CVE-2026-34773

A flaw was found in Electron, a framework for building desktop applications. On Windows, the app.setAsDefaultProtocolClient function did not properly validate protocol names before writing to the system registry. This vulnerability could allow a local attacker, through an application that process...

GHSA-MWMH-MQ4G-G6GR Electron: Registry key path injection in app.setAsDefaultProtocolClient on Windows

Impact On Windows, app.setAsDefaultProtocolClientprotocol did not validate the protocol name before writing to the registry. Apps that pass untrusted input as the protocol name may allow an attacker to write to arbitrary subkeys under HKCU\Software\Classes, potentially hijacking existing protocol...