EL
Product
electron
50
CVEs
0
On KEV
9.8
Max CVSS
14
New 30D
Severity mix
Critical 3High 16Medium 26Low 5
Watch
Add electron to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-102677 | 8.8 | Sep 29 | Electron: Sandboxed preload code cache can be poisoned by a compromised renderer Affected: >= 42.3.3, < 42.10.0; >= 43.0.0-beta.1, < 43.5.0; >= 44.0.0-alpha.1, < 44.0.0-beta.6 |
| CVE-2026-34765 | 8.8 | Apr 7 | Electron named window.open targets not scoped to the opener's browsing context Affected: < 39.8.5; >= 40.0.0-alpha.1, < 40.8.5; >= 41.0.0-alpha.1, < 41.1.0; >= 42.0.0-alpha.1, < 42.0.0-alpha.5 |
| CVE-2026-34772 | 8.8 | Apr 3 | Electron: Use-after-free in download save dialog callback Affected: < 38.8.6; >= 39.0.0-alpha.1, < 39.8.0; >= 40.0.0-alpha.1, < 40.7.0; >= 41.0.0-alpha.1, < 41.0.0-beta.8 |
| CVE-2026-34771 | 8.8 | Apr 3 | Electron: Use-after-free in WebContents fullscreen, pointer-lock, and keyboard-lock permission callbacks Affected: < 38.8.6; >= 39.0.0-alpha.1, < 39.8.0; >= 40.0.0-alpha.1, < 40.7.0; >= 41.0.0-alpha.1, < 41.0.0-beta.8 |
| CVE-2026-34770 | 8.8 | Apr 3 | Electron: Use-after-free in PowerMonitor on Windows and macOS Affected: < 38.8.6; >= 39.0.0-alpha.1, < 39.8.1; >= 40.0.0-alpha.1, < 40.8.0; >= 41.0.0-alpha.1, < 41.0.0-beta.8 |
| CVE-2026-34769 | 8.8 | Apr 3 | Electron: Renderer command-line switch injection via undocumented commandLineSwitches webPreference Affected: < 38.8.6; >= 39.0.0-alpha.1, < 39.8.0; >= 40.0.0-alpha.1, < 40.7.0; >= 41.0.0-alpha.1, < 41.0.0-beta.8 |
| CVE-2026-34774 | 8.1 | Apr 3 | Electron: Use-after-free in offscreen child window paint callback Affected: < 39.8.1; >= 40.0.0-alpha.1, < 40.7.0; >= 41.0.0-alpha.1, < 41.0.0 |
| CVE-2017-12581 | 8.1 | Aug 6 | GitHub Electron before 1.6.8 allows remote command execution because of a nodeIntegration bypass vulnerability Affected: through 1.6.7 |
| CVE-2026-34779 | 7.8 | Apr 4 | Electron: AppleScript injection in app.moveToApplicationsFolder on macOS Affected: < 38.8.6; >= 39.0.0-alpha.1, < 39.8.1; >= 40.0.0-alpha.1, < 40.8.0; >= 41.0.0-alpha.1, < 41.0.0-beta.8 |
| CVE-2026-34768 | 7.8 | Apr 3 | Electron: Unquoted executable path in app.setLoginItemSettings on Windows Affected: < 38.8.6; >= 39.0.0-alpha.1, < 39.8.1; >= 40.0.0-alpha.1, < 40.8.0; >= 41.0.0-alpha.1, < 41.0.0-beta.8 |
| CVE-2026-70601 | 7.5 | Aug 5 | Electron: Context isolation bypass via Function.prototype.bind hijack Affected: < 39.8.9; >= 40.0.0-alpha.1, < 40.9.2; >= 41.0.0-alpha.1, < 41.2.2; >= 42.0.0-alpha.1, < 42.0.0-beta.5 |
| CVE-2026-34773 | 7.5 | Apr 3 | Electron: Registry key path injection in app.setAsDefaultProtocolClient on Windows Affected: < 38.8.6; >= 39.0.0-alpha.1, < 39.8.1; >= 40.0.0-alpha.1, < 40.8.1; >= 41.0.0-alpha.1, < 41.0.0 |
| CVE-2026-115570 New | 7.4 | Oct 23 | Electron: Mitigation for compromised eMudhra intermediate certificates Affected: >= 45.0.0-alpha.1, < 45.0.0-beta.6; >= 44.0.0-alpha.1, < 44.9.1; >= 43.0.0-alpha.1, < 43.8.1; < 42.11.16 |
| CVE-2026-102675 | 7.4 | Sep 29 | Electron: File and HTTP protocol handlers allow cross-origin reads without corsEnabled Affected: < 41.10.6; >= 42.0.0-alpha.1, < 42.9.2; >= 43.0.0-alpha.1, < 43.4.1; >= 44.0.0-alpha.1, < 44.0.0-beta.5 |
| CVE-2026-70604 | 7.4 | Aug 5 | Electron: Custom protocol with supportFetchAPI but not corsEnabled allows cross-origin reads Affected: < 39.8.10; >= 40.0.0-alpha.1, < 40.9.3; >= 41.0.0-alpha.1, < 41.4.0; >= 42.0.0-alpha.1, < 42.0.0 |
| CVE-2026-70608 | 7.2 | Aug 5 | Electron: Sandboxed iframe can bypass the allow-popups restriction via the OpenURL navigation path Affected: < 39.8.10; >= 40.0.0-alpha.1, < 41.10.3; >= 42.0.0-alpha.1, < 42.0.1 |
Showing 16