alpha.1, fixed in 39.8.0; from 40.0.0-alpha.1, fixed in 40.7.0; from 41.0.0-alpha.1, fixed in 41.0.0-beta.7.
- Fixed in 38.8.6 (released Mar 11, 2026, 23 days before disclosure), 39.8.0 (released Mar 4, 2026, 30 days before disclosure), 40.7.0 (released Mar 4, 2026, 30 days before disclosure) and 1 other version.
- The latest release, 45.2.3, is not affected.
- 18% of electron downloads last week were affected versions (2.4M).

### [CVE-2026-34771](https://cve.now/CVE-2026-34771): Electron: Use-after-free in WebContents fullscreen, pointer-lock, and keyboard-lock permission callbacks

- Severity: High 7.5
- Published: Apr 3, 2026
- Affected: fixed in 38.8.6; from 39.0.0-alpha.1, fixed in 39.8.0; from 40.0.0-alpha.1, fixed in 40.7.0; from 41.0.0-alpha.1, fixed in 41.0.0-beta.8.
- Fixed in 38.8.6 (released Mar 11, 2026, 23 days before disclosure), 39.8.0 (released Mar 4, 2026, 30 days before disclosure), 40.7.0 (released Mar 4, 2026, 30 days before disclosure) and 1 other version.
- The latest release, 45.2.3, is not affected.
- 18% of electron downloads last week were affected versions (2.4M).

### [CVE-2026-34770](https://cve.now/CVE-2026-34770): Electron: Use-after-free in PowerMonitor on Windows and macOS

- Severity: High 7.0
- Published: Apr 3, 2026
- Affected: fixed in 38.8.6; from 39.0.0-alpha.1, fixed in 39.8.1; from 40.0.0-alpha.1, fixed in 40.8.0; from 41.0.0-alpha.1, fixed in 41.0.0-beta.8.
- Fixed in 38.8.6 (released Mar 11, 2026, 23 days before disclosure), 39.8.1 (released Mar 12, 2026, 22 days before disclosure), 40.8.0 (released Mar 5, 2026, 29 days before disclosure) and 1 other version.
- The latest release, 45.2.3, is not affected.
- 18% of electron downloads last week were affected versions (2.4M).

### [CVE-2026-34768](https://cve.now/CVE-2026-34768): Electron: Unquoted executable path in app.setLoginItemSettings on Windows

- Severity: Low 3.9
- Published: Apr 3, 2026
- Affected: fixed in 38.8.6; from 39.0.0-alpha.1, fixed in 39.8.1; from 40.0.0-alpha.1, fixed in 40.8.0; from 41.0.0-alpha.1, fixed in 41.0.0-beta.8.
- Fixed in 38.8.6 (released Mar 11, 2026, 23 days before disclosure), 39.8.1 (released Mar 12, 2026, 22 days before disclosure), 40.8.0 (released Mar 5, 2026, 29 days before disclosure) and 1 other version.
- The latest release, 45.2.3, is not affected.
- 18% of electron downloads last week were affected versions (2.4M).

### [CVE-2026-34767](https://cve.now/CVE-2026-34767): Electron: HTTP Response Header Injection in custom protocol handlers and webRequest

- Severity: Medium 5.9
- Published: Apr 3, 2026
- Affected: fixed in 38.8.6; from 39.0.0-alpha.1, fixed in 39.8.3; from 40.0.0-alpha.1, fixed in 40.8.3; from 41.0.0-alpha.1, fixed in 41.0.3.
- Fixed in 38.8.6 (released Mar 11, 2026, 23 days before disclosure), 39.8.3 (released Mar 17, 2026, 17 days before disclosure), 40.8.3 (released Mar 17, 2026, 17 days before disclosure) and 1 other version.
- The latest release, 45.2.3, is not affected.
- 19% of electron downloads last week were affected versions (2.5M).

### [CVE-2026-34766](https://cve.now/CVE-2026-34766): Electron: USB device selection not validated against filtered device list

- Severity: Low 3.3
- Published: Apr 3, 2026
- Affected: fixed in 38.8.6; from 39.0.0-alpha.1, fixed in 39.8.0; from 40.0.0-alpha.1, fixed in 40.7.0; from 41.0.0-alpha.1, fixed in 41.0.0-beta.8.
- Fixed in 38.8.6 (released Mar 11, 2026, 23 days before disclosure), 39.8.0 (released Mar 4, 2026, 30 days before disclosure), 40.7.0 (released Mar 4, 2026, 30 days before disclosure) and 1 other version.
- The latest release, 45.2.3, is not affected.
- 18% of electron downloads last week were affected versions (2.4M).

### [CVE-2026-34769](https://cve.now/CVE-2026-34769): Electron: Renderer command-line switch injection via undocumented commandLineSwitches webPreference

- Severity: High 7.8
- Published: Apr 3, 2026
- Affected: fixed in 38.8.6; from 39.0.0-alpha.1, fixed in 39.8.0; from 40.0.0-alpha.1, fixed in 40.7.0; from 41.0.0-alpha.1, fixed in 41.0.0-beta.8.
- Fixed in 38.8.6 (released Mar 11, 2026, 23 days before disclosure), 39.8.0 (released Mar 4, 2026, 30 days before disclosure), 40.7.0 (released Mar 4, 2026, 30 days before disclosure) and 1 other version.
- The latest release, 45.2.3, is not affected.
- 18% of electron downloads last week were affected versions (2.4M).

### [CVE-2025-55305](https://cve.now/CVE-2025-55305): Electron is vulnerable to Code Injection via resource modification

- Severity: Medium 6.1
- Published: Sep 4, 2025
- Affected: fixed in 35.7.5; from 36.0.0-alpha.1, fixed in 36.8.1; from 37.0.0-alpha.1, fixed in 37.3.1; from 38.0.0-alpha.1, fixed in 38.0.0-beta.6.
- Fixed in 35.7.5 (released Aug 19, 2025, 16 days before disclosure), 36.8.1 (released Aug 19, 2025, 16 days before disclosure), 37.3.1 (released Aug 19, 2025, 16 days before disclosure) and 1 other version.
- The latest release, 45.2.3, is not affected.
- 14% of electron downloads last week were affected versions (1.8M).

### [CVE-2024-46993](https://cve.now/CVE-2024-46993): Electron Vulnerable to Heap Buffer Overflow in NativeImage::CreateFromPath

- Severity: Medium 4.4
- Published: Jul 1, 2025
- Affected: fixed in 28.3.2; from 29.0.0-alpha.1, fixed in 29.3.3; from 30.0.0-alpha.1, fixed in 30.0.3.
- Fixed in 28.3.2, 29.3.3 and 30.0.3.
- The latest release, 45.2.3, is not affected.
- 5.6% of electron downloads last week were affected versions (742.1K).

### [CVE-2024-46992](https://cve.now/CVE-2024-46992): Electron ASAR Integrity bypass by just modifying the content

- Severity: High 7.8
- Published: Jul 1, 2025
- Affected: from 30.0.0-alpha.1, fixed in 30.0.5; from 31.0.0-alpha.1, fixed in 31.0.0-beta.1.
- Fixed in 30.0.5 and 31.0.0-beta.1.
- The latest release, 45.2.3, is not affected.
- <0.1% of electron downloads last week were affected versions (5.2K).

### [CVE-2023-44402](https://cve.now/CVE-2023-44402): ASAR Integrity bypass via filetype confusion in electron

- Severity: Medium 6.1
- Published: Dec 1, 2023
- Affected: fixed in 22.3.24; from 24.0.0-alpha.1, fixed in 24.8.3; from 25.0.0-alpha.1, fixed in 25.8.1; from 26.0.0-alpha.1, fixed in 26.2.1; from 27.0.0-alpha.1, fixed in 27.0.0-alpha.7; from 23.0.0-alpha.1, through 23.3.13.
- Fixed in 22.3.24, 24.8.3, 25.8.1 and 2 other versions.
- The latest release, 45.2.3, is not affected.
- 4.6% of electron downloads last week were affected versions (606.1K).

### [CVE-2023-5217](https://cve.now/CVE-2023-5217): Heap buffer overflow in vp8 encoding in libvpx in Google Chrome prior to 117.0.5938.132 and libvpx 1.13.1 allowed a remote attacker to poten

- Severity: High 8.8 · KEV
- Published: Sep 28, 2023
- Affected: fixed in 22.3.25; from 24.0.0, fixed in 24.8.5; from 25.0.0, fixed in 25.8.4; from 26.0.0, fixed in 26.2.4; from 27.0.0-alpha.1, fixed in 27.0.0-beta.8.
- Fixed in 22.3.25, 24.8.5, 25.8.4 and 2 other versions.
- The latest release, 45.2.3, is not affected.
- 2.3% of electron downloads last week were affected versions (298.3K).

### [CVE-2023-4863](https://cve.now/CVE-2023-4863): Heap buffer overflow in libwebp in Google Chrome prior to 116.0.5845.187 and libwebp 1.3.2 allowed a remote attacker to perform an out of bo

- Severity: High 8.8 · KEV
- Published: Sep 12, 2023
- Affected: from 22.0.0, fixed in 22.3.24; from 24.0.0, fixed in 24.8.3; from 25.0.0, fixed in 25.8.1; from 26.0.0, fixed in 26.2.1; from 27.0.0-beta.1, fixed in 27.0.0-beta.2.
- Fixed in 22.3.24, 24.8.3, 25.8.1 and 2 other versions.
- The latest release, 45.2.3, is not affected.
- 0.1% of electron downloads last week were affected versions (17.2K).

### [CVE-2023-23623](https://cve.now/CVE-2023-23623): Content-Secrity-Policy disabling eval not applied consistently in renderers with sandbox disabled in Electron

- Severity: High 7.5
- Published: Sep 6, 2023
- Affected: from 22.0.0-beta.1, fixed in 22.0.1; from 23.0.0-alpha.1, fixed in 23.0.0-alpha.2.
- Fixed in 22.0.1 and 23.0.0-alpha.2.
- The latest release, 45.2.3, is not affected.
- <0.1% of electron downloads last week were affected versions (2.6K).

### [CVE-2023-29198](https://cve.now/CVE-2023-29198): Context isolation bypass via nested unserializable return value in Electron

- Severity: Medium 6.0
- Published: Sep 6, 2023
- Affected: fixed in 22.3.6; from 23.0.0-alpha.1, fixed in 23.2.3; from 24.0.0-alpha.1, fixed in 24.0.1; from 25.0.0-alpha.1, fixed in 25.0.0-alpha.2.
- Fixed in 22.3.6, 23.2.3, 24.0.1 and 1 other version.
- The latest release, 45.2.3, is not affected.
- 2.3% of electron downloads last week were affected versions (300.1K).

### [CVE-2023-39956](https://cve.now/CVE-2023-39956): Electron: Out-of-package code execution when launched with arbitrary cwd

- Severity: Medium 6.1
- Published: Sep 6, 2023
- Affected: fixed in 22.3.19; from 23.0.0-alpha.1, fixed in 23.3.13; from 24.0.0-alpha.1, fixed in 24.7.1; from 25.0.0-alpha.1, fixed in 25.5.0; from 26.0.0-alpha.1, fixed in 26.0.0-beta.13.
- Fixed in 22.3.19, 23.3.13, 24.7.1 and 2 other versions.
- The latest release, 45.2.3, is not affected.
- 2.5% of electron downloads last week were affected versions (336.7K).

### [CVE-2022-4135](https://cve.now/CVE-2022-4135): Heap buffer overflow in GPU in Google Chrome prior to 107.0.5304.121 allowed a remote attacker who had compromised the renderer process to p

- Severity: Critical 9.6 · KEV
- Published: Nov 25, 2022
- Affected: from 19.0.0, fixed in 19.1.8.
- Fixed in 19.1.8.
- The latest release, 45.2.3, is not affected.
- <0.1% of electron downloads last week were affected versions (9.2K).

### [CVE-2022-36077](https://cve.now/CVE-2022-36077): Electron subject to Exfiltration of hashed SMB credentials on Windows via file:// redirect

- Severity: High 7.2
- Published: Nov 8, 2022
- Affected: fixed in 18.3.7; from 20.0.0-beta.1, fixed in 20.0.1; from 19.0.0-beta.1, fixed in 19.0.11.
- Fixed in 18.3.7, 19.0.11 and 20.0.1.
- The latest release, 45.2.3, is not affected.
- 1.9% of electron downloads last week were affected versions (245.6K).

### [CVE-2022-29257](https://cve.now/CVE-2022-29257): Electron's AutoUpdater module fails to validate certain nested components of the bundle

- Severity: Medium 6.6
- Published: Jun 13, 2022
- Affected: fixed in 15.5.0; from 16.0.0, fixed in 16.2.0; from 17.0.0, fixed in 17.2.0; from 18.0.0-beta.1, fixed in 18.0.0-beta.6.
- Fixed in 15.5.0, 16.2.0, 17.2.0 and 1 other version.
- The latest release, 45.2.3, is not affected.
- 1.6% of electron downloads last week were affected versions (218.2K).

### [CVE-2022-29247](https://cve.now/CVE-2022-29247): Exposure of Resource to Wrong Sphere in Electron

- Severity: Low 2.2
- Published: Jun 13, 2022
- Affected: fixed in 15.5.5; from 16.0.0, fixed in 16.2.6; from 17.0.0, fixed in 17.2.0; from 18.0.0-beta.1, fixed in 18.0.0-beta.6.
- Fixed in 15.5.5, 16.2.6, 17.2.0 and 1 other version.
- The latest release, 45.2.3, is not affected.
- 1.6% of electron downloads last week were affected versions (218.6K).

### [CVE-2022-21718](https://cve.now/CVE-2022-21718): Renderers can obtain access to random bluetooth device without permission in Electron

- Severity: Low 3.4
- Published: Mar 22, 2022
- Affected: fixed in 13.6.6; from 14.0.0-beta.1, fixed in 14.2.4; from 15.0.0-beta.1, fixed in 15.3.5; from 16.0.0-beta.1, fixed in 16.0.6; from 17.0.0-alpha.1, fixed in 17.0.0-alpha.6.
- Fixed in 13.6.6, 14.2.4, 15.3.5 and 2 other versions.
- The latest release, 45.2.3, is not affected.
- 1.6% of electron downloads last week were affected versions (205.7K).

### [CVE-2021-39184](https://cve.now/CVE-2021-39184): Sandboxed renderers can obtain thumbnails of arbitrary files through the nativeImage API

- Severity: Medium 6.8
- Published: Oct 12, 2021
- Affected: fixed in 11.5.0; from 12.0.0, fixed in 12.1.0; from 13.0.0, fixed in 13.3.0.
- Fixed in 11.5.0, 12.1.0 and 13.3.0.
- The latest release, 45.2.3, is not affected.
- 1% of electron downloads last week were affected versions (138.7K).

### [CVE-2020-26272](https://cve.now/CVE-2020-26272): Electron vulnerable to ID collision when routing IPC messages to renderers containing OOPIFs

- Severity: Medium 5.4
- Published: Jan 28, 2021
- Affected: fixed in 9.4.0; from 10.0.0, fixed in 10.2.0; from 11.0.0, fixed in 11.1.0.
- Fixed in 9.4.0, 10.2.0 and 11.1.0.
- The latest release, 45.2.3, is not affected.
- 0.8% of electron downloads last week were affected versions (106.5K).

### [CVE-2020-15215](https://cve.now/CVE-2020-15215): Context isolation bypass in Electron

- Severity: Medium 5.6
- Published: Oct 6, 2020
- Affected: from 8.0.0-beta.0, fixed in 8.5.2; from 9.0.0-beta.0, fixed in 9.3.1; from 10.0.0-beta.0, fixed in 10.1.2; from 11.0.0-beta.0, fixed in 11.0.0-beta.6.
- Fixed in 8.5.2, 9.3.1, 10.1.2 and 1 other version.
- The latest release, 45.2.3, is not affected.
- <0.1% of electron downloads last week were affected versions (9.7K).

### [CVE-2020-15174](https://cve.now/CVE-2020-15174): Unpreventable top-level navigation in Electron

- Severity: High 7.5
- Published: Oct 6, 2020
- Affected: from 8.0.0-beta.0, fixed in 8.5.1; from 9.0.0-beta.0, fixed in 9.3.0; from 10.0.0-beta.0, fixed in 10.0.1.
- Fixed in 8.5.1, 9.3.0 and 10.0.1.
- The latest release, 45.2.3, is not affected.
- <0.1% of electron downloads last week were affected versions (9.1K).

### [CVE-2020-15096](https://cve.now/CVE-2020-15096): Context isolation bypass via Promise in Electron

- Severity: Medium 6.8
- Published: Jul 7, 2020
- Affected: fixed in 6.1.11; from 7.0.0, fixed in 7.2.4; from 8.0.0, fixed in 8.2.4.
- Fixed in 6.1.11, 7.2.4 and 8.2.4.
- The latest release, 45.2.3, is not affected.
- 0.7% of electron downloads last week were affected versions (86.9K).

### [CVE-2020-4075](https://cve.now/CVE-2020-4075): Arbitrary file read via window-open IPC in Electron

- Severity: Medium 6.8
- Published: Jul 7, 2020
- Affected: fixed in 7.2.4; from 8.0.0, fixed in 8.2.4.
- Fixed in 7.2.4 and 8.2.4.
- The latest release, 45.2.3, is not affected.
- 0.7% of electron downloads last week were affected versions (88.6K).

### [CVE-2020-4076](https://cve.now/CVE-2020-4076): Context isolation bypass via leaked cross-context objects in Electron

- Severity: High 7.8
- Published: Jul 7, 2020
- Affected: fixed in 7.2.4; from 8.0.0, fixed in 8.2.4.
- Fixed in 7.2.4 and 8.2.4.
- The latest release, 45.2.3, is not affected.
- 0.7% of electron downloads last week were affected versions (88.6K).

### [CVE-2020-4077](https://cve.now/CVE-2020-4077): Context isolation bypass via contextBridge in Electron

- Severity: High 7.7
- Published: Jul 7, 2020
- Affected: fixed in 7.2.4; from 8.0.0, fixed in 8.2.4.
- Fixed in 7.2.4 and 8.2.4.
- The latest release, 45.2.3, is not affected.
- 0.7% of electron downloads last week were affected versions (88.6K).

### [CVE-2018-15685](https://cve.now/CVE-2018-15685): GitHub Electron 1.7.15, 1.8.7, 2.0.7, and 3.0.0-beta.6, in certain scenarios involving IFRAME elements and "nativeWindowOpen: true" or…

- Severity: Unrated
- Published: Aug 23, 2018
- Affected: from 1.7.0, fixed in 1.7.16; from 1.8.0, fixed in 1.8.8; from 2.0.0, fixed in 2.0.8; from 3.0.0-beta.1, fixed in 3.0.0-beta.7.
- Fixed in 1.7.16, 1.8.8, 2.0.8 and 1 other version.
- The latest release, 45.2.3, is not affected.
- <0.1% of electron downloads last week were affected versions (11.4K).

### [CVE-2017-16151](https://cve.now/CVE-2017-16151): Based on details posted by the ElectronJS team; A remote code execution vulnerability has been discovered in Google Chromium that affects…

- Severity: Unrated
- Published: Jun 7, 2018
- Affected: fixed in 1.6.14; from 1.7.0, fixed in 1.7.8.
- Fixed in 1.6.14 and 1.7.8.
- The latest release, 45.2.3, is not affected.
- 0.1% of electron downloads last week were affected versions (14.7K).

### [CVE-2018-1000136](https://cve.now/CVE-2018-1000136): Electron version 1.7 up to 1.7.12; 1.8 up to 1.8.3 and 2.0.0 up to 2.0.0-beta.3 contains an improper handling of values vulnerability in…

- Severity: Unrated
- Published: Mar 23, 2018
- Affected: from 1.7.0, fixed in 1.7.13; from 1.8.0, fixed in 1.8.4; from 2.0.0-beta.1, fixed in 2.0.0-beta.5.
- Fixed in 1.7.13, 1.8.4 and 2.0.0-beta.5.
- The latest release, 45.2.3, is not affected.
- <0.1% of electron downloads last week were affected versions (6.5K).

### [CVE-2018-1000118](https://cve.now/CVE-2018-1000118): Github Electron version Electron 1.8.2-beta.4 and earlier contains a Command Injection vulnerability in Protocol Handler that can result…

- Severity: Unrated
- Published: Mar 7, 2018
- Affected: fixed in 1.8.2-beta5.
- Fixed in 1.8.2-beta5.
- The latest release, 45.2.3, is not affected.
- 0.1% of electron downloads last week were affected versions (19.8K).

### [CVE-2018-1000006](https://cve.now/CVE-2018-1000006): GitHub Electron versions 1.8.2-beta.3 and earlier, 1.7.10 and earlier, 1.6.15 and earlier has a vulnerability in the protocol handler…

- Severity: Unrated
- Published: Jan 24, 2018
- Affected: from 1.7.0, fixed in 1.7.11; from 1.6.0, fixed in 1.6.16; from 1.8.0, fixed in 1.8.2-beta.4.
- Fixed in 1.6.16, 1.7.11 and 1.8.2-beta.4.
- The latest release, 45.2.3, is not affected.
- <0.1% of electron downloads last week were affected versions (6.6K).

### [CVE-2017-1000424](https://cve.now/CVE-2017-1000424): Github Electron version 1.6.4 - 1.6.11 and 1.7.0 - 1.7.5 is vulnerable to a URL Spoofing problem when opening PDFs in PDFium resulting…

- Severity: Unrated
- Published: Jan 2, 2018
- Affected: from 1.7.0, fixed in 1.7.6.
- Fixed in 1.7.6.
- The latest release, 45.2.3, is not affected.
- <0.1% of electron downloads last week were affected versions (669).

### [CVE-2017-12581](https://cve.now/CVE-2017-12581): GitHub Electron before 1.6.8 allows remote command execution because of a nodeIntegration bypass vulnerability.

- Severity: Unrated
- Published: Aug 6, 2017
- Affected: fixed in 1.6.8.
- Fixed in 1.6.8.
- The latest release, 45.2.3, is not affected.
- <0.1% of electron downloads last week were affected versions (12.6K).

### [CVE-2016-1202](https://cve.now/CVE-2016-1202): Untrusted search path vulnerability in Atom Electron before 0.33.5 allows local users to gain privileges via a Trojan horse Node.js module…

- Severity: Unrated
- Published: Apr 25, 2016
- Affected: fixed in 0.33.5.
- Fixed in 0.33.5.
- The latest release, 45.2.3, is not affected.
- <0.1% of electron downloads last week were affected versions (9.2K).

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/packages/npm/electron
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.