What’s Vulnerable › Products
electron vulnerabilities
72 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 52 published in the last 12 months.
Check whether your electron version is affected
Latest electron vulnerabilities
- CVE-2026-115570 — Electron: Mitigation for compromised eMudhra intermediate certificates (CVSS 7.4)
- CVE-2026-114124 — Electron: Off-screen rendering on macOS trusts GPU-supplied frame geometry (CVSS 3.9)
- CVE-2026-114122 — Electron: Frame subscription trusts GPU-supplied frame geometry (CVSS 3.9)
- CVE-2026-114121 — Electron: openExternal permission requests can be attributed to the wrong origin (CVSS 5.4)
- CVE-2026-113800 — Electron: HID and USB permission checks can be attributed to the wrong origin (CVSS 5.4)
- CVE-2026-113798 — Electron: Pointer lock permission requests can be attributed to the wrong frame (CVSS 5.4)
- CVE-2026-113797 — Electron: Extension tabs.query returns tab URLs and titles without the tabs permission (CVSS 3.1)
- CVE-2026-113796 — Electron: SameSite cookie restrictions are not applied to windows opened from links (CVSS 4.2)
- CVE-2026-102672 — Electron: Local race condition in Squirrel.Mac update installation on macOS (CVSS 6.7)
- CVE-2026-102677 — Electron: Sandboxed preload code cache can be poisoned by a compromised renderer (CVSS 8.8)
- CVE-2026-102676 — Electron: <webview> can enable Node.js integration in Web Workers despite embedder restrictions (CVSS 9.8)
- CVE-2026-102675 — Electron: File and HTTP protocol handlers allow cross-origin reads without corsEnabled (CVSS 7.4)
- CVE-2026-102674 — Electron: Windows opened from a sandboxed top-level document do not inherit its sandbox restrictions (CVSS 6.1)
- CVE-2026-102673 — Electron drops inherited HTML sandbox restrictions for popups opened through OpenURLFromTab (CVSS 6.1)
- CVE-2026-70612 — Electron: Sandboxed iframes can launch external protocol handlers (CVSS 5.4)
- CVE-2026-70611 — Electron: DevTools embedder handler executes arbitrary files via shell open (CVSS 6.9)
- CVE-2026-70610 — Electron: contextBridge object copy honors prototype setters (CVSS 5.4)
- CVE-2026-70609 — Electron: DevTools JavaScript Injection via Unsanitized Dock State Parameter (CVSS 5.7)
- CVE-2026-70608 — Electron: Sandboxed iframe can bypass the allow-popups restriction via the OpenURL navigation path (CVSS 7.2)
- CVE-2026-70607 — Electron: window.open features string controls some window options considered privileged (CVSS 5.3)
- CVE-2026-70606 — Electron: ProtocolResponse.url reuses the default session cache instead of the registering session (CVSS 5.9)
- CVE-2026-70605 — Electron: HTTP redirect followed into local file loader (CVSS 5.9)
- CVE-2026-70604 — Electron: Custom protocol with supportFetchAPI but not corsEnabled allows cross-origin reads (CVSS 7.4)
- CVE-2026-70603 — Electron: shell.openPath path validation bypass via embedded null byte (CVSS 6.0)
- CVE-2026-70602 — Electron: Extension tab APIs operate across session boundaries (CVSS 6.6)