CVE-2026-34778
MEDIUM EPSS 2.5%
Published Apr 4, 20262mo ago · Modified Jun 17, 20262w ago
6.5 CVSS 3.1
Published Apr 4, 2026 2mo ago
Last Modified Jun 17, 2026 2w ago
Description
Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to versions 38.8.6, 39.8.1, 40.8.1, and 41.0.0, a service worker running in a session could spoof reply messages on the internal IPC channel used by webContents.executeJavaScript() and related methods, causing the main-process promise to resolve with attacker-controlled data. Apps are only affected if they have service workers registered and use the result of webContents.executeJavaScript() (or webFrameMain.executeJavaScript()) in security-sensitive decisions. This issue has been patched in versions 38.8.6, 39.8.1, 40.8.1, and 41.0.0.
CVSS Details
Base Score
Exploitability
Impact
Vector string
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N Attack Vector Network
Attack Complexity Low
Privileges Required Low
User Interaction None
Scope Unchanged
Confidentiality None
Integrity High
Availability None
Threat Intelligence
EPSS Exploit Probability
2.5% percentile
Exploit & Patch Status
No Known Exploit
No Patch Available
Weaknesses 2
CWE-290
CWE-345
Affected Products 17
| Vendor | Product | Version | Range |
|---|---|---|---|
| electronjs | electron | * | <38.8.6 |
| electronjs | electron | * | ≥39.0.0 – <39.8.1 |
| electronjs | electron | * | ≥40.0.0 – <40.8.1 |
| electronjs | electron | 41.0.0 | any |
| electronjs | electron | 41.0.0 | any |
| electronjs | electron | 41.0.0 | any |
| electronjs | electron | 41.0.0 | any |
| electronjs | electron | 41.0.0 | any |
| electronjs | electron | 41.0.0 | any |
| electronjs | electron | 41.0.0 | any |
| electronjs | electron | 41.0.0 | any |
| electronjs | electron | 41.0.0 | any |
| electronjs | electron | 41.0.0 | any |
| electronjs | electron | 41.0.0 | any |
| electronjs | electron | 41.0.0 | any |
| electronjs | electron | 41.0.0 | any |
| electronjs | electron | 41.0.0 | any |
References 1
- github.com https://github.com/electron/electron/security/advisories/GHSA-xj5x-m3f3-5x3h
Remediation
No remediation data recorded yet
Check vendor advisories and the NVD entry for patch availability.