Login Request a demo
EL
Product
electron
by electron · last CVE Oct 23, 2026
50
CVEs
0
On KEV
9.8
Max CVSS
14
New 30D
Vulnerabilities50In the news0Timeline
Severity mix
Critical 3High 16Medium 26Low 5
Severity
All severities50Critical3High16Medium26Low5
Exploitation
On CISA KEV0Exploited in the wild0
Watch

Add electron to your stack to get only the CVEs that touch what you run.

CVECVSSEPSSPublishedSummary · affected versions
CVE-2026-70611
6.9
0%
Aug 5
Electron: DevTools embedder handler executes arbitrary files via shell open
Affected: < 39.8.9; >= 40.0.0-alpha.1, < 40.9.2; >= 41.0.0-alpha.1, < 41.2.1; >= 42.0.0-alpha.1, < 42.0.0-beta.3
CVE-2026-102672
6.7
0%
Oct 13
Electron: Local race condition in Squirrel.Mac update installation on macOS
Affected: < 39.8.10; >= 40.0.0-alpha.1, < 41.10.5; >= 42.0.0-alpha.1, < 42.0.0-beta.2
CVE-2026-70602
6.6
0%
Aug 5
Electron: Extension tab APIs operate across session boundaries
Affected: < 39.8.8; >= 40.0.0-alpha.1, < 40.9.0; >= 41.0.0-alpha.1, < 41.2.1; >= 42.0.0-alpha.1, < 42.0.0-beta.3
CVE-2026-34778
6.5
0%
Apr 3
Electron: Service worker can spoof executeJavaScript IPC replies
Affected: < 38.8.6; >= 39.0.0-alpha.1, < 39.8.1; >= 40.0.0-alpha.1, < 40.8.1; >= 41.0.0-alpha.1, < 41.0.0
CVE-2026-34767
6.5
0%
Apr 3
Electron: HTTP Response Header Injection in custom protocol handlers and webRequest
Affected: < 38.8.6; >= 39.0.0-alpha.1, < 39.8.3; >= 40.0.0-alpha.1, < 40.8.3; >= 41.0.0-alpha.1, < 41.0.3
CVE-2026-70597
6.3
0%
Aug 5
Electron: Parent process code-sign check is spoofable
Affected: < 39.8.8; >= 40.0.0-alpha.1, < 40.9.0; >= 41.0.0-alpha.1, < 41.2.1; >= 42.0.0-alpha.1, < 42.0.0-beta.3
CVE-2026-102674
6.1
0%
Sep 29
Electron: Windows opened from a sandboxed top-level document do not inherit its sandbox restrictions
Affected: < 41.10.6; >= 42.0.0-alpha.1, < 42.9.2; >= 43.0.0-alpha.1, < 43.4.1; >= 44.0.0-alpha.1, < 44.0.0-beta.5
CVE-2026-102673
6.1
0%
Sep 29
Electron drops inherited HTML sandbox restrictions for popups opened through OpenURLFromTab
Affected: < 41.10.4; >= 42.0.0-alpha.1, < 42.5.2; >= 43.0.0-alpha.1, < 43.0.0
CVE-2026-34780
6.1
0%
Apr 4
Electron: Context Isolation bypass via contextBridge VideoFrame transfer
Affected: >= 39.0.0-alpha.1, < 39.8.0; >= 40.0.0-alpha.1, < 40.7.0; >= 41.0.0-alpha.1, < 41.0.0-beta.8
CVE-2026-70603
6.0
0%
Aug 5
Electron: shell.openPath path validation bypass via embedded null byte
Affected: < 39.8.6; >= 40.0.0-alpha.1, < 40.9.0; >= 41.0.0-alpha.1, < 41.1.1; >= 42.0.0-alpha.1, < 42.0.0-beta.1
CVE-2026-70606
5.9
0%
Aug 5
Electron: ProtocolResponse.url reuses the default session cache instead of the registering session
Affected: >= 40.0.0-alpha.1, < 40.10.6; >= 41.0.0-alpha.1, < 41.9.1; >= 42.0.0-alpha.1, < 42.5.1; >= 43.0.0-alpha.1, < 43.0.0
CVE-2026-70605
5.9
0%
Aug 5
Electron: HTTP redirect followed into local file loader
Affected: < 39.8.8; >= 40.0.0-alpha.1, < 40.9.0; >= 41.0.0-alpha.1, < 41.2.1; >= 42.0.0-alpha.1, < 42.0.0-beta.3
CVE-2026-70599
5.9
0%
Aug 5
Electron: Permission Check Handler Receives Main Frame Origin Instead of Requesting Iframe Origin
Affected: < 39.8.7; >= 40.0.0-alpha.1, < 40.9.0; >= 41.0.0-alpha.1, < 41.2.0; >= 42.0.0-alpha.1, < 42.0.0-beta.1
CVE-2026-70609
5.7
1%
Aug 5
Electron: DevTools JavaScript Injection via Unsanitized Dock State Parameter
Affected: < 39.8.7; >= 40.0.0-alpha.1, < 40.9.0; >= 41.0.0-alpha.1, < 41.2.0; >= 42.0.0-alpha.1, < 42.0.0-beta.1
CVE-2026-34764
5.5
0%
Apr 6
Electron has a use-after-free in offscreen shared texture release() callback
Affected: >= 33.0.0-alpha.1, < 39.8.5; >= 40.0.0-alpha.1, < 40.8.5; >= 41.0.0-alpha.1, < 41.1.0; >= 42.0.0-alpha.1, < 42.0.0-alpha.5
CVE-2026-114121
New
5.4
0%
Oct 21
Electron: openExternal permission requests can be attributed to the wrong origin
Affected: < 42.11.3; >= 43.0.0-alpha.1, < 43.7.0; >= 44.0.0-alpha.1, < 44.3.0; >= 45.0.0-alpha.1, < 45.0.0-alpha.5
CVE-2026-113800
New
5.4
0%
Oct 21
Electron: HID and USB permission checks can be attributed to the wrong origin
Affected: < 42.11.3; >= 43.0.0-alpha.1, < 43.7.0; >= 44.0.0-alpha.1, < 44.3.0; >= 45.0.0-alpha.1, < 45.0.0-alpha.5
CVE-2026-113798
New
5.4
0%
Oct 21
Electron: Pointer lock permission requests can be attributed to the wrong frame
Affected: < 42.11.9; >= 43.0.0-alpha.1, < 43.7.6; >= 44.0.0-alpha.1, < 44.5.0; >= 45.0.0-alpha.1, < 45.0.0-alpha.13
CVE-2026-70612
5.4
0%
Aug 5
Electron: Sandboxed iframes can launch external protocol handlers
Affected: < 39.8.8; >= 40.0.0-alpha.1, < 40.9.0; >= 41.0.0-alpha.1, < 41.2.1; >= 42.0.0-alpha.1, < 42.0.0-beta.3
CVE-2026-70610
5.4
1%
Aug 5
Electron: contextBridge object copy honors prototype setters
Affected: < 39.8.9; >= 40.0.0-alpha.1, < 40.9.2; >= 41.0.0-alpha.1, < 41.2.2; >= 42.0.0-alpha.1, < 42.0.0-beta.4
CVE-2026-34777
5.4
0%
Apr 3
Electron: Incorrect origin passed to permission request handler for iframe requests
Affected: < 38.8.6; >= 39.0.0-alpha.1, < 39.8.1; >= 40.0.0-alpha.1, < 40.8.1; >= 41.0.0-alpha.1, < 41.0.0
CVE-2026-34766
5.4
0%
Apr 3
Electron: USB device selection not validated against filtered device list
Affected: < 38.8.6; >= 39.0.0-alpha.1, < 39.8.0; >= 40.0.0-alpha.1, < 40.7.0; >= 41.0.0-alpha.1, < 41.0.0-beta.8
CVE-2026-70607
5.3
1%
Aug 5
Electron: window.open features string controls some window options considered privileged
Affected: < 39.8.8; >= 40.0.0-alpha.1, < 40.9.0; >= 41.0.0-alpha.1, < 41.2.1; >= 42.0.0-alpha.1, < 42.0.0-beta.3
CVE-2026-34776
5.3
0%
Apr 3
Electron: Out-of-bounds read in second-instance IPC on macOS and Linux
Affected: < 38.8.6; >= 39.0.0-alpha.1, < 39.8.1; >= 40.0.0-alpha.1, < 40.8.1; >= 41.0.0-alpha.1, < 41.0.0
CVE-2026-70600
4.3
0%
Aug 5
Electron: Cross-origin iframe can position native autofill popup
Affected: < 39.8.8; >= 40.0.0-alpha.1, < 40.9.0; >= 41.0.0-alpha.1, < 41.2.1; >= 42.0.0-alpha.1, < 42.0.0-beta.3
CVE-2026-113796
New
4.2
0%
Oct 21
Electron: SameSite cookie restrictions are not applied to windows opened from links
Affected: < 42.11.3; >= 43.0.0-alpha.1, < 43.7.0; >= 44.0.0-alpha.1, < 44.3.0; >= 45.0.0-alpha.1, < 45.0.0-alpha.6
Showing 26