EL
Product
Electron
59
CVEs
0
On KEV
9.9
Max CVSS
0
New 30D
Severity mix
Critical 7High 23Medium 27Low 2
Watch
Add Electron to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-102677 | 8.8 | Sep 29 | Electron: Sandboxed preload code cache can be poisoned by a compromised renderer Affected: 42.3.3 through 42.10.0; 43.0.0 before 43.4.2; 44.0.0; 44.0.0; 44.0.0; 44.0.0; +10 more |
| CVE-2026-34765 | 8.8 | Apr 7 | Electron named window.open targets not scoped to the opener's browsing context Affected: through 39.8.4; 40.0.0 through 40.8.4; 41.0.0 before 41.1.0; 41.2.0; 42.0.0; 42.0.0; +2 more |
| CVE-2026-34772 | 8.8 | Apr 3 | Electron: Use-after-free in download save dialog callback Affected: before 38.8.6; 39.0.0 before 39.8.0; 40.0.0 before 40.7.0; 41.0.0; 41.0.0; 41.0.0; +10 more |
| CVE-2026-34771 | 8.8 | Apr 3 | Electron: Use-after-free in WebContents fullscreen, pointer-lock, and keyboard-lock permission callbacks Affected: before 38.8.6; 39.0.0 before 39.8.0; 40.0.0 before 40.7.0; 41.0.0; 41.0.0; 41.0.0; +10 more |
| CVE-2026-34770 | 8.8 | Apr 3 | Electron: Use-after-free in PowerMonitor on Windows and macOS Affected: before 38.8.6; 39.0.0 before 39.8.1; 40.0.0 before 40.8.0; 41.0.0; 41.0.0; 41.0.0; +10 more |
| CVE-2026-34769 | 8.8 | Apr 3 | Electron: Renderer command-line switch injection via undocumented commandLineSwitches webPreference Affected: before 38.8.6; 39.0.0 before 39.8.0; 40.0.0 before 40.7.0; 41.0.0; 41.0.0; 41.0.0; +10 more |
| CVE-2018-1000118 | 8.8 | Mar 7 | Github Electron version Electron 1.8.2-beta.4 and earlier contains a Command Injection vulnerability in Protocol Handler that can result in command execute Affected: through 1.8.1; 1.8.2; 1.8.2; 1.8.2; 1.8.2 |
| CVE-2021-39184 | 8.6 | Oct 12 | Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS Affected: 10.1.0 before 11.5.0; 12.0.0 before 12.1.0; 13.0.0 before 13.3.0; 14.0.0; 14.0.0; 14.0.0; +31 more |
| CVE-2023-29198 | 8.5 | Sep 6 | Context isolation bypass via nested unserializable return value in Electron Affected: before 22.3.6; 23.0.0 before 23.2.3; 24.0.0; 24.0.0; 24.0.0; 24.0.0; +12 more |
| CVE-2026-34774 | 8.1 | Apr 3 | Electron: Use-after-free in offscreen child window paint callback Affected: before 39.8.1; 40.0.0 before 40.7.0; 41.0.0; 41.0.0; 41.0.0; 41.0.0; +10 more |
| CVE-2018-15685 | 8.1 | Aug 23 | GitHub Electron 1.7.15, 1.8.7, 2.0.7, and 3.0.0-beta.6, in certain scenarios involving IFRAME elements and "nativeWindowOpen: true" or "sandbox: true" options, is affected by a… Affected: 1.7.15; 1.8.7; 2.0.7; 3.0.0 |
| CVE-2018-1000136 | 8.1 | Mar 23 | Electron version 1.7 up to 1.7.12; 1.8 up to 1.8.3 and 2.0.0 up to 2.0.0-beta.3 contains an improper handling of values vulnerability in Webviews that can result in remote code… Affected: 1.7.0 through 1.7.12; after 1.8.0 through 1.8.3; 2.0.0; 2.0.0; 2.0.0; 2.0.0; +1 more |
| CVE-2026-34779 | 7.8 | Apr 4 | Electron: AppleScript injection in app.moveToApplicationsFolder on macOS Affected: before 38.8.6; 39.0.0 before 39.8.1; 40.0.0 before 40.8.0; 41.0.0; 41.0.0; 41.0.0; +10 more |
| CVE-2026-34768 | 7.8 | Apr 3 | Electron: Unquoted executable path in app.setLoginItemSettings on Windows Affected: before 38.8.6; 39.0.0 before 39.8.1; 40.0.0 before 40.8.0; 41.0.0; 41.0.0; 41.0.0; +10 more |
| CVE-2026-70601 | 7.5 | Aug 5 | Electron: Context isolation bypass via Function.prototype.bind hijack Affected: before 39.8.9; 40.0.0 before 40.9.2; 41.0.0 before 41.2.2; 42.0.0; 42.0.0; 42.0.0; +7 more |
| CVE-2026-34773 | 7.5 | Apr 3 | Electron: Registry key path injection in app.setAsDefaultProtocolClient on Windows Affected: before 38.8.6; 39.0.0 before 39.8.1; 40.0.0 before 40.8.1; 41.0.0; 41.0.0; 41.0.0; +11 more |
| CVE-2020-15174 | 7.5 | Oct 6 | In Electron before versions 11.0.0-beta.1, 10.0.1, 9.3.0 or 8.5.1 the `will-navigate` event that apps use to prevent navigations to unexpected destinations as per our security… Affected: 8.0.0 before 8.5.1; 9.0.0 before 9.3.0; 10.0.0 before 10.0.1 |
| CVE-2020-4075 | 7.5 | Jul 7 | In Electron before versions 7.2.4, 8.2.4, and 9.0.0-beta21, arbitrary local file read is possible by defining unsafe window options on a child window opened via window.open Affected: 7.0.0 before 7.2.4; 8.0.0 before 8.2.4; 9.0.0; 9.0.0; 9.0.0; 9.0.0; +17 more |
| CVE-2026-102675 | 7.4 | Sep 29 | Electron: File and HTTP protocol handlers allow cross-origin reads without corsEnabled Affected: before 41.10.6; 42.0.0 before 42.9.2; 43.0.0 before 43.4.1; 44.0.0; 44.0.0; 44.0.0; +10 more |
| CVE-2026-70604 | 7.4 | Aug 5 | Electron: Custom protocol with supportFetchAPI but not corsEnabled allows cross-origin reads Affected: before 39.8.10; 40.0.0 before 40.9.3; 41.0.0 before 41.4.0; 42.0.0; 42.0.0; 42.0.0; +11 more |
| CVE-2026-70608 | 7.2 | Aug 5 | Electron: Sandboxed iframe can bypass the allow-popups restriction via the OpenURL navigation path Affected: before 39.8.8; 40.0.0 before 41.10.3; 42.0.0 before 42.0.1 |
| CVE-2022-29257 | 7.2 | Jun 13 | Electron is a framework for writing cross-platform desktop applications using JavaScript (JS), HTML, and CSS Affected: before 15.5.0; 16.0.1 before 16.2.0; 17.0.1 before 17.2.0; 16.0.0; 16.0.0; 16.0.0; +20 more |
| CVE-2023-44402 | 7.0 | Dec 1 | ASAR Integrity bypass via filetype confusion in electron Affected: through 22.3.24; 23.0.0 through 23.3.14; 24.0.0 through 24.8.3; 25.0.0 through 25.8.1; 26.0.0 through 26.2.1; 27.0.0; +5 more |
Showing 23