Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%
Buy Us a Coffee

electron — Vulnerabilities & Security Advisories 55

Browse all 55 CVE security advisories affecting electron. AI-powered Chinese analysis, POCs, and references for each vulnerability.

Electron is an open-source framework enabling developers to build cross-platform desktop applications using web technologies like HTML, CSS, and JavaScript. By embedding the Chromium engine and Node.js runtime, it allows web code to interact directly with the operating system, creating a significant attack surface. Historically, vulnerabilities within this architecture frequently lead to Remote Code Execution (RCE) and Cross-Site Scripting (XSS), often stemming from improper handling of IPC channels or insecure default configurations. With 38 recorded CVEs, the framework has faced scrutiny regarding privilege escalation risks when applications fail to properly sandbox web content. While not inherently malicious, the complexity of integrating web and native APIs has resulted in notable security incidents where attackers exploited these interfaces to gain unauthorized system access. Developers must rigorously enforce security policies to mitigate these inherent risks associated with the hybrid nature of Electron-based software.

Found 54 results / 55Clear Filters
Top products by electron: electron packager
CVE IDTitleCVSSSeverityPublished
CVE-2026-70612 Electron: Sandboxed iframes can launch external protocol handlers — electronCWE-284 5.4 Medium2026-08-05
CVE-2026-70611 Electron: DevTools embedder handler executes arbitrary files via shell open — electronCWE-78 6.9 Medium2026-08-05
CVE-2026-70610 Electron: contextBridge object copy honors prototype setters — electronCWE-1321 5.4 Medium2026-08-05
CVE-2026-70609 Electron: DevTools JavaScript Injection via Unsanitized Dock State Parameter — electronCWE-94 5.7 Medium2026-08-05
CVE-2026-70608 Electron: Sandboxed iframe can bypass the allow-popups restriction via the OpenURL navigation path — electronCWE-693 7.2 High2026-08-05
CVE-2026-70607 Electron: window.open features string controls some window options considered privileged — electronCWE-20 5.3 Medium2026-08-05
CVE-2026-70606 Electron: ProtocolResponse.url reuses the default session cache instead of the registering session — electronCWE-668 5.9 Medium2026-08-05
CVE-2026-70605 Electron: HTTP redirect followed into local file loader — electronCWE-918 5.9 Medium2026-08-05
CVE-2026-70604 Electron: Custom protocol with supportFetchAPI but not corsEnabled allows cross-origin reads — electronCWE-942 7.4 High2026-08-05
CVE-2026-70603 Electron: shell.openPath path validation bypass via embedded null byte — electronCWE-20 6.0 Medium2026-08-05
CVE-2026-70602 Electron: Extension tab APIs operate across session boundaries — electronCWE-284 6.6 Medium2026-08-05
CVE-2026-70601 Electron: Context isolation bypass via Function.prototype.bind hijack — electronCWE-693 7.5 High2026-08-05
CVE-2026-70600 Electron: Cross-origin iframe can position native autofill popup — electronCWE-1021 3.1 Low2026-08-05
CVE-2026-70599 Electron: Permission Check Handler Receives Main Frame Origin Instead of Requesting Iframe Origin — electronCWE-346 5.9 Medium2026-08-05
CVE-2026-70598 Electron: Off-screen rendering trusts GPU-supplied geometry over shared-memory size — electronCWE-125 3.9 Low2026-08-05
CVE-2026-70597 Electron: Parent process code-sign check is spoofable — electronCWE-367 6.3 Medium2026-08-05
CVE-2026-54257 Electron: Buffer performs incorrect byte length calculations resulting in heap buffer under/overflow — electronCWE-120--2026-06-23
CVE-2026-34781 Electron crashes in clipboard.readImage() on malformed clipboard image data — electronCWE-476 2.8 Low2026-04-07
CVE-2026-34765 Electron named window.open targets not scoped to the opener's browsing context — electronCWE-668 6.0 Medium2026-04-07
CVE-2026-34764 Electron has a use-after-free in offscreen shared texture release() callback — electronCWE-416 2.3 Low2026-04-06
CVE-2026-34780 Electron: Context Isolation bypass via contextBridge VideoFrame transfer — electronCWE-668 8.4 High2026-04-04
CVE-2026-34779 Electron: AppleScript injection in app.moveToApplicationsFolder on macOS — electronCWE-78 6.5 Medium2026-04-04
CVE-2026-34778 Electron: Service worker can spoof executeJavaScript IPC replies — electronCWE-290 5.9 Medium2026-04-03
CVE-2026-34777 Electron: Incorrect origin passed to permission request handler for iframe requests — electronCWE-346 5.4 Medium2026-04-03
CVE-2026-34776 Electron: Out-of-bounds read in second-instance IPC on macOS and Linux — electronCWE-125 5.3 Medium2026-04-03
CVE-2026-34775 Electron: nodeIntegrationInWorker not correctly scoped in shared renderer processes — electronCWE-653 6.8 Medium2026-04-03
CVE-2026-34774 Electron: Use-after-free in offscreen child window paint callback — electronCWE-416 8.1 High2026-04-03
CVE-2026-34773 Electron: Registry key path injection in app.setAsDefaultProtocolClient on Windows — electronCWE-20 4.7 Medium2026-04-03
CVE-2026-34772 Electron: Use-after-free in download save dialog callback — electronCWE-416 5.8 Medium2026-04-03
CVE-2026-34771 Electron: Use-after-free in WebContents fullscreen, pointer-lock, and keyboard-lock permission callbacks — electronCWE-416 7.5 High2026-04-03

This page lists every published CVE security advisory associated with electron. Each entry links to a detailed page with CVSS scoring, CWE classification, affected products and references. AI-generated Chinese analysis is provided for fast triage.