# cve.now: Electron

The newest entries naming Electron as an affected vendor (up to 200), of 70 in all, 0 known exploited. Older ones are in the full catalog at https://cve.now/latest.md.

- [CVE-2026-115570](https://cve.now/CVE-2026-115570.md): Electron: Mitigation for compromised eMudhra intermediate certificates (CVSS 7.4)
- [CVE-2026-114124](https://cve.now/CVE-2026-114124.md): Electron: Off-screen rendering on macOS trusts GPU-supplied frame geometry (CVSS 3.9)
- [CVE-2026-114122](https://cve.now/CVE-2026-114122.md): Electron: Frame subscription trusts GPU-supplied frame geometry (CVSS 3.9)
- [CVE-2026-114121](https://cve.now/CVE-2026-114121.md): Electron: openExternal permission requests can be attributed to the wrong origin (CVSS 5.4)
- [CVE-2026-113800](https://cve.now/CVE-2026-113800.md): Electron: HID and USB permission checks can be attributed to the wrong origin (CVSS 5.4)
- [CVE-2026-113798](https://cve.now/CVE-2026-113798.md): Electron: Pointer lock permission requests can be attributed to the wrong frame (CVSS 5.4)
- [CVE-2026-113797](https://cve.now/CVE-2026-113797.md): Electron: Extension tabs.query returns tab URLs and titles without the tabs permission (CVSS 3.1)
- [CVE-2026-113796](https://cve.now/CVE-2026-113796.md): Electron: SameSite cookie restrictions are not applied to windows opened from links (CVSS 4.2)
- [CVE-2026-102672](https://cve.now/CVE-2026-102672.md): Electron: Local race condition in Squirrel.Mac update installation on macOS (CVSS 6.7)
- [CVE-2026-102677](https://cve.now/CVE-2026-102677.md): Electron: Sandboxed preload code cache can be poisoned by a compromised renderer (CVSS 7.8)
- [CVE-2026-102676](https://cve.now/CVE-2026-102676.md): Electron: \<webview\> can enable Node.js integration in Web Workers despite embedder restrictions (CVSS 8.3)
- [CVE-2026-102675](https://cve.now/CVE-2026-102675.md): Electron: File and HTTP protocol handlers allow cross-origin reads without corsEnabled (CVSS 7.4)
- [CVE-2026-102674](https://cve.now/CVE-2026-102674.md): Electron: Windows opened from a sandboxed top-level document do not inherit its sandbox restrictions (CVSS 8.2)
- [CVE-2026-102673](https://cve.now/CVE-2026-102673.md): Electron drops inherited HTML sandbox restrictions for popups opened through OpenURLFromTab (CVSS 8.2)
- [CVE-2026-70612](https://cve.now/CVE-2026-70612.md): Electron: Sandboxed iframes can launch external protocol handlers (CVSS 5.4)
- [CVE-2026-70611](https://cve.now/CVE-2026-70611.md): Electron: DevTools embedder handler executes arbitrary files via shell open (CVSS 6.9)
- [CVE-2026-70610](https://cve.now/CVE-2026-70610.md): Electron: contextBridge object copy honors prototype setters (CVSS 5.4)
- [CVE-2026-70609](https://cve.now/CVE-2026-70609.md): Electron: DevTools JavaScript Injection via Unsanitized Dock State Parameter (CVSS 5.7)
- [CVE-2026-70608](https://cve.now/CVE-2026-70608.md): Electron: Sandboxed iframe can bypass the allow-popups restriction via the OpenURL navigation path (CVSS 7.2)
- [CVE-2026-70607](https://cve.now/CVE-2026-70607.md): Electron: window.open features string controls some window options considered privileged (CVSS 5.3)
- [CVE-2026-70606](https://cve.now/CVE-2026-70606.md): Electron: ProtocolResponse.url reuses the default session cache instead of the registering session (CVSS 5.9)
- [CVE-2026-70605](https://cve.now/CVE-2026-70605.md): Electron: HTTP redirect followed into local file loader (CVSS 5.9)
- [CVE-2026-70604](https://cve.now/CVE-2026-70604.md): Electron: Custom protocol with supportFetchAPI but not corsEnabled allows cross-origin reads (CVSS 7.4)
- [CVE-2026-70603](https://cve.now/CVE-2026-70603.md): Electron: shell.openPath path validation bypass via embedded null byte (CVSS 6.0)
- [CVE-2026-70602](https://cve.now/CVE-2026-70602.md): Electron: Extension tab APIs operate across session boundaries (CVSS 6.6)
- [CVE-2026-70601](https://cve.now/CVE-2026-70601.md): Electron: Context isolation bypass via Function.prototype.bind hijack (CVSS 7.5)
- [CVE-2026-70600](https://cve.now/CVE-2026-70600.md): Electron: Cross-origin iframe can position native autofill popup (CVSS 3.1)
- [CVE-2026-70599](https://cve.now/CVE-2026-70599.md): Electron: Permission Check Handler Receives Main Frame Origin Instead of Requesting Iframe Origin (CVSS 5.9)
- [CVE-2026-70598](https://cve.now/CVE-2026-70598.md): Electron: Off-screen rendering trusts GPU-supplied geometry over shared-memory size (CVSS 3.9)
- [CVE-2026-70597](https://cve.now/CVE-2026-70597.md): Electron: Parent process code-sign check is spoofable (CVSS 6.3)
- [CVE-2026-54257](https://cve.now/CVE-2026-54257.md): Electron: Buffer performs incorrect byte length calculations resulting in heap buffer under/overflow (CVSS 9.3)
- [CVE-2026-34781](https://cve.now/CVE-2026-34781.md): Electron crashes in clipboard.readImage() on malformed clipboard image data (CVSS 2.8)
- [CVE-2026-34765](https://cve.now/CVE-2026-34765.md): Electron named window.open targets not scoped to the opener's browsing context (CVSS 6.0)
- [CVE-2026-34764](https://cve.now/CVE-2026-34764.md): Electron has a use-after-free in offscreen shared texture release() callback (CVSS 2.3)
- [CVE-2026-34780](https://cve.now/CVE-2026-34780.md): Electron: Context Isolation bypass via contextBridge VideoFrame transfer (CVSS 8.4)
- [CVE-2026-34779](https://cve.now/CVE-2026-34779.md): Electron: AppleScript injection in app.moveToApplicationsFolder on macOS (CVSS 6.5)
- [CVE-2026-34778](https://cve.now/CVE-2026-34778.md): Electron: Service worker can spoof executeJavaScript IPC replies (CVSS 5.9)
- [CVE-2026-34777](https://cve.now/CVE-2026-34777.md): Electron: Incorrect origin passed to permission request handler for iframe requests (CVSS 5.4)
- [CVE-2026-34776](https://cve.now/CVE-2026-34776.md): Electron: Out-of-bounds read in second-instance IPC on macOS and Linux (CVSS 5.3)
- [CVE-2026-34775](https://cve.now/CVE-2026-34775.md): Electron: nodeIntegrationInWorker not correctly scoped in shared renderer processes (CVSS 6.8)
- [CVE-2026-34774](https://cve.now/CVE-2026-34774.md): Electron: Use-after-free in offscreen child window paint callback (CVSS 8.1)
- [CVE-2026-34773](https://cve.now/CVE-2026-34773.md): Electron: Registry key path injection in app.setAsDefaultProtocolClient on Windows (CVSS 4.7)
- [CVE-2026-34772](https://cve.now/CVE-2026-34772.md): Electron: Use-after-free in download save dialog callback (CVSS 5.8)
- [CVE-2026-34771](https://cve.now/CVE-2026-34771.md): Electron: Use-after-free in WebContents fullscreen, pointer-lock, and keyboard-lock permission callbacks (CVSS 7.5)
- [CVE-2026-34770](https://cve.now/CVE-2026-34770.md): Electron: Use-after-free in PowerMonitor on Windows and macOS (CVSS 7.0)
- [CVE-2026-34768](https://cve.now/CVE-2026-34768.md): Electron: Unquoted executable path in app.setLoginItemSettings on Windows (CVSS 3.9)
- [CVE-2026-34767](https://cve.now/CVE-2026-34767.md): Electron: HTTP Response Header Injection in custom protocol handlers and webRequest (CVSS 5.9)
- [CVE-2026-34766](https://cve.now/CVE-2026-34766.md): Electron: USB device selection not validated against filtered device list (CVSS 3.3)
- [CVE-2026-34769](https://cve.now/CVE-2026-34769.md): Electron: Renderer command-line switch injection via undocumented commandLineSwitches webPreference (CVSS 7.8)
- [CVE-2025-55305](https://cve.now/CVE-2025-55305.md): Electron is vulnerable to Code Injection via resource modification (CVSS 6.1)
- [CVE-2024-46993](https://cve.now/CVE-2024-46993.md): Electron Vulnerable to Heap Buffer Overflow in NativeImage::CreateFromPath (CVSS 4.4)
- [CVE-2024-46992](https://cve.now/CVE-2024-46992.md): Electron ASAR Integrity bypass by just modifying the content (CVSS 7.8)
- [CVE-2024-29900](https://cve.now/CVE-2024-29900.md): @electron/packager's build process memory potentially leaked into final executable (CVSS 7.5)
- [CVE-2023-44402](https://cve.now/CVE-2023-44402.md): ASAR Integrity bypass via filetype confusion in electron (CVSS 6.1)
- [CVE-2023-23623](https://cve.now/CVE-2023-23623.md): Content-Secrity-Policy disabling eval not applied consistently in renderers with sandbox disabled in Electron (CVSS 7.5)
- [CVE-2023-29198](https://cve.now/CVE-2023-29198.md): Context isolation bypass via nested unserializable return value in Electron (CVSS 6.0)
- [CVE-2023-39956](https://cve.now/CVE-2023-39956.md): Electron: Out-of-package code execution when launched with arbitrary cwd (CVSS 6.1)
- [CVE-2022-36077](https://cve.now/CVE-2022-36077.md): Electron subject to Exfiltration of hashed SMB credentials on Windows via file:// redirect (CVSS 7.2)
- [CVE-2022-29257](https://cve.now/CVE-2022-29257.md): Electron's AutoUpdater module fails to validate certain nested components of the bundle (CVSS 6.6)
- [CVE-2022-29247](https://cve.now/CVE-2022-29247.md): Exposure of Resource to Wrong Sphere in Electron (CVSS 2.2)
- [CVE-2022-21718](https://cve.now/CVE-2022-21718.md): Renderers can obtain access to random bluetooth device without permission in Electron (CVSS 3.4)
- [CVE-2021-39184](https://cve.now/CVE-2021-39184.md): Sandboxed renderers can obtain thumbnails of arbitrary files through the nativeImage API (CVSS 6.8)
- [CVE-2020-26272](https://cve.now/CVE-2020-26272.md): Electron vulnerable to ID collision when routing IPC messages to renderers containing OOPIFs (CVSS 5.4)
- [CVE-2020-15215](https://cve.now/CVE-2020-15215.md): Context isolation bypass in Electron (CVSS 5.6)
- [CVE-2020-15174](https://cve.now/CVE-2020-15174.md): Unpreventable top-level navigation in Electron (CVSS 7.5)
- [CVE-2020-15096](https://cve.now/CVE-2020-15096.md): Context isolation bypass via Promise in Electron (CVSS 6.8)
- [CVE-2020-4075](https://cve.now/CVE-2020-4075.md): Arbitrary file read via window-open IPC in Electron (CVSS 6.8)
- [CVE-2020-4076](https://cve.now/CVE-2020-4076.md): Context isolation bypass via leaked cross-context objects in Electron (CVSS 7.8)
- [CVE-2020-4077](https://cve.now/CVE-2020-4077.md): Context isolation bypass via contextBridge in Electron (CVSS 7.7)
- [CVE-2011-3582](https://cve.now/CVE-2011-3582.md): A Cross-site Request Forgery (CSRF) vulnerability exists in Advanced Electron Forums (AEF) through 1.0.9 due to inadequate confirmation for (no CVSS)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/vendors/electron
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.