High severity · published Apr 3, 2026
CVE-2026-34771
Electron: Use-after-free in WebContents fullscreen, pointer-lock, and keyboard-lock permission callbacks
8.8
CVSS
0.3%
EPSS
No
On KEV
Description
Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to versions 38.8.6, 39.8.0, 40.7.0, and 41.0.0-beta.8, apps that register an asynchronous session.setPermissionRequestHandler() may be vulnerable to a use-after-free when handling fullscreen, pointer-lock, or keyboard-lock permission requests. If the requesting frame navigates or the window closes while the permission handler is pending, invoking the stored callback dereferences freed memory, which may lead to a crash or memory corruption. Apps that do not set a permission request handler, or whose handler responds synchronously, are not affected. This issue has been patched in versions 38.8.6, 39.8.0, 40.7.0, and 41.0.0-beta.8.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 21% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
EL
electron · electron
< 38.8.6; >= 39.0.0-alpha.1, < 39.8.0; >= 40.0.0-alpha.1, < 40.7.0; >= 41.0.0-alpha.1, < 41.0.0-beta.8 · source: vendor, NVD
RH
Red Hat Build of Podman Desktop · Red Hat
All versions, or not specified · source: CISA
RH
Red Hat Build of Podman Desktop - Tech Preview · Red Hat
All versions, or not specified · source: CISA
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-34771
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-34771
Vendor Advisory
https://github.com/electron/electron/security/advisories/GHSA-8337-3p73-46f4
access.redhat.com
https://access.redhat.com/security/cve/CVE-2026-34771
bugzilla.redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=2454995
security.access.redhat.com
https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-34771.json
More from electron
9.8
CVE-2026-102676
Electron: <webview> can enable Node.js integration in Web Workers despite embedder restrictions
9.8
CVE-2026-34775
Electron: nodeIntegrationInWorker not correctly scoped in shared renderer processes
9.3
CVE-2026-54257
Electron: Buffer performs incorrect byte length calculations resulting in heap buffer under/overflow
8.8
CVE-2026-102677
Electron: Sandboxed preload code cache can be poisoned by a compromised renderer
8.8
CVE-2026-34765
Electron named window.open targets not scoped to the opener's browsing context