electron

Products

Exploited and recent CVEs

• CVE-2026-115570 High 7.4 Electron: Mitigation for compromised eMudhra intermediate certificates 0.4%
• CVE-2026-114124 Low 3.9 Electron: Off-screen rendering on macOS trusts GPU-supplied frame geometry 0.2%
• CVE-2026-114122 Low 3.9 Electron: Frame subscription trusts GPU-supplied frame geometry 0.2%
• CVE-2026-114121 Medium 5.4 Electron: openExternal permission requests can be attributed to the wrong origin 0.2%
• CVE-2026-113800 Medium 5.4 Electron: HID and USB permission checks can be attributed to the wrong origin 0.2%
• CVE-2026-113798 Medium 5.4 Electron: Pointer lock permission requests can be attributed to the wrong frame 0.2%
• CVE-2026-113797 Low 3.1 Electron: Extension tabs.query returns tab URLs and titles without the tabs permission 0.6%
• CVE-2026-113796 Medium 4.2 Electron: SameSite cookie restrictions are not applied to windows opened from links 0.2%
• CVE-2026-102672 Medium 6.7 Electron: Local race condition in Squirrel.Mac update installation on macOS <0.1%
• CVE-2026-102677 High 7.8 Electron: Sandboxed preload code cache can be poisoned by a compromised renderer <0.1%
• CVE-2026-102676 High 8.3 Electron: <webview> can enable Node.js integration in Web Workers despite embedder restrictions 0.5%
• CVE-2026-102675 High 7.4 Electron: File and HTTP protocol handlers allow cross-origin reads without corsEnabled 0.2%
• CVE-2026-102674 High 8.2 Electron: Windows opened from a sandboxed top-level document do not inherit its sandbox restrictions 0.2%
• CVE-2026-102673 High 8.2 Electron drops inherited HTML sandbox restrictions for popups opened through OpenURLFromTab 0.1%
• CVE-2026-70612 Medium 5.4 Electron: Sandboxed iframes can launch external protocol handlers 0.4%
• CVE-2026-70611 Medium 6.9 Electron: DevTools embedder handler executes arbitrary files via shell open 0.2%
• CVE-2026-70610 Medium 5.4 Electron: contextBridge object copy honors prototype setters 0.6%
• CVE-2026-70609 Medium 5.7 Electron: DevTools JavaScript Injection via Unsanitized Dock State Parameter 0.5%
• CVE-2026-70608 High 7.2 Electron: Sandboxed iframe can bypass the allow-popups restriction via the OpenURL navigation path 0.4%
• CVE-2026-70607 Medium 5.3 Electron: window.open features string controls some window options considered privileged 0.6%
• CVE-2026-70606 Medium 5.9 Electron: ProtocolResponse.url reuses the default session cache instead of the registering session 0.3%
• CVE-2026-70605 Medium 5.9 Electron: HTTP redirect followed into local file loader 0.3%
• CVE-2026-70604 High 7.4 Electron: Custom protocol with supportFetchAPI but not corsEnabled allows cross-origin reads 0.4%
• CVE-2026-70603 Medium 6.0 Electron: shell.openPath path validation bypass via embedded null byte 0.1%
• CVE-2026-70602 Medium 6.6 Electron: Extension tab APIs operate across session boundaries 0.3%
• CVE-2026-70601 High 7.5 Electron: Context isolation bypass via Function.prototype.bind hijack 0.3%
• CVE-2026-70600 Low 3.1 Electron: Cross-origin iframe can position native autofill popup 0.2%
• CVE-2026-70599 Medium 5.9 Electron: Permission Check Handler Receives Main Frame Origin Instead of Requesting Iframe Origin 0.2%
• CVE-2026-70598 Low 3.9 Electron: Off-screen rendering trusts GPU-supplied geometry over shared-memory size 0.1%
• CVE-2026-70597 Medium 6.3 Electron: Parent process code-sign check is spoofable 0.1%