electron vulnerabilities

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Browse by ecosystem

npm PyPI Maven Go RubyGems Cargo NuGet Composer pub Swift GitHub Actions

CVE-IDSeverityPackage summary

CVE-2026-113796Mediumelectron: Electron: SameSite cookie restrictions are not applied to windows opened from links CVE-2026-113798Mediumelectron: Electron: Pointer lock permission requests can be attributed to the wrong frame CVE-2026-113797Lowelectron: Electron: Extension tabs.query returns tab URLs and titles without the tabs permission CVE-2026-114122Lowelectron: Electron: Frame subscription trusts GPU-supplied frame geometry CVE-2026-114124Lowelectron: Electron: Off-screen rendering on macOS trusts GPU-supplied frame geometry CVE-2026-114121Mediumelectron: Electron: openExternal permission requests can be attributed to the wrong origin CVE-2026-113800Mediumelectron: Electron: HID and USB permission checks can be attributed to the wrong origin CVE-2026-102672Mediumelectron: Electron: Local race condition in Squirrel.Mac update installation on macOS CVE-2026-102673Highelectron: Electron drops inherited HTML sandbox restrictions for popups opened through OpenURLFromTab CVE-2026-102674Highelectron: Electron: Windows opened from a sandboxed top-level document do not inherit its sandbox restrictions CVE-2026-102675Highelectron: Electron: File and HTTP protocol handlers allow cross-origin reads without corsEnabled CVE-2026-102676Highelectron: Electron: <webview> can enable Node.js integration in Web Workers despite embedder restrictions CVE-2026-102677Highelectron: Electron: Sandboxed preload code cache can be poisoned by a compromised renderer CVE-2026-70612Mediumelectron: Electron: Sandboxed iframes can launch external protocol handlers CVE-2026-70611Mediumelectron: Electron: DevTools embedder handler executes arbitrary files via shell open CVE-2026-70610Mediumelectron: Electron: contextBridge object copy honors prototype setters CVE-2026-70609Mediumelectron: Electron: DevTools JavaScript Injection via Unsanitized Dock State Parameter CVE-2026-70608Highelectron: Electron: Sandboxed iframe can bypass the allow-popups restriction via the OpenURL navigation path CVE-2026-70607Mediumelectron: Electron: window.open features string controls some window options considered privileged CVE-2026-70606Mediumelectron: Electron: ProtocolResponse.url reuses the default session cache instead of the registering session CVE-2026-70605Mediumelectron: Electron: HTTP redirect followed into local file loader CVE-2026-70604Highelectron: Electron: Custom protocol with supportFetchAPI but not corsEnabled allows cross-origin reads CVE-2026-70602Mediumelectron: Electron: Extension tab APIs operate across session boundaries CVE-2026-70603Mediumelectron: Electron: shell.openPath path validation bypass via embedded null byte CVE-2026-70601Highelectron: Electron: Context isolation bypass via Function.prototype.bind hijack

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo

Get a personalized demo