EL
Vendor
electron
55
CVEs
0
On KEV
14
New 30D
Products
EL9.8
electron
electron
50 CVEs0 on KEV14 new
EL7.8
Electron-builder
Electron
4 CVEs0 on KEV0 new
BU6.5
Builder-util-runtime
Electron
1 CVEs0 on KEV0 new
Recent CVEs
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-115570 New | EL electron electron | 7.4 | Oct 23 | Electron: Mitigation for compromised eMudhra intermediate certificates |
| CVE-2026-114124 New | EL electron electron | 3.9 | Oct 21 | Electron: Off-screen rendering on macOS trusts GPU-supplied frame geometry |
| CVE-2026-114122 New | EL electron electron | 3.9 | Oct 21 | Electron: Frame subscription trusts GPU-supplied frame geometry |
| CVE-2026-114121 New | EL electron electron | 5.4 | Oct 21 | Electron: openExternal permission requests can be attributed to the wrong origin |
| CVE-2026-113800 New | EL electron electron | 5.4 | Oct 21 | Electron: HID and USB permission checks can be attributed to the wrong origin |
| CVE-2026-113798 New | EL electron electron | 5.4 | Oct 21 | Electron: Pointer lock permission requests can be attributed to the wrong frame |
| CVE-2026-113797 New | EL electron electron | 3.1 | Oct 21 | Electron: Extension tabs.query returns tab URLs and titles without the tabs permission |
| CVE-2026-113796 New | EL electron electron | 4.2 | Oct 21 | Electron: SameSite cookie restrictions are not applied to windows opened from links |
| CVE-2026-102672 | EL electron electron | 6.7 | Oct 13 | Electron: Local race condition in Squirrel.Mac update installation on macOS |
| CVE-2026-102677 | EL electron electron | 8.8 | Sep 29 | Electron: Sandboxed preload code cache can be poisoned by a compromised renderer |
| CVE-2026-102676 | EL electron electron | 9.8 | Sep 29 | Electron: <webview> can enable Node.js integration in Web Workers despite embedder restrictions |
| CVE-2026-102675 | EL electron electron | 7.4 | Sep 29 | Electron: File and HTTP protocol handlers allow cross-origin reads without corsEnabled |
| CVE-2026-102674 | EL electron electron | 6.1 | Sep 29 | Electron: Windows opened from a sandboxed top-level document do not inherit its sandbox restrictions |
| CVE-2026-102673 | EL electron electron | 6.1 | Sep 29 | Electron drops inherited HTML sandbox restrictions for popups opened through OpenURLFromTab |
| CVE-2026-70612 | EL electron electron | 5.4 | Aug 5 | Electron: Sandboxed iframes can launch external protocol handlers |
| CVE-2026-70611 | EL electron electron | 6.9 | Aug 5 | Electron: DevTools embedder handler executes arbitrary files via shell open |
| CVE-2026-70610 | EL electron electron | 5.4 | Aug 5 | Electron: contextBridge object copy honors prototype setters |
| CVE-2026-70609 | EL electron electron | 5.7 | Aug 5 | Electron: DevTools JavaScript Injection via Unsanitized Dock State Parameter |
| CVE-2026-70608 | EL electron electron | 7.2 | Aug 5 | Electron: Sandboxed iframe can bypass the allow-popups restriction via the OpenURL navigation path |
| CVE-2026-70607 | EL electron electron | 5.3 | Aug 5 | Electron: window.open features string controls some window options considered privileged |
| CVE-2026-70606 | EL electron electron | 5.9 | Aug 5 | Electron: ProtocolResponse.url reuses the default session cache instead of the registering session |
| CVE-2026-70605 | EL electron electron | 5.9 | Aug 5 | Electron: HTTP redirect followed into local file loader |
| CVE-2026-70604 | EL electron electron | 7.4 | Aug 5 | Electron: Custom protocol with supportFetchAPI but not corsEnabled allows cross-origin reads |
| CVE-2026-70603 | EL electron electron | 6.0 | Aug 5 | Electron: shell.openPath path validation bypass via embedded null byte |
| CVE-2026-70602 | EL electron electron | 6.6 | Aug 5 | Electron: Extension tab APIs operate across session boundaries |
| CVE-2026-70601 | EL electron electron | 7.5 | Aug 5 | Electron: Context isolation bypass via Function.prototype.bind hijack |
| CVE-2026-70600 | EL electron electron | 4.3 | Aug 5 | Electron: Cross-origin iframe can position native autofill popup |
| CVE-2026-70599 | EL electron electron | 5.9 | Aug 5 | Electron: Permission Check Handler Receives Main Frame Origin Instead of Requesting Iframe Origin |
| CVE-2026-70598 | EL electron electron | 3.9 | Aug 5 | Electron: Off-screen rendering trusts GPU-supplied geometry over shared-memory size |
| CVE-2026-70597 | EL electron electron | 6.3 | Aug 5 | Electron: Parent process code-sign check is spoofable |
| CVE-2026-54672 | EL Electron-builder Electron | 7.8 | Jun 30 | electron-updater: Uncontrolled search path elements within `AppImage` built by `app-builder-lib` |
| CVE-2026-54673 | EL Electron-builder Electron | 6.5 | Jun 30 | electron-updater: Cross-origin redirect leaks `PRIVATE-TOKEN` and mixed-case `Authorization` credentials in `builder-util-runtime` |
| CVE-2026-54257 | EL electron electron | 9.3 | Jun 23 | Electron: Buffer performs incorrect byte length calculations resulting in heap buffer under/overflow |
| CVE-2026-34781 | EL electron electron | 3.3 | Apr 7 | Electron crashes in clipboard.readImage() on malformed clipboard image data |
| CVE-2026-34765 | EL electron electron | 8.8 | Apr 7 | Electron named window.open targets not scoped to the opener's browsing context |
| CVE-2026-34764 | EL electron electron | 5.5 | Apr 6 | Electron has a use-after-free in offscreen shared texture release() callback |
| CVE-2026-34780 | EL electron electron | 6.1 | Apr 4 | Electron: Context Isolation bypass via contextBridge VideoFrame transfer |
| CVE-2026-34779 | EL electron electron | 7.8 | Apr 4 | Electron: AppleScript injection in app.moveToApplicationsFolder on macOS |
| CVE-2026-34778 | EL electron electron | 6.5 | Apr 3 | Electron: Service worker can spoof executeJavaScript IPC replies |
| CVE-2026-34777 | EL electron electron | 5.4 | Apr 3 | Electron: Incorrect origin passed to permission request handler for iframe requests |
| CVE-2026-34776 | EL electron electron | 5.3 | Apr 3 | Electron: Out-of-bounds read in second-instance IPC on macOS and Linux |
| CVE-2026-34775 | EL electron electron | 9.8 | Apr 3 | Electron: nodeIntegrationInWorker not correctly scoped in shared renderer processes |
| CVE-2026-34774 | EL electron electron | 8.1 | Apr 3 | Electron: Use-after-free in offscreen child window paint callback |
| CVE-2026-34773 | EL electron electron | 7.5 | Apr 3 | Electron: Registry key path injection in app.setAsDefaultProtocolClient on Windows |
| CVE-2026-34772 | EL electron electron | 8.8 | Apr 3 | Electron: Use-after-free in download save dialog callback |
| CVE-2026-34771 | EL electron electron | 8.8 | Apr 3 | Electron: Use-after-free in WebContents fullscreen, pointer-lock, and keyboard-lock permission callbacks |
| CVE-2026-34770 | EL electron electron | 8.8 | Apr 3 | Electron: Use-after-free in PowerMonitor on Windows and macOS |
| CVE-2026-34768 | EL electron electron | 7.8 | Apr 3 | Electron: Unquoted executable path in app.setLoginItemSettings on Windows |
| CVE-2026-34767 | EL electron electron | 6.5 | Apr 3 | Electron: HTTP Response Header Injection in custom protocol handlers and webRequest |
| CVE-2026-34766 | EL electron electron | 5.4 | Apr 3 | Electron: USB device selection not validated against filtered device list |
| CVE-2026-34769 | EL electron electron | 8.8 | Apr 3 | Electron: Renderer command-line switch injection via undocumented commandLineSwitches webPreference |
| CVE-2024-39698 | EL Electron-builder Electron | 7.5 | Jul 9 | electron-updater allows for automatic updates for Electron apps |
| CVE-2024-27303 | EL Electron-builder Electron | 7.3 | Mar 6 | electron-builder is a solution to package and build a ready for distribution Electron, Proton Native app for macOS, Windows and Linux |
| CVE-2017-12581 | EL Electron Electron | 8.1 | Aug 6 | GitHub Electron before 1.6.8 allows remote command execution because of a nodeIntegration bypass vulnerability |