EL
Product
Electron
59
CVEs
0
On KEV
9.9
Max CVSS
0
New 30D
Severity mix
Critical 7High 23Medium 27Low 2
Watch
Add Electron to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-70611 | 6.9 | Aug 5 | Electron: DevTools embedder handler executes arbitrary files via shell open Affected: before 39.8.9; 40.0.0 before 40.9.2; 41.0.0 before 41.2.1; 42.0.0; 42.0.0; 42.0.0; +5 more |
| CVE-2020-15096 | 6.8 | Jul 7 | In Electron before versions 6.1.1, 7.2.4, 8.2.4, and 9.0.0-beta21, there is a context isolation bypass, meaning that code running in the main world context in the renderer can… Affected: before 6.1.1; 7.0.0 before 7.2.4; 8.0.0 before 8.2.4; 9.0.0; 9.0.0; 9.0.0; +18 more |
| CVE-2026-70602 | 6.6 | Aug 5 | Electron: Extension tab APIs operate across session boundaries Affected: before 39.8.8; 40.0.0 before 40.9.0; 41.0.0 before 41.2.1; 42.0.0; 42.0.0; 42.0.0; +5 more |
| CVE-2023-39956 | 6.6 | Sep 6 | Electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS Affected: before 22.3.9; 23.0.0 before 23.3.13; 24.0.0 before 24.7.1; 25.0.0 before 25.5.0; 26.0.0; 26.0.0; +18 more |
| CVE-2026-34778 | 6.5 | Apr 3 | Electron: Service worker can spoof executeJavaScript IPC replies Affected: before 38.8.6; 39.0.0 before 39.8.1; 40.0.0 before 40.8.1; 41.0.0; 41.0.0; 41.0.0; +11 more |
| CVE-2026-34767 | 6.5 | Apr 3 | Electron: HTTP Response Header Injection in custom protocol handlers and webRequest Affected: before 38.8.6; 39.0.0 before 39.8.3; 40.0.0 before 40.8.3; 41.0.0 before 41.0.3 |
| CVE-2020-26272 | 6.5 | Jan 28 | The Electron framework lets users write cross-platform desktop applications using JavaScript, HTML and CSS Affected: 9.0.0 before 9.4.0; 10.0.0 before 10.2.0; 11.0.0 before 11.1.0; 9.0.0; 9.0.0; 9.0.0; +34 more |
| CVE-2026-70597 | 6.3 | Aug 5 | Electron: Parent process code-sign check is spoofable Affected: before 39.8.8; 40.0.0 before 40.9.0; 41.0.0 through 41.2.1; 42.0.0; 42.0.0; 42.0.0; +5 more |
| CVE-2026-102674 | 6.1 | Sep 29 | Electron: Windows opened from a sandboxed top-level document do not inherit its sandbox restrictions Affected: before 41.10.6; 42.0.0 before 42.9.2; 43.0.0 before 43.4.1; 44.0.0; 44.0.0; 44.0.0; +10 more |
| CVE-2026-102673 | 6.1 | Sep 29 | Electron drops inherited HTML sandbox restrictions for popups opened through OpenURLFromTab Affected: before 39.8.8; 40.0.0 before 40.9.0; 41.0.0 through 41.2.1; 42.0.0; 42.0.0; 42.0.0; +5 more |
| CVE-2026-34780 | 6.1 | Apr 4 | Electron: Context Isolation bypass via contextBridge VideoFrame transfer Affected: 39.0.0 before 39.8.0; 40.0.0 before 40.7.0; 41.0.0; 41.0.0; 41.0.0; 41.0.0; +9 more |
| CVE-2022-36077 | 6.1 | Nov 8 | The Electron framework enables writing cross-platform desktop applications using JavaScript, HTML and CSS Affected: before 18.3.7; 19.0.0 before 19.0.11; 20.0.0 before 20.0.1; 21.0.0; 21.0.0; 21.0.0; +4 more |
| CVE-2026-70603 | 6.0 | Aug 5 | Electron: shell.openPath path validation bypass via embedded null byte Affected: before 39.8.6; 40.0.0 before 40.9.0; 41.0.0 before 41.1.1; 42.0.0; 42.0.0; 42.0.0; +4 more |
| CVE-2026-70606 | 5.9 | Aug 5 | Electron: ProtocolResponse.url reuses the default session cache instead of the registering session Affected: before 40.10.6; 41.0.0 through 41.9.1; 42.0.0 through 42.5.1; 43.0.0; 43.0.0; 43.0.0; +2 more |
| CVE-2026-70605 | 5.9 | Aug 5 | Electron: HTTP redirect followed into local file loader Affected: before 39.8.8; 40.0.0 before 40.9.0; 41.0.0 before 41.2.1; 42.0.0; 42.0.0; 42.0.0; +5 more |
| CVE-2026-70599 | 5.9 | Aug 5 | Electron: Permission Check Handler Receives Main Frame Origin Instead of Requesting Iframe Origin Affected: before 39.8.7; 40.0.0 before 40.9.0; 41.0.0 before 41.2.1; 42.0.0; 42.0.0; 42.0.0; +5 more |
| CVE-2026-70609 | 5.7 | Aug 5 | Electron: DevTools JavaScript Injection via Unsanitized Dock State Parameter Affected: before 39.8.7; 40.0.0 before 40.9.0; 41.0.0 before 41.2.0; 42.0.0; 42.0.0; 42.0.0; +4 more |
| CVE-2020-15215 | 5.6 | Oct 6 | Electron before versions 11.0.0-beta.6, 10.1.2, 9.3.1 or 8.5.2 is vulnerable to a context isolation bypass Affected: 8.0.0; 8.0.0; 8.0.0; 8.0.0; 8.0.0; 8.0.0; +34 more |
| CVE-2026-34764 | 5.5 | Apr 6 | Electron has a use-after-free in offscreen shared texture release() callback Affected: 33.0.0 before 39.8.5; 40.0.0 before 40.8.5; 41.0.0 before 41.1.0; 42.0.0; 42.0.0; 42.0.0; +1 more |
| CVE-2026-70612 | 5.4 | Aug 5 | Electron: Sandboxed iframes can launch external protocol handlers Affected: before 39.8.8; 40.0.0 before 40.9.0; 41.0.0 through 41.2.1; 42.0.0; 42.0.0; 42.0.0; +5 more |
| CVE-2026-70610 | 5.4 | Aug 5 | Electron: contextBridge object copy honors prototype setters Affected: before 39.8.9; 40.0.0 before 40.9.2; 41.0.0 before 41.2.2; 42.0.0; 42.0.0; 42.0.0; +6 more |
| CVE-2026-34777 | 5.4 | Apr 3 | Electron: Incorrect origin passed to permission request handler for iframe requests Affected: before 38.8.6; 39.0.0 before 39.8.1; 40.0.0 before 40.8.1; 41.0.0; 41.0.0; 41.0.0; +11 more |
| CVE-2026-34766 | 5.4 | Apr 3 | Electron: USB device selection not validated against filtered device list Affected: before 38.8.6; 39.0.0 before 39.8.0; 40.0.0 before 40.7.0; 41.0.0; 41.0.0; 41.0.0; +10 more |
| CVE-2026-70607 | 5.3 | Aug 5 | Electron: window.open features string controls some window options considered privileged Affected: before 39.8.8; 40.0.0 before 40.9.0; 41.0.0 through 41.2.1; 42.0.0; 42.0.0; 42.0.0; +5 more |
| CVE-2026-34776 | 5.3 | Apr 3 | Electron: Out-of-bounds read in second-instance IPC on macOS and Linux Affected: before 38.8.6; 39.0.0 before 39.8.1; 40.0.0 before 40.8.1; 41.0.0; 41.0.0; 41.0.0; +11 more |
| CVE-2022-21718 | 5.0 | Mar 22 | Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS Affected: before 13.6.6; 14.0.0 before 14.2.4; 15.0.0 before 15.3.5; 16.0.0 before 16.0.6; 17.0.0; 17.0.0; +3 more |
| CVE-2026-70600 | 4.3 | Aug 5 | Electron: Cross-origin iframe can position native autofill popup Affected: before 39.8.8; 40.0.0 before 40.9.0; 41.0.0 through 41.2.1; 42.0.0; 42.0.0; 42.0.0; +5 more |
Showing 27