CVE-2026-34770— Electron: Use-after-free in PowerMonitor on Windows and macOS
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2026-34770
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Electron: Use-after-free in PowerMonitor on Windows and macOS
Source: NVD (National Vulnerability Database)
Vulnerability Description
Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to versions 38.8.6, 39.8.1, 40.8.0, and 41.0.0-beta.8, apps that use the powerMonitor module may be vulnerable to a use-after-free. After the native PowerMonitor object is garbage-collected, the associated OS-level resources (a message window on Windows, a shutdown handler on macOS) retain dangling references. A subsequent session-change event (Windows) or system shutdown (macOS) dereferences freed memory, which may lead to a crash or memory corruption. All apps that access powerMonitor events (suspend, resume, lock-screen, etc.) are potentially affected. The issue is not directly renderer-controllable. This issue has been patched in versions 38.8.6, 39.8.1, 40.8.0, and 41.0.0-beta.8.
Source: NVD (National Vulnerability Database)
CVSS Information
CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Source: NVD (National Vulnerability Database)
Vulnerability Type
释放后使用
Source: NVD (National Vulnerability Database)
Vulnerability Title
Electron 资源管理错误漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Electron是Electron开源的一个用户编写跨平台桌面应用的 JavaScript 框架。该框架基于 nodejs 和 Chromium 可以使用HTML，CSS实现跨平台桌面应用的编写。 Electron 38.8.6之前版本、39.8.1之前版本、40.8.0之前版本和41.0.0-beta.8之前版本存在资源管理错误漏洞，该漏洞源于使用powerMonitor模块时存在释放后重用问题，可能导致崩溃或内存损坏。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
II. Public POCs for CVE-2026-34770
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-34770
请登录查看更多情报信息。
Same Patch Batch · electron · 2026-04-03 · 13 CVEs total
| CVE-2026-34774 | 8.1 HIGH | Electron: Use-after-free in offscreen child window paint callback |
| CVE-2026-34769 | 7.8 HIGH | Electron: Renderer command-line switch injection via undocumented commandLineSwitches webP |
| CVE-2026-34771 | 7.5 HIGH | Electron: Use-after-free in WebContents fullscreen, pointer-lock, and keyboard-lock permis |
| CVE-2026-34775 | 6.8 MEDIUM | Electron: nodeIntegrationInWorker not correctly scoped in shared renderer processes |
| CVE-2026-34767 | 5.9 MEDIUM | Electron: HTTP Response Header Injection in custom protocol handlers and webRequest |
| CVE-2026-34778 | 5.9 MEDIUM | Electron: Service worker can spoof executeJavaScript IPC replies |
| CVE-2026-34772 | 5.8 MEDIUM | Electron: Use-after-free in download save dialog callback |
| CVE-2026-34777 | 5.4 MEDIUM | Electron: Incorrect origin passed to permission request handler for iframe requests |
| CVE-2026-34776 | 5.3 MEDIUM | Electron: Out-of-bounds read in second-instance IPC on macOS and Linux |
| CVE-2026-34773 | 4.7 MEDIUM | Electron: Registry key path injection in app.setAsDefaultProtocolClient on Windows |
| CVE-2026-34768 | 3.9 LOW | Electron: Unquoted executable path in app.setLoginItemSettings on Windows |
| CVE-2026-34766 | 3.3 LOW | Electron: USB device selection not validated against filtered device list |
IV. Related Vulnerabilities
Same product: electron
- CVE-2026-34781
Electron crashes in clipboard.readImage() on malformed clipb - CVE-2026-34765
Electron named window.open targets not scoped to the opener' - CVE-2026-34764
Electron has a use-after-free in offscreen shared texture re - CVE-2026-34780
Electron: Context Isolation bypass via contextBridge VideoFr - CVE-2026-34779
Electron: AppleScript injection in app.moveToApplicationsFol
Same vendor: electron
- CVE-2026-34781
Electron crashes in clipboard.readImage() on malformed clipb - CVE-2026-34765
Electron named window.open targets not scoped to the opener' - CVE-2026-34764
Electron has a use-after-free in offscreen shared texture re - CVE-2026-34780
Electron: Context Isolation bypass via contextBridge VideoFr - CVE-2026-34779
Electron: AppleScript injection in app.moveToApplicationsFol
V. Comments for CVE-2026-34770
No comments yet