Electron vulnerabilities
70 CVEs and advisories name Electron as an affected vendor, newest first. Follow it as a feed.
- CVE-2026-54257Electron: Buffer performs incorrect byte length calculations resulting in heap buffer under/overflow
- CVE-2026-34781Electron crashes in clipboard.readImage() on malformed clipboard image data
- CVE-2026-34765Electron named window.open targets not scoped to the opener's browsing context
- CVE-2026-34764Electron has a use-after-free in offscreen shared texture release() callback
- CVE-2026-34780Electron: Context Isolation bypass via contextBridge VideoFrame transfer
- CVE-2026-34779Electron: AppleScript injection in app.moveToApplicationsFolder on macOS
- CVE-2026-34778Electron: Service worker can spoof executeJavaScript IPC replies
- CVE-2026-34777Electron: Incorrect origin passed to permission request handler for iframe requests
- CVE-2026-34776Electron: Out-of-bounds read in second-instance IPC on macOS and Linux
- CVE-2026-34775Electron: nodeIntegrationInWorker not correctly scoped in shared renderer processes
- CVE-2026-34774Electron: Use-after-free in offscreen child window paint callback
- CVE-2026-34773Electron: Registry key path injection in app.setAsDefaultProtocolClient on Windows
- CVE-2026-34772Electron: Use-after-free in download save dialog callback
- CVE-2026-34771Electron: Use-after-free in WebContents fullscreen, pointer-lock, and keyboard-lock permission callbacks
- CVE-2026-34770Electron: Use-after-free in PowerMonitor on Windows and macOS
- CVE-2026-34768Electron: Unquoted executable path in app.setLoginItemSettings on Windows
- CVE-2026-34767Electron: HTTP Response Header Injection in custom protocol handlers and webRequest
- CVE-2026-34766Electron: USB device selection not validated against filtered device list
- CVE-2026-34769Electron: Renderer command-line switch injection via undocumented commandLineSwitches webPreference
- CVE-2025-55305Electron is vulnerable to Code Injection via resource modification
- CVE-2024-46993Electron Vulnerable to Heap Buffer Overflow in NativeImage::CreateFromPath
- CVE-2024-46992Electron ASAR Integrity bypass by just modifying the content
- CVE-2024-29900@electron/packager's build process memory potentially leaked into final executable
- CVE-2023-44402ASAR Integrity bypass via filetype confusion in electron
- CVE-2023-23623Content-Secrity-Policy disabling eval not applied consistently in renderers with sandbox disabled in Electron
- CVE-2023-29198Context isolation bypass via nested unserializable return value in Electron
- CVE-2023-39956Electron: Out-of-package code execution when launched with arbitrary cwd
- CVE-2022-36077Electron subject to Exfiltration of hashed SMB credentials on Windows via file:// redirect
- CVE-2022-29257Electron's AutoUpdater module fails to validate certain nested components of the bundle
- CVE-2022-29247Exposure of Resource to Wrong Sphere in Electron