CVE-2026-102677

Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. From 42.3.3 until 42.10.0, 43.5.0, and 44.0.0-beta.6, Electron's sandboxed preload code cache did not verify that a cached entry matched the preload it was served for. A compromised renderer...

NPM: Electron: Sandboxed preload code cache can be poisoned by a compromised renderer

NPM: Electron: Sandboxed preload code cache can be poisoned by a compromised renderer vulnerability discovered by ? in WordPress Npm electron versions = 42.3.3, 42.10.0...

Electron: Sandboxed preload code cache can be poisoned by a compromised renderer

Impact The cache Electron keeps for sandboxed preload scripts did not verify that a cached entry matched the preload it was served for. A compromised renderer could use this to run its own code in the preload context on a later load. Apps are only affected if they load untrusted content. Apps tha...

CVE-2026-102677 Electron: Sandboxed preload code cache can be poisoned by a compromised renderer

Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. From 42.3.3 until 42.10.0, 43.5.0, and 44.0.0-beta.6, Electron's sandboxed preload code cache did not verify that a cached entry matched the preload it was served for. A compromised renderer...

CVE-2026-102677

Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. From 42.3.3 until 42.10.0, 43.5.0, and 44.0.0-beta.6, Electron's sandboxed preload code cache did not verify that a cached entry matched the preload it was served for. A compromised renderer...

CVE-2026-102677

The Electron framework (versions 42.3.3 to 42.10.0 , 43.5.0 , and 44.0.0-beta.6 ) is vulnerable to a sandboxed preload code cache poisoning issue. The root cause is a lack of verification ensuring that a cached entry matches the preload it was originally served for. A compromised renderer can inj...

CVE-2026-102677 Electron: Sandboxed preload code cache can be poisoned by a compromised renderer

Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. From 42.3.3 until 42.10.0, 43.5.0, and 44.0.0-beta.6, Electron's sandboxed preload code cache did not verify that a cached entry matched the preload it was served for. A compromised renderer...

CVE-2026-102677 Electron: Sandboxed preload code cache can be poisoned by a compromised renderer

Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. From 42.3.3 until 42.10.0, 43.5.0, and 44.0.0-beta.6, Electron's sandboxed preload code cache did not verify that a cached entry matched the preload it was served for. A compromised renderer...

EUVD-2026-89179

Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. From 42.3.3 until 42.10.0, 43.5.0, and 44.0.0-beta.6, Electron's sandboxed preload code cache did not verify that a cached entry matched the preload it was served for. A compromised renderer...

CVE-2026-102677: Improper Input Validation

Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. From 42.3.3 until 42.10.0, 43.5.0, and 44.0.0-beta.6, Electron's sandboxed preload code cache did not verify that a cached entry matched the preload it was served for. A compromised renderer...

PT-2026-102756

Name of the Vulnerable Software and Affected Versions Electron versions 42.3.3 through 42.9.9 Electron versions 43.0.0 through 43.4.9 Electron versions 44.0.0-beta.0 through 44.0.0-beta.5 Description The sandboxed preload code cache fails to verify that a cached entry matches the preload it was...

CVE-2026-70610

Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.9, 40.9.2, 41.2.2, and 42.0.0-beta.4, objects copied across the contextBridge boundary from untrusted content could carry an attacker-influenced prototype, enabling...

Prototype Pollution

Overview electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS. Affected versions of this package are vulnerable to Prototype Pollution in the contextBridge boundary. An attacker can influence the prototype of objects copied across the...

GHSA-FF2P-HMQR-HXM4 Electron: contextBridge object copy honors prototype setters

Impact Objects copied across the contextBridge boundary from untrusted content could carry an attacker-influenced prototype, enabling prototype-pollution-style attacks against preload code despite context isolation being enabled. Apps are only affected if their preload code accepts object argumen...

CVE-2026-70610

Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.9, 40.9.2, 41.2.2, and 42.0.0-beta.4, objects copied across the contextBridge boundary from untrusted content could carry an attacker-influenced prototype, enabling...

CVE-2026-70610 Electron: contextBridge object copy honors prototype setters

Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.9, 40.9.2, 41.2.2, and 42.0.0-beta.4, objects copied across the contextBridge boundary from untrusted content could carry an attacker-influenced prototype, enabling...

CVE-2026-70610

Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.9, 40.9.2, 41.2.2, and 42.0.0-beta.4, objects copied across the contextBridge boundary from untrusted content could carry an attacker-influenced prototype, enabling...

PT-2026-68959

Impact Objects copied across the contextBridge boundary from untrusted content could carry an attacker-influenced prototype, enabling prototype-pollution-style attacks against preload code despite context isolation being enabled. Apps are only affected if their preload code accepts object argumen...

PT-2026-68286

Name of the Vulnerable Software and Affected Versions Electron versions prior to 39.8.9 Electron versions prior to 40.9.2 Electron versions prior to 41.2.2 Electron versions prior to 42.0.0-beta.4 Description Objects copied across the contextBridge boundary from untrusted content can carry an...

CVE-2026-70610: Improperly Controlled Modification of Object Prototype Attributes

Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.9, 40.9.2, 41.2.2, and 42.0.0-beta.4, objects copied across the contextBridge boundary from untrusted content could carry an attacker-influenced prototype, enabling...