Electron vulnerabilities
70 CVEs and advisories name Electron as an affected vendor, newest first. Follow it as a feed.
- CVE-2026-115570Electron: Mitigation for compromised eMudhra intermediate certificates
- CVE-2026-114124Electron: Off-screen rendering on macOS trusts GPU-supplied frame geometry
- CVE-2026-114122Electron: Frame subscription trusts GPU-supplied frame geometry
- CVE-2026-114121Electron: openExternal permission requests can be attributed to the wrong origin
- CVE-2026-113800Electron: HID and USB permission checks can be attributed to the wrong origin
- CVE-2026-113798Electron: Pointer lock permission requests can be attributed to the wrong frame
- CVE-2026-113797Electron: Extension tabs.query returns tab URLs and titles without the tabs permission
- CVE-2026-113796Electron: SameSite cookie restrictions are not applied to windows opened from links
- CVE-2026-102672Electron: Local race condition in Squirrel.Mac update installation on macOS
- CVE-2026-102677Electron: Sandboxed preload code cache can be poisoned by a compromised renderer
- CVE-2026-102676Electron: <webview> can enable Node.js integration in Web Workers despite embedder restrictions
- CVE-2026-102675Electron: File and HTTP protocol handlers allow cross-origin reads without corsEnabled
- CVE-2026-102674Electron: Windows opened from a sandboxed top-level document do not inherit its sandbox restrictions
- CVE-2026-102673Electron drops inherited HTML sandbox restrictions for popups opened through OpenURLFromTab
- CVE-2026-70612Electron: Sandboxed iframes can launch external protocol handlers
- CVE-2026-70611Electron: DevTools embedder handler executes arbitrary files via shell open
- CVE-2026-70610Electron: contextBridge object copy honors prototype setters
- CVE-2026-70609Electron: DevTools JavaScript Injection via Unsanitized Dock State Parameter
- CVE-2026-70608Electron: Sandboxed iframe can bypass the allow-popups restriction via the OpenURL navigation path
- CVE-2026-70607Electron: window.open features string controls some window options considered privileged
- CVE-2026-70606Electron: ProtocolResponse.url reuses the default session cache instead of the registering session
- CVE-2026-70605Electron: HTTP redirect followed into local file loader
- CVE-2026-70604Electron: Custom protocol with supportFetchAPI but not corsEnabled allows cross-origin reads
- CVE-2026-70603Electron: shell.openPath path validation bypass via embedded null byte
- CVE-2026-70602Electron: Extension tab APIs operate across session boundaries
- CVE-2026-70601Electron: Context isolation bypass via Function.prototype.bind hijack
- CVE-2026-70600Electron: Cross-origin iframe can position native autofill popup
- CVE-2026-70599Electron: Permission Check Handler Receives Main Frame Origin Instead of Requesting Iframe Origin
- CVE-2026-70598Electron: Off-screen rendering trusts GPU-supplied geometry over shared-memory size
- CVE-2026-70597Electron: Parent process code-sign check is spoofable