Sign in
Deutsch English Español Polski
High

Electron: Use-after-free in WebContents fullscreen, pointer-lock, and keyboard-lock permission callbacks

  • Disclosed: 03.04.2026
  • Updated: 11.10.2026 10:22

Impact

Apps that register an asynchronous session.setPermissionRequestHandler() may be vulnerable to a use-after-free when handling fullscreen, pointer-lock, or keyboard-lock permission requests. If the requesting frame navigates or the window closes while the permission handler is pending, invoking the stored callback dereferences freed memory, which may lead to a crash or memory corruption.

Apps that do not set a permission request handler, or whose handler responds synchronously, are not affected.

Workarounds

Respond to permission requests synchronously, or deny fullscreen, pointer-lock, and keyboard-lock requests if an asynchronous flow is required.

Fixed Versions

  • 41.0.0-beta.8
  • 40.7.0
  • 39.8.0
  • 38.8.6

For more information

If there are any questions or comments about this advisory, please email security@electronjs.org

Affected software

Click a technology to see all vulnerabilities affecting it.

PlatformPackageVulnerable versionsFixed in
npm package electron < 38.8.6, >= 39.0.0-alpha.1, < 39.8.0, >= 40.0.0-alpha.1, < 40.7.0, >= 41.0.0-alpha.1, < 41.0.0-beta.8 38.8.6, 39.8.0, 40.7.0, 41.0.0-beta.8

References

CVSS score 7.5/10
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Weakness (CWE)
CWE-416
Platform
npm
Package
electron
Disclosed
03.04.2026
Updated
11.10.2026 10:22

Sources and licenses

OSV / GitHub Advisory Database - GHSA-8337-3p73-46f4 - CC BY 4.0

Vulnerability history: electron

All published vulnerabilities of this package (npm package), newest first. Shows whether this is a one-off slip or a package that needs watching.

All (72) in the archive
Total entries
72
First → latest
10.2017 10.2026
Without a fix
0
Exploited in attacks
3

Severity breakdown

  • Critical 3
  • High 26
  • Medium 33
  • Low 10

Disclosures per year

Severity:
  1. Electron drops inherited HTML sandbox restrictions for popups opened through OpenURLFromTab
    High · 8.2 CVE-2026-102673 < 41.10.4, >= 42.0.0-alpha.1, < 42.5.2, >= 43.0.0-alpha.1, < 43.0.0 41.10.4, 42.5.2, 43.0.0
  2. Electron: Windows opened from a sandboxed top-level document do not inherit its sandbox restrictions
    High · 8.2 CVE-2026-102674 < 41.10.6, >= 42.0.0-alpha.1, < 42.9.2, >= 43.0.0-alpha.1, < 43.4.1, >= 44.0.0-alpha.1, < 44.0.0-beta.5 41.10.6, 42.9.2, 43.4.1, 44.0.0-beta.5
  3. Electron: File and HTTP protocol handlers allow cross-origin reads without corsEnabled
    High · 7.4 CVE-2026-102675 < 41.10.6, >= 42.0.0-alpha.1, < 42.9.2, >= 43.0.0-alpha.1, < 43.4.1, >= 44.0.0-alpha.1, < 44.0.0-beta.5 41.10.6, 42.9.2, 43.4.1, 44.0.0-beta.5
  4. Electron: <webview> can enable Node.js integration in Web Workers despite embedder restrictions
    High · 8.3 CVE-2026-102676 < 41.10.6, >= 42.0.0-alpha.1, < 42.9.2, >= 43.0.0-alpha.1, < 43.4.1, >= 44.0.0-alpha.1, < 44.0.0-beta.5 41.10.6, 42.9.2, 43.4.1, 44.0.0-beta.5
  5. Electron: Sandboxed preload code cache can be poisoned by a compromised renderer
    High · 7.8 CVE-2026-102677 >= 42.3.3, < 42.10.0, >= 43.0.0-beta.1, < 43.5.0, >= 44.0.0-alpha.1, < 44.0.0-beta.6 42.10.0, 43.5.0, 44.0.0-beta.6
  6. Electron: Sandboxed iframe can bypass the allow-popups restriction via the OpenURL navigation path
    High · 7.2 CVE-2026-70608 >= 42.0.0-alpha.1, < 42.0.1, >= 40.0.0-alpha.1, < 41.10.3, < 39.8.10 42.0.1, 41.10.3, 39.8.10
  7. Electron: Custom protocol with supportFetchAPI but not corsEnabled allows cross-origin reads
    High · 7.4 CVE-2026-70604 >= 42.0.0-alpha.1, < 42.0.0, >= 41.0.0-alpha.1, < 41.4.0, >= 40.0.0-alpha.1, < 40.9.3, < 39.8.10 42.0.0, 41.4.0, 40.9.3, 39.8.10
  8. Electron: Context isolation bypass via Function.prototype.bind hijack
    High · 7.5 CVE-2026-70601 < 39.8.9, >= 40.0.0-alpha.1, < 40.9.2, >= 41.0.0-alpha.1, < 41.2.2, >= 42.0.0-alpha.1, < 42.0.0-beta.5 39.8.9, 40.9.2, 41.2.2, 42.0.0-beta.5
  9. Electron: Buffer performs incorrect byte length calculations resulting in heap buffer under/overflow
    Critical CVE-2026-54257 >= 42.3.1, < 42.3.3 42.3.3
  10. Electron: Context Isolation bypass via contextBridge VideoFrame transfer
    High · 8.3 CVE-2026-34780 >= 39.0.0-alpha.1, < 39.8.0, >= 40.0.0-alpha.1, < 40.7.0, >= 41.0.0-alpha.1, < 41.0.0-beta.8 39.8.0, 40.7.0, 41.0.0-beta.8
  11. Electron: Use-after-free in offscreen child window paint callback
    High · 8.1 CVE-2026-34774 < 39.8.1, >= 40.0.0-alpha.1, < 40.7.0, >= 41.0.0-alpha.1, < 41.0.0 39.8.1, 40.7.0, 41.0.0
  12. Electron: Use-after-free in WebContents fullscreen, pointer-lock, and keyboard-lock permission callbacks this entry
    High · 7.5 CVE-2026-34771 < 38.8.6, >= 39.0.0-alpha.1, < 39.8.0, >= 40.0.0-alpha.1, < 40.7.0, >= 41.0.0-alpha.1, < 41.0.0-beta.8 38.8.6, 39.8.0, 40.7.0, 41.0.0-beta.8
  13. Electron: Use-after-free in PowerMonitor on Windows and macOS
    High · 7.0 CVE-2026-34770 < 38.8.6, >= 39.0.0-alpha.1, < 39.8.1, >= 40.0.0-alpha.1, < 40.8.0, >= 41.0.0-alpha.1, < 41.0.0-beta.8 38.8.6, 39.8.1, 40.8.0, 41.0.0-beta.8
  14. Electron: Renderer command-line switch injection via undocumented commandLineSwitches webPreference
    High · 7.7 CVE-2026-34769 < 38.8.6, >= 39.0.0-alpha.1, < 39.8.0, >= 40.0.0-alpha.1, < 40.7.0, >= 41.0.0-alpha.1, < 41.0.0-beta.8 38.8.6, 39.8.0, 40.7.0, 41.0.0-beta.8
  15. electron ASAR Integrity bypass by just modifying the content
    High · 7.8 CVE-2024-46992 >= 30.0.0-alpha.1, < 30.0.5, >= 31.0.0-alpha.1, < 31.0.0-beta.1 30.0.5, 31.0.0-beta.1
  16. Electron affected by libvpx's heap buffer overflow in vp8 encoding
    High · 8.8 Exploited in attacks CVE-2023-5217 < 22.3.25, >= 24.0.0, < 24.8.5, >= 25.0.0, < 25.8.4, >= 26.0.0, < 26.2.4, >= 27.0.0-alpha.1, < 27.0.0-beta.8 22.3.25, 24.8.5, 25.8.4, 26.2.4, 27.0.0-beta.8
  17. libwebp: OOB write in BuildHuffmanTable
    High · 8.8 Exploited in attacks CVE-2023-4863 >= 22.0.0, < 22.3.24, >= 24.0.0, < 24.8.3, >= 25.0.0, < 25.8.1, >= 26.0.0, < 26.2.1, >= 27.0.0-beta.1, < 27.0.0-beta.2 22.3.24, 24.8.3, 25.8.1, 26.2.1, 27.0.0-beta.2
  18. Electron's Content-Secrity-Policy disabling eval not applied consistently in renderers with sandbox disabled
    High · 7.5 CVE-2023-23623 >= 22.0.0-beta.1, < 22.0.1, >= 23.0.0-alpha.1, < 23.0.0-alpha.2 22.0.1, 23.0.0-alpha.2
  19. Heap buffer overflow in GPU
    Critical · 9.6 Exploited in attacks CVE-2022-4135 >= 19.0.0, < 19.1.8 19.1.8
  20. Electron vulnerable to remote command execution
    High · 8.1 CVE-2017-12581 < 1.6.8 1.6.8
  21. Unpreventable top-level navigation
    High · 7.5 CVE-2020-15174 >= 8.0.0-beta.0, < 8.5.1, >= 9.0.0-beta.0, < 9.3.0, >= 10.0.0-beta.0, < 10.0.1 8.5.1, 9.3.0, 10.0.1
  22. Context isolation bypass via contextBridge in Electron
    High · 7.7 CVE-2020-4077 < 7.2.4, >= 8.0.0, < 8.2.4 7.2.4, 8.2.4
  23. Context isolation bypass via leaked cross-context objects in Electron
    High · 7.8 CVE-2020-4076 < 7.2.4, >= 8.0.0, < 8.2.4 7.2.4, 8.2.4
  24. Electron webPreferences vulnerability can be used to perform remote code execution
    High · 8.1 CVE-2018-15685 >= 1.7.0, < 1.7.16, >= 1.8.0, < 1.8.8, >= 2.0.0, < 2.0.8, >= 3.0.0-beta.1, < 3.0.0-beta.7 1.7.16, 1.8.8, 2.0.8, 3.0.0-beta.7
  25. Chromium Remote Code Execution in electron
    Critical · 9.8 CVE-2017-16151 < 1.6.14, >= 1.7.0, < 1.7.8 1.6.14, 1.7.8
  26. Electron protocol handler browser vulnerable to Command Injection
    High · 8.8 CVE-2018-1000118 < 1.8.2-beta5 1.8.2-beta5
  27. Electron Vulnerable to Code Execution by Re-Enabling Node.js Integration
    High · 8.1 CVE-2018-1000136 >= 1.7.0, < 1.7.13, >= 1.8.0, < 1.8.4, >= 2.0.0-beta.1, < 2.0.0-beta.5 1.7.13, 1.8.4, 2.0.0-beta.5
  28. Remote Code Execution in electron
    High · 8.8 CVE-2018-1000006 >= 1.7.0, < 1.7.11, >= 1.6.0, < 1.6.16, >= 1.8.0, < 1.8.2-beta.4 1.7.11, 1.6.16, 1.8.2-beta.4
  29. High severity vulnerability that affects electron
    High · 7.8 CVE-2016-1202 < 0.33.5 0.33.5

Know which vulnerabilities affect your application

With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.

Connect your application
DockRay newsletter

Application security in your inbox

Important vulnerabilities, actionable guidance and practical advice for your applications. Choose your technologies and follow what matters to your project.

  • A daily digest of new vulnerabilities, critical ones included.
  • Notifications about important updates.
  • Practical advice on application security and monitoring.

Leave empty to receive updates for every technology.

Privacy policy

Free to subscribe. Unsubscribe with one click in any email.