VendorsElectronjselectron42.0.0
Vulnerabilities

Electronjs Electron 42.0.0

Ranked by severity, then by exploit likelihood, unless you sort otherwise. Click a CVE ID for its full record.

18CVEs
CVE-2026-34765
Electron named window.open targets not scoped to the opener's browsing context
Published 2026-04-07 · Analyzed
8.8EPSS 0.003
CVE-2026-102673
Electron drops inherited HTML sandbox restrictions for popups opened through OpenURLFromTab
Published 2026-09-29 · Analyzed
8.2EPSS 0.001
CVE-2026-70601
Electron: Context isolation bypass via Function.prototype.bind hijack
Published 2026-08-05 · Analyzed
7.5EPSS 0.003
CVE-2026-70604
Electron: Custom protocol with supportFetchAPI but not corsEnabled allows cross-origin reads
Published 2026-08-05 · Analyzed
7.4EPSS 0.004
CVE-2026-70611
Electron: DevTools embedder handler executes arbitrary files via shell open
Published 2026-08-05 · Analyzed
6.9EPSS 0.002
CVE-2026-70602
Electron: Extension tab APIs operate across session boundaries
Published 2026-08-05 · Analyzed
6.6EPSS 0.003
CVE-2026-70597
Electron: Parent process code-sign check is spoofable
Published 2026-08-05 · Analyzed
6.3EPSS 0.001
CVE-2026-70603
Electron: shell.openPath path validation bypass via embedded null byte
Published 2026-08-05 · Analyzed
6.0EPSS 0.001
CVE-2026-70605
Electron: HTTP redirect followed into local file loader
Published 2026-08-05 · Analyzed
5.9EPSS 0.003
CVE-2026-70599
Electron: Permission Check Handler Receives Main Frame Origin Instead of Requesting Iframe Origin
Published 2026-08-05 · Analyzed
5.9EPSS 0.002
CVE-2026-70609
Electron: DevTools JavaScript Injection via Unsanitized Dock State Parameter
Published 2026-08-05 · Analyzed
5.7EPSS 0.005
CVE-2026-34764
Electron has a use-after-free in offscreen shared texture release() callback
Published 2026-04-06 · Analyzed
5.5EPSS 0.001
CVE-2026-70610
Electron: contextBridge object copy honors prototype setters
Published 2026-08-05 · Analyzed
5.4EPSS 0.006
CVE-2026-70612
Electron: Sandboxed iframes can launch external protocol handlers
Published 2026-08-05 · Analyzed
5.4EPSS 0.004
CVE-2026-70607
Electron: window.open features string controls some window options considered privileged
Published 2026-08-05 · Analyzed
5.3EPSS 0.006
CVE-2026-70600
Electron: Cross-origin iframe can position native autofill popup
Published 2026-08-05 · Analyzed
4.3EPSS 0.002
CVE-2026-70598
Electron: Off-screen rendering trusts GPU-supplied geometry over shared-memory size
Published 2026-08-05 · Analyzed
3.9EPSS 0.001
CVE-2026-34781
Electron crashes in clipboard.readImage() on malformed clipboard image data
Published 2026-04-07 · Analyzed
3.3EPSS 0.002