What’s Vulnerable › Vulnerabilities
CVE-2026-102677: Electron: Sandboxed preload code cache can be poisoned by a compromised renderer
- Severity: high (CVSS 8.8 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.1% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2026-09-29 · updated 2026-10-08
- Weakness: CWE-20
Description
Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. From 42.3.3 until 42.10.0, 43.5.0, and 44.0.0-beta.6, Electron's sandboxed preload code cache did not verify that a cached entry matched the preload it was served for. A compromised renderer could write attacker-controlled cache data and cause Electron to reuse it for a later load, executing the renderer's code in the more privileged preload context. The issue affects applications that load untrusted content. This issue is fixed in versions 42.10.0, 43.5.0, and 44.0.0-beta.6.
Affected products
- electron: from 42.3.3 through 42.10.0; from 43.0.0 before 43.4.2; 44.0.0-alpha1, 44.0.0-alpha2, 44.0.0-alpha3, 44.0.0-alpha4, 44.0.0-alpha5, 44.0.0-alpha6 (+8) — fixed in 43.4.2
How to fix
Upgrade to a fixed version: electron 43.4.2. Check the vendor advisory for mitigations.
References
- https://github.com/electron/electron/commit/000453e399bd1dee5e86376cdd9ece5fc071e601
- https://github.com/electron/electron/commit/25ba8be57c65a83d8c14ebb8aa37693df17a04f3
- https://github.com/electron/electron/commit/c38d6fd68756f04647ea857bdb6a2abec332e217
- https://github.com/electron/electron/pull/52480
- https://github.com/electron/electron/releases/tag/v42.10.0
- https://github.com/electron/electron/releases/tag/v43.5.0
- https://github.com/electron/electron/releases/tag/v44.0.0-beta.6
- https://github.com/electron/electron/security/advisories/GHSA-qmv3-fv6v-rmhq
Get alerted when CVE-2026-102677 or the next vulnerability affects your stack