Vulnerabilities in electron
69 resultsCVE-2026-34774HIGHElectron: Use-after-free in offscreen child window paint callbackEPSS 0.5%CVE-2026-70608HIGHElectron: Sandboxed iframe can bypass the allow-popups restriction via the OpenURL navigation pathEPSS 0.4%CVE-2026-70612MEDIUMElectron: Sandboxed iframes can launch external protocol handlersEPSS 0.4%CVE-2026-54257CRITICALElectron: Buffer performs incorrect byte length calculations resulting in heap buffer under/overflowEPSS 0.4%CVE-2026-115570HIGHElectron: Mitigation for compromised eMudhra intermediate certificatesEPSS 0.4%CVE-2020-4076HIGHContext isolation bypass via leaked cross-context objects in ElectronEPSS 0.4%CVE-2026-70604HIGHElectron: Custom protocol with supportFetchAPI but not corsEnabled allows cross-origin readsEPSS 0.4%CVE-2026-34780HIGHElectron: Context Isolation bypass via contextBridge VideoFrame transferEPSS 0.3%CVE-2026-70605MEDIUMElectron: HTTP redirect followed into local file loaderEPSS 0.3%CVE-2026-34765MEDIUMElectron named window.open targets not scoped to the opener's browsing contextEPSS 0.3%CVE-2026-34769HIGHElectron: Renderer command-line switch injection via undocumented commandLineSwitches webPreferenceEPSS 0.3%CVE-2026-34775MEDIUMElectron: nodeIntegrationInWorker not correctly scoped in shared renderer processesEPSS 0.3%CVE-2026-34771HIGHElectron: Use-after-free in WebContents fullscreen, pointer-lock, and keyboard-lock permission callbacksEPSS 0.3%CVE-2025-55305MEDIUMElectron is vulnerable to Code Injection via resource modificationEPSS 0.3%CVE-2026-70601HIGHElectron: Context isolation bypass via Function.prototype.bind hijackEPSS 0.3%CVE-2026-70602MEDIUMElectron: Extension tab APIs operate across session boundariesEPSS 0.3%CVE-2026-70606MEDIUMElectron: ProtocolResponse.url reuses the default session cache instead of the registering sessionEPSS 0.3%CVE-2026-34770HIGHElectron: Use-after-free in PowerMonitor on Windows and macOSEPSS 0.2%CVE-2026-113798MEDIUMElectron: Pointer lock permission requests can be attributed to the wrong frameEPSS 0.2%CVE-2026-34773MEDIUMElectron: Registry key path injection in app.setAsDefaultProtocolClient on WindowsEPSS 0.2%