Log in Start free

Vulnerability · Published Apr 3, 2026 · Assigned by GitHub_M

CVE-2026-34774Electron: Use-after-free in offscreen child window paint callback

High 8.1

In plain English

A high-severity use-after-free in electron from electron. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 39% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)8.1High
Exploit odds (30 days)0.5%top 60.6% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to versions 39.8.1, 40.7.0, and 41.0.0, apps that use offscreen rendering and allow child windows via window.open() may be vulnerable to a use-after-free. If the parent offscreen WebContents is destroyed while a child window remains open, subsequent paint frames on the child dereference freed memory, which may lead to a crash or memory corruption. Apps are only affected if they use offscreen rendering (webPreferences.offscreen: true) and their setWindowOpenHandler permits child windows. Apps that do not use offscreen rendering, or that deny child windows, are not affected. This issue has been patched in versions 39.8.1, 40.7.0, and 41.0.0.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
npmelectron39.8.1GHSA-532v-xpq5-8h95
npmelectron40.7.0GHSA-532v-xpq5-8h95
npmelectron41.0.0GHSA-532v-xpq5-8h95

Affected products (as reported)

VendorProductVersions
electron electron < 39.8.1>= 40.0.0-alpha.1, < 40.7.0>= 41.0.0-alpha.1, < 41.0.0

Weakness: CWE-416, CWE-825 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

References