Low severity · published Oct 21, 2026
CVE-2026-114124
Electron: Off-screen rendering on macOS trusts GPU-supplied frame geometry
New
3.9
CVSS
0.2%
EPSS
No
On KEV
Description
Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to versions 42.11.6, 43.7.3, 44.4.3, and 45.0.0-alpha.9, frame data received from the GPU process for macOS offscreen rendering was not fully validated by the main process. An attacker who had separately gained code execution in the GPU process could provide inconsistent frame geometry and cause the main process to read out-of-bounds memory while producing paint event images, disclosing memory or crashing the application. This issue is fixed in versions 42.11.6, 43.7.3, 44.4.3, and 45.0.0-alpha.9.
CVSS vector
CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:L/I:N/A:L
Attack vector
Local
Complexity
High
Privileges
High
User interaction
None
Confidentiality
Low
Integrity
None
Availability
Low
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 8% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
EL
electron · electron
< 42.11.6; >= 43.0.0-alpha.1, < 43.7.3; >= 44.0.0-alpha.1, < 44.4.3; >= 45.0.0-alpha.1, < 45.0.0-alpha.9 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-114124
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-114124
github.com
https://github.com/electron/electron/commit/24d8dbc661c6a109476ae59e9a2740b35d005cf4
github.com
https://github.com/electron/electron/commit/64ae597deda8956037387b439e6361f0fe936c86
github.com
https://github.com/electron/electron/commit/8d48be150c3fd53b0d02854124bdb7858598799c
github.com
https://github.com/electron/electron/commit/d496507ffa1693edaa704a4be130fbcb8ecb4ada
github.com
https://github.com/electron/electron/commit/d7f87070a8d738e561245d1ade4d6fbb082db80a
github.com
https://github.com/electron/electron/pull/54033
More from electron
9.8
CVE-2026-102676
Electron: <webview> can enable Node.js integration in Web Workers despite embedder restrictions
9.8
CVE-2026-34775
Electron: nodeIntegrationInWorker not correctly scoped in shared renderer processes
9.3
CVE-2026-54257
Electron: Buffer performs incorrect byte length calculations resulting in heap buffer under/overflow
8.8
CVE-2026-102677
Electron: Sandboxed preload code cache can be poisoned by a compromised renderer
8.8
CVE-2026-34765
Electron named window.open targets not scoped to the opener's browsing context