electron vulnerabilities

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Browse by ecosystem

npm PyPI Maven Go RubyGems Cargo NuGet Composer pub Swift GitHub Actions

CVE-IDSeverityPackage summary

CVE-2026-54257Criticalelectron: Electron: Buffer performs incorrect byte length calculations resulting in heap buffer under/overflow CVE-2026-34781Lowelectron: Electron: Crash in clipboard.readImage() on malformed clipboard image data CVE-2026-34765Mediumelectron: Electron: Named window.open targets not scoped to the opener's browsing context CVE-2026-34764Lowelectron: Electron: Use-after-free in offscreen shared texture release() callback CVE-2026-34780Highelectron: Electron: Context Isolation bypass via contextBridge VideoFrame transfer CVE-2026-34779Mediumelectron: Electron: AppleScript injection in app.moveToApplicationsFolder on macOS CVE-2026-34778Mediumelectron: Electron: Service worker can spoof executeJavaScript IPC replies CVE-2026-34777Mediumelectron: Electron: Incorrect origin passed to permission request handler for iframe requests CVE-2026-34776Mediumelectron: Electron: Out-of-bounds read in second-instance IPC on macOS and Linux CVE-2026-34775Mediumelectron: Electron: nodeIntegrationInWorker not correctly scoped in shared renderer processes CVE-2026-34774Highelectron: Electron: Use-after-free in offscreen child window paint callback CVE-2026-34773Mediumelectron: Electron: Registry key path injection in app.setAsDefaultProtocolClient on Windows CVE-2026-34772Mediumelectron: Electron: Use-after-free in download save dialog callback CVE-2026-34771Highelectron: Electron: Use-after-free in WebContents fullscreen, pointer-lock, and keyboard-lock permission…CVE-2026-34770Highelectron: Electron: Use-after-free in PowerMonitor on Windows and macOS CVE-2026-34769Highelectron: Electron: Renderer command-line switch injection via undocumented commandLineSwitches webPreference CVE-2026-34768Lowelectron: Electron: Unquoted executable path in app.setLoginItemSettings on Windows CVE-2026-34767Mediumelectron: Electron: HTTP Response Header Injection in custom protocol handlers and webRequest CVE-2026-34766Lowelectron: Electron: USB device selection not validated against filtered device list CVE-2025-55305Mediumelectron: Electron has ASAR Integrity Bypass via resource modification CVE-2024-46993Mediumelectron: Electron vulnerable to Heap Buffer Overflow in NativeImage CVE-2024-46992Highelectron: electron ASAR Integrity bypass by just modifying the content CVE-2023-44402Mediumelectron: ASAR Integrity bypass via filetype confusion in electron CVE-2023-5217Highelectron: Electron affected by libvpx's heap buffer overflow in vp8 encoding CVE-2023-4863Highlibwebp-sys2: libwebp: OOB write in BuildHuffmanTable

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo

Get a personalized demo