[ Vendor · 13 CVEs ]
electron
CVEs affecting electron published in the last 30 days, plus any electron CVE on CISA's exploited list.
| CVE | Published | Severity | Vulnerability | Signals |
|---|---|---|---|---|
| CVE-2026-114124 | 21 Oct 2026 | CVSS 3.9 | Electron: Off-screen rendering on macOS trusts GPU-supplied frame geometryElectron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to versions 42.11.6, 43.7.3, 44.4.3… | Fix |
| CVE-2026-113800 | 21 Oct 2026 | CVSS 5.4 | Electron: HID and USB permission checks can be attributed to the wrong originElectron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to versions 42.11.3, 43.7.0, 44.3.0… | Fix |
| CVE-2026-114121 | 21 Oct 2026 | CVSS 5.4 | Electron: openExternal permission requests can be attributed to the wrong originElectron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to versions 42.11.3, 43.7.0, 44.3.0… | Fix |
| CVE-2026-114122 | 21 Oct 2026 | CVSS 3.9 | Electron: Frame subscription trusts GPU-supplied frame geometryElectron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to versions 42.11.6, 43.7.3, 44.4.3… | Fix |
| CVE-2026-113796 | 21 Oct 2026 | CVSS 4.2 | Electron: SameSite cookie restrictions are not applied to windows opened from linksElectron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to versions 42.11.3, 43.7.0, 44.3.0… | Fix |
| CVE-2026-113797 | 21 Oct 2026 | CVSS 3.1 | Electron: Extension tabs.query returns tab URLs and titles without the tabs permissionElectron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to versions 42.11.1, 43.5.1, 44.1.1… | Fix |
| CVE-2026-113798 | 21 Oct 2026 | CVSS 5.4 | Electron: Pointer lock permission requests can be attributed to the wrong frameElectron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to versions 42.11.9, 43.7.6, 44.5.0… | Fix |
| CVE-2026-102672 | 13 Oct 2026 | CVSS 6.7 | Electron: Local race condition in Squirrel.Mac update installation on macOSElectron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.10, 41.10.5, and 42.0.0-beta.2… | Fix |
| CVE-2026-102677 | 29 Sep 2026 | CVSS 8.8 | Electron: Sandboxed preload code cache can be poisoned by a compromised rendererElectron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. From 42.3.3 until 42.10.0, 43.5.0, and… | Fix |
| CVE-2026-102673 | 29 Sep 2026 | CVSS 6.1 | Electron drops inherited HTML sandbox restrictions for popups opened through OpenURLFromTabElectron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 41.10.4, 42.5.2, and 43.0.0, popups… | Fix |
| CVE-2026-102674 | 29 Sep 2026 | CVSS 6.1 | Electron: Windows opened from a sandboxed top-level document do not inherit its sandbox restrictionsElectron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 41.10.6, 42.9.2, 43.4.1, and… | Fix |
| CVE-2026-102675 | 29 Sep 2026 | CVSS 7.4 | Electron: File and HTTP protocol handlers allow cross-origin reads without corsEnabledElectron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 41.10.6, 42.9.2, 43.4.1, and… | Fix |
| CVE-2026-102676 | 29 Sep 2026 | CVSS 9.8 | Electron: <webview> can enable Node.js integration in Web Workers despite embedder restrictionsElectron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 41.10.6, 42.9.2, 43.4.1, and… | Fix |