VendorsElectronjselectronany version
Vulnerabilities

Electronjs Electron any version

Ranked by severity, then by exploit likelihood, unless you sort otherwise. Click a CVE ID for its full record.

56CVEs
CVE-2026-70603
Electron: shell.openPath path validation bypass via embedded null byte
Published 2026-08-05 · Analyzed
6.0EPSS 0.001
CVE-2026-70605
Electron: HTTP redirect followed into local file loader
Published 2026-08-05 · Analyzed
5.9EPSS 0.003
CVE-2026-70606
Electron: ProtocolResponse.url reuses the default session cache instead of the registering session
Published 2026-08-05 · Analyzed
5.9EPSS 0.003
CVE-2026-70599
Electron: Permission Check Handler Receives Main Frame Origin Instead of Requesting Iframe Origin
Published 2026-08-05 · Analyzed
5.9EPSS 0.002
CVE-2026-70609
Electron: DevTools JavaScript Injection via Unsanitized Dock State Parameter
Published 2026-08-05 · Analyzed
5.7EPSS 0.005
CVE-2026-34764
Electron has a use-after-free in offscreen shared texture release() callback
Published 2026-04-06 · Analyzed
5.5EPSS 0.001
CVE-2026-70610
Electron: contextBridge object copy honors prototype setters
Published 2026-08-05 · Analyzed
5.4EPSS 0.006
CVE-2026-70612
Electron: Sandboxed iframes can launch external protocol handlers
Published 2026-08-05 · Analyzed
5.4EPSS 0.004
CVE-2026-34766
Electron: USB device selection not validated against filtered device list
Published 2026-04-03 · Analyzed
5.4EPSS 0.002
CVE-2026-34777
Electron: Incorrect origin passed to permission request handler for iframe requests
Published 2026-04-03 · Analyzed
5.4EPSS 0.001
CVE-2026-70607
Electron: window.open features string controls some window options considered privileged
Published 2026-08-05 · Analyzed
5.3EPSS 0.006
CVE-2026-34776
Electron: Out-of-bounds read in second-instance IPC on macOS and Linux
Published 2026-04-03 · Analyzed
5.3EPSS 0.002
CVE-2022-21718
Renderers can obtain access to random bluetooth device without permission in Electron
Published 2022-03-22 · Modified
5.0EPSS 0.009
CVE-2026-70600
Electron: Cross-origin iframe can position native autofill popup
Published 2026-08-05 · Analyzed
4.3EPSS 0.002
CVE-2026-70598
Electron: Off-screen rendering trusts GPU-supplied geometry over shared-memory size
Published 2026-08-05 · Analyzed
3.9EPSS 0.001
CVE-2026-34781
Electron crashes in clipboard.readImage() on malformed clipboard image data
Published 2026-04-07 · Analyzed
3.3EPSS 0.002
← Prev2 / 2