Vulnerability-Lookup

CVE-2026-34774 (GCVE-0-2026-34774)

Vulnerability from cvelistv5 – Published: 2026-04-03 23:52 – Updated: 2026-06-30 12:09

Title

Electron: Use-after-free in offscreen child window paint callback

Summary

Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to versions 39.8.1, 40.7.0, and 41.0.0, apps that use offscreen rendering and allow child windows via window.open() may be vulnerable to a use-after-free. If the parent offscreen WebContents is destroyed while a child window remains open, subsequent paint frames on the child dereference freed memory, which may lead to a crash or memory corruption. Apps are only affected if they use offscreen rendering (webPreferences.offscreen: true) and their setWindowOpenHandler permits child windows. Apps that do not use offscreen rendering, or that deny child windows, are not affected. This issue has been patched in versions 39.8.1, 40.7.0, and 41.0.0.

Severity

8.1 (High)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator (v2.0.3)

CWE

CWE-416 - Use After Free
CWE-825 - Expired Pointer Dereference

Assigner

GitHub_M

References

4 references

URL	Tags
https://github.com/electron/electron/security/adv…	x_refsource_CONFIRM
https://access.redhat.com/security/cve/CVE-2026-34774	vdb-entryx_refsource_REDHAT
https://bugzilla.redhat.com/show_bug.cgi?id=2455026	issue-trackingx_refsource_REDHAT
https://security.access.redhat.com/data/csaf/v2/v…	x_sadp-csaf-vex

Impacted products

3 products

Vendor	Product	Version
electron	electron	Affected: < 39.8.1 Affected: >= 40.0.0-alpha.1, < 40.7.0 Affected: >= 41.0.0-alpha.1, < 41.0.0
Red Hat	Red Hat Build of Podman Desktop	cpe:/a:redhat:podman_desktop:1
Red Hat	Red Hat Build of Podman Desktop - Tech Preview	cpe:/a:redhat:podman_desktop:0

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-34774",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-04-07T00:00:00+00:00",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-04-08T03:55:38.650Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "affected": [
          {
            "cpes": [
              "cpe:/a:redhat:podman_desktop:1"
            ],
            "defaultStatus": "affected",
            "product": "Red Hat Build of Podman Desktop",
            "vendor": "Red Hat"
          },
          {
            "cpes": [
              "cpe:/a:redhat:podman_desktop:0"
            ],
            "defaultStatus": "affected",
            "product": "Red Hat Build of Podman Desktop - Tech Preview",
            "vendor": "Red Hat"
          }
        ],
        "datePublic": "2026-04-03T23:52:38.680Z",
        "descriptions": [
          {
            "lang": "en",
            "value": "A flaw was found in Electron. This use-after-free vulnerability occurs in applications that utilize offscreen rendering and permit child windows. When the parent offscreen WebContents is destroyed while a child window remains active, subsequent rendering attempts on the child can access freed memory. This can lead to a crash or memory corruption within the application."
          }
        ],
        "metrics": [
          {
            "other": {
              "content": {
                "namespace": "https://access.redhat.com/security/updates/classification/",
                "value": "Important"
              },
              "type": "Red Hat severity rating"
            }
          },
          {
            "cvssV3_1": {
              "attackComplexity": "HIGH",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 8.1,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
              "version": "3.1"
            },
            "format": "CVSS"
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-825",
                "description": "Expired Pointer Dereference",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-06-30T12:09:08.816Z",
          "orgId": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
          "shortName": "redhat-SADP"
        },
        "references": [
          {
            "tags": [
              "vdb-entry",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/security/cve/CVE-2026-34774"
          },
          {
            "name": "RHBZ#2455026",
            "tags": [
              "issue-tracking",
              "x_refsource_REDHAT"
            ],
            "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2455026"
          },
          {
            "tags": [
              "x_sadp-csaf-vex"
            ],
            "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-34774.json"
          }
        ],
        "timeline": [
          {
            "lang": "en",
            "time": "2026-04-04T01:01:12.427Z",
            "value": "Reported to Red Hat."
          },
          {
            "lang": "en",
            "time": "2026-04-03T23:52:38.680Z",
            "value": "Made public."
          }
        ],
        "title": "Electron: Electron: Memory corruption and crash due to use-after-free in offscreen rendering",
        "workarounds": [
          {
            "lang": "en",
            "value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability."
          }
        ],
        "x_adpType": "supplier",
        "x_generator": {
          "engine": "sadp-cli 1.0.0"
        }
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "electron",
          "vendor": "electron",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 39.8.1"
            },
            {
              "status": "affected",
              "version": "\u003e= 40.0.0-alpha.1, \u003c 40.7.0"
            },
            {
              "status": "affected",
              "version": "\u003e= 41.0.0-alpha.1, \u003c 41.0.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to versions 39.8.1, 40.7.0, and 41.0.0, apps that use offscreen rendering and allow child windows via window.open() may be vulnerable to a use-after-free. If the parent offscreen WebContents is destroyed while a child window remains open, subsequent paint frames on the child dereference freed memory, which may lead to a crash or memory corruption. Apps are only affected if they use offscreen rendering (webPreferences.offscreen: true) and their setWindowOpenHandler permits child windows. Apps that do not use offscreen rendering, or that deny child windows, are not affected. This issue has been patched in versions 39.8.1, 40.7.0, and 41.0.0."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-416",
              "description": "CWE-416: Use After Free",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-04-03T23:52:38.680Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/electron/electron/security/advisories/GHSA-532v-xpq5-8h95",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/electron/electron/security/advisories/GHSA-532v-xpq5-8h95"
        }
      ],
      "source": {
        "advisory": "GHSA-532v-xpq5-8h95",
        "discovery": "UNKNOWN"
      },
      "title": "Electron: Use-after-free in offscreen child window paint callback"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-34774",
    "datePublished": "2026-04-03T23:52:38.680Z",
    "dateReserved": "2026-03-30T19:54:55.555Z",
    "dateUpdated": "2026-06-30T12:09:08.816Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-34774",
      "date": "2026-07-02",
      "epss": "0.00444",
      "percentile": "0.35618"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-34774\",\"sourceIdentifier\":\"security-advisories@github.com\",\"published\":\"2026-04-04T00:16:18.447\",\"lastModified\":\"2026-06-30T03:18:58.500\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to versions 39.8.1, 40.7.0, and 41.0.0, apps that use offscreen rendering and allow child windows via window.open() may be vulnerable to a use-after-free. If the parent offscreen WebContents is destroyed while a child window remains open, subsequent paint frames on the child dereference freed memory, which may lead to a crash or memory corruption. Apps are only affected if they use offscreen rendering (webPreferences.offscreen: true) and their setWindowOpenHandler permits child windows. Apps that do not use offscreen rendering, or that deny child windows, are not affected. This issue has been patched in versions 39.8.1, 40.7.0, and 41.0.0.\"}],\"affected\":[{\"source\":\"security-advisories@github.com\",\"affectedData\":[{\"vendor\":\"electron\",\"product\":\"electron\",\"versions\":[{\"version\":\"\u003c 39.8.1\",\"status\":\"affected\"},{\"version\":\"\u003e= 40.0.0-alpha.1, \u003c 40.7.0\",\"status\":\"affected\"},{\"version\":\"\u003e= 41.0.0-alpha.1, \u003c 41.0.0\",\"status\":\"affected\"}]}]},{\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\",\"affectedData\":[{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Build of Podman Desktop\",\"defaultStatus\":\"affected\",\"cpes\":[\"cpe:/a:redhat:podman_desktop:1\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Build of Podman Desktop - Tech Preview\",\"defaultStatus\":\"affected\",\"cpes\":[\"cpe:/a:redhat:podman_desktop:0\"]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":8.1,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"HIGH\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":2.2,\"impactScore\":5.9},{\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":8.1,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"HIGH\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":2.2,\"impactScore\":5.9}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2026-04-07T00:00:00+00:00\",\"id\":\"CVE-2026-34774\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"total\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-416\"}]},{\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-825\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:electronjs:electron:*:*:*:*:*:node.js:*:*\",\"versionEndExcluding\":\"39.8.1\",\"matchCriteriaId\":\"91FBFEA2-C61C-4D30-A961-8C5A076484F4\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:electronjs:electron:*:*:*:*:*:node.js:*:*\",\"versionStartIncluding\":\"40.0.0\",\"versionEndExcluding\":\"40.7.0\",\"matchCriteriaId\":\"E54036E0-1D1F-4265-A2F3-B9C1F88F65ED\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:electronjs:electron:41.0.0:alpha1:*:*:*:node.js:*:*\",\"matchCriteriaId\":\"A20225D6-F435-4D09-962D-B162F521B6AD\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:electronjs:electron:41.0.0:alpha2:*:*:*:node.js:*:*\",\"matchCriteriaId\":\"33712802-EB60-4E9A-83B8-9F2320B70CB4\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:electronjs:electron:41.0.0:alpha3:*:*:*:node.js:*:*\",\"matchCriteriaId\":\"9D0A9142-54FE-47BB-9FEB-5E97528E28FE\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:electronjs:electron:41.0.0:alpha4:*:*:*:node.js:*:*\",\"matchCriteriaId\":\"9E1D191F-DEAE-4DB3-9822-F31AF9FE3BAC\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:electronjs:electron:41.0.0:alpha5:*:*:*:node.js:*:*\",\"matchCriteriaId\":\"45A8192F-3D2C-4987-9BBE-7ECC3F71965D\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:electronjs:electron:41.0.0:alpha6:*:*:*:node.js:*:*\",\"matchCriteriaId\":\"EEA1A2E5-03DB-46CB-8427-7F31A8A7CE1C\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:electronjs:electron:41.0.0:beta1:*:*:*:node.js:*:*\",\"matchCriteriaId\":\"B2DFCE75-BD3F-4537-B5B8-14097E262EA2\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:electronjs:electron:41.0.0:beta2:*:*:*:node.js:*:*\",\"matchCriteriaId\":\"BC346E25-EA43-4615-8CDB-16D15D46E4FF\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:electronjs:electron:41.0.0:beta3:*:*:*:node.js:*:*\",\"matchCriteriaId\":\"FA5B3C00-CAFC-4995-BF35-9920F3039E77\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:electronjs:electron:41.0.0:beta4:*:*:*:node.js:*:*\",\"matchCriteriaId\":\"3672F3FB-6B5E-40FD-8A92-CB4DD6BC6A93\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:electronjs:electron:41.0.0:beta5:*:*:*:node.js:*:*\",\"matchCriteriaId\":\"9EE4F8AE-21D2-4815-85B7-B7ECCC0D5059\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:electronjs:electron:41.0.0:beta6:*:*:*:node.js:*:*\",\"matchCriteriaId\":\"D195760C-7DD9-4259-9042-EDE65AEAC1D6\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:electronjs:electron:41.0.0:beta7:*:*:*:node.js:*:*\",\"matchCriteriaId\":\"B370859F-24D3-4B25-B580-1A5B6DB94BFE\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:electronjs:electron:41.0.0:beta8:*:*:*:node.js:*:*\",\"matchCriteriaId\":\"7F47CFAE-9744-4B54-B7E4-BB8E4346FDBA\"}]}]}],\"references\":[{\"url\":\"https://github.com/electron/electron/security/advisories/GHSA-532v-xpq5-8h95\",\"source\":\"security-advisories@github.com\",\"tags\":[\"Vendor Advisory\"]},{\"url\":\"https://access.redhat.com/security/cve/CVE-2026-34774\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://bugzilla.redhat.com/show_bug.cgi?id=2455026\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-34774.json\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"}]}}",
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2026-34774\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"total\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-04-06T15:28:41.463428Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-04-06T15:29:18.652Z\"}}], \"cna\": {\"title\": \"Electron: Use-after-free in offscreen child window paint callback\", \"source\": {\"advisory\": \"GHSA-532v-xpq5-8h95\", \"discovery\": \"UNKNOWN\"}, \"metrics\": [{\"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 8.1, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H\", \"integrityImpact\": \"HIGH\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"HIGH\", \"availabilityImpact\": \"HIGH\", \"privilegesRequired\": \"NONE\", \"confidentialityImpact\": \"HIGH\"}}], \"affected\": [{\"vendor\": \"electron\", \"product\": \"electron\", \"versions\": [{\"status\": \"affected\", \"version\": \"\u003c 39.8.1\"}, {\"status\": \"affected\", \"version\": \"\u003e= 40.0.0-alpha.1, \u003c 40.7.0\"}, {\"status\": \"affected\", \"version\": \"\u003e= 41.0.0-alpha.1, \u003c 41.0.0\"}]}], \"references\": [{\"url\": \"https://github.com/electron/electron/security/advisories/GHSA-532v-xpq5-8h95\", \"name\": \"https://github.com/electron/electron/security/advisories/GHSA-532v-xpq5-8h95\", \"tags\": [\"x_refsource_CONFIRM\"]}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to versions 39.8.1, 40.7.0, and 41.0.0, apps that use offscreen rendering and allow child windows via window.open() may be vulnerable to a use-after-free. If the parent offscreen WebContents is destroyed while a child window remains open, subsequent paint frames on the child dereference freed memory, which may lead to a crash or memory corruption. Apps are only affected if they use offscreen rendering (webPreferences.offscreen: true) and their setWindowOpenHandler permits child windows. Apps that do not use offscreen rendering, or that deny child windows, are not affected. This issue has been patched in versions 39.8.1, 40.7.0, and 41.0.0.\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-416\", \"description\": \"CWE-416: Use After Free\"}]}], \"providerMetadata\": {\"orgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"shortName\": \"GitHub_M\", \"dateUpdated\": \"2026-04-03T23:52:38.680Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2026-34774\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-04-08T03:55:38.650Z\", \"dateReserved\": \"2026-03-30T19:54:55.555Z\", \"assignerOrgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"datePublished\": \"2026-04-03T23:52:38.680Z\", \"assignerShortName\": \"GitHub_M\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

FKIE_CVE-2026-34774

Vulnerability from fkie_nvd - Published: 2026-04-04 00:16 - Updated: 2026-06-30 03:18

Severity

8.1 (High) - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
8.1 (High) - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Summary

References

URL	Tags
security-advisories@github.com	https://github.com/electron/electron/security/advisories/GHSA-532v-xpq5-8h95	Vendor Advisory
0b0ca135-0b70-47e7-9f44-1890c2a1c46c	https://access.redhat.com/security/cve/CVE-2026-34774
0b0ca135-0b70-47e7-9f44-1890c2a1c46c	https://bugzilla.redhat.com/show_bug.cgi?id=2455026
0b0ca135-0b70-47e7-9f44-1890c2a1c46c	https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-34774.json

Impacted products

Vendor	Product	Version
electronjs	electron	*
electronjs	electron	*
electronjs	electron	41.0.0
electronjs	electron	41.0.0
electronjs	electron	41.0.0
electronjs	electron	41.0.0
electronjs	electron	41.0.0
electronjs	electron	41.0.0
electronjs	electron	41.0.0
electronjs	electron	41.0.0
electronjs	electron	41.0.0
electronjs	electron	41.0.0
electronjs	electron	41.0.0
electronjs	electron	41.0.0
electronjs	electron	41.0.0
electronjs	electron	41.0.0

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "electron",
          "vendor": "electron",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 39.8.1"
            },
            {
              "status": "affected",
              "version": "\u003e= 40.0.0-alpha.1, \u003c 40.7.0"
            },
            {
              "status": "affected",
              "version": "\u003e= 41.0.0-alpha.1, \u003c 41.0.0"
            }
          ]
        }
      ],
      "source": "security-advisories@github.com"
    },
    {
      "affectedData": [
        {
          "cpes": [
            "cpe:/a:redhat:podman_desktop:1"
          ],
          "defaultStatus": "affected",
          "product": "Red Hat Build of Podman Desktop",
          "vendor": "Red Hat"
        },
        {
          "cpes": [
            "cpe:/a:redhat:podman_desktop:0"
          ],
          "defaultStatus": "affected",
          "product": "Red Hat Build of Podman Desktop - Tech Preview",
          "vendor": "Red Hat"
        }
      ],
      "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c"
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:electronjs:electron:*:*:*:*:*:node.js:*:*",
              "matchCriteriaId": "91FBFEA2-C61C-4D30-A961-8C5A076484F4",
              "versionEndExcluding": "39.8.1",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:electronjs:electron:*:*:*:*:*:node.js:*:*",
              "matchCriteriaId": "E54036E0-1D1F-4265-A2F3-B9C1F88F65ED",
              "versionEndExcluding": "40.7.0",
              "versionStartIncluding": "40.0.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:electronjs:electron:41.0.0:alpha1:*:*:*:node.js:*:*",
              "matchCriteriaId": "A20225D6-F435-4D09-962D-B162F521B6AD",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:electronjs:electron:41.0.0:alpha2:*:*:*:node.js:*:*",
              "matchCriteriaId": "33712802-EB60-4E9A-83B8-9F2320B70CB4",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:electronjs:electron:41.0.0:alpha3:*:*:*:node.js:*:*",
              "matchCriteriaId": "9D0A9142-54FE-47BB-9FEB-5E97528E28FE",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:electronjs:electron:41.0.0:alpha4:*:*:*:node.js:*:*",
              "matchCriteriaId": "9E1D191F-DEAE-4DB3-9822-F31AF9FE3BAC",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:electronjs:electron:41.0.0:alpha5:*:*:*:node.js:*:*",
              "matchCriteriaId": "45A8192F-3D2C-4987-9BBE-7ECC3F71965D",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:electronjs:electron:41.0.0:alpha6:*:*:*:node.js:*:*",
              "matchCriteriaId": "EEA1A2E5-03DB-46CB-8427-7F31A8A7CE1C",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:electronjs:electron:41.0.0:beta1:*:*:*:node.js:*:*",
              "matchCriteriaId": "B2DFCE75-BD3F-4537-B5B8-14097E262EA2",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:electronjs:electron:41.0.0:beta2:*:*:*:node.js:*:*",
              "matchCriteriaId": "BC346E25-EA43-4615-8CDB-16D15D46E4FF",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:electronjs:electron:41.0.0:beta3:*:*:*:node.js:*:*",
              "matchCriteriaId": "FA5B3C00-CAFC-4995-BF35-9920F3039E77",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:electronjs:electron:41.0.0:beta4:*:*:*:node.js:*:*",
              "matchCriteriaId": "3672F3FB-6B5E-40FD-8A92-CB4DD6BC6A93",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:electronjs:electron:41.0.0:beta5:*:*:*:node.js:*:*",
              "matchCriteriaId": "9EE4F8AE-21D2-4815-85B7-B7ECCC0D5059",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:electronjs:electron:41.0.0:beta6:*:*:*:node.js:*:*",
              "matchCriteriaId": "D195760C-7DD9-4259-9042-EDE65AEAC1D6",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:electronjs:electron:41.0.0:beta7:*:*:*:node.js:*:*",
              "matchCriteriaId": "B370859F-24D3-4B25-B580-1A5B6DB94BFE",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:electronjs:electron:41.0.0:beta8:*:*:*:node.js:*:*",
              "matchCriteriaId": "7F47CFAE-9744-4B54-B7E4-BB8E4346FDBA",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to versions 39.8.1, 40.7.0, and 41.0.0, apps that use offscreen rendering and allow child windows via window.open() may be vulnerable to a use-after-free. If the parent offscreen WebContents is destroyed while a child window remains open, subsequent paint frames on the child dereference freed memory, which may lead to a crash or memory corruption. Apps are only affected if they use offscreen rendering (webPreferences.offscreen: true) and their setWindowOpenHandler permits child windows. Apps that do not use offscreen rendering, or that deny child windows, are not affected. This issue has been patched in versions 39.8.1, 40.7.0, and 41.0.0."
    }
  ],
  "id": "CVE-2026-34774",
  "lastModified": "2026-06-30T03:18:58.500",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "HIGH",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 8.1,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 2.2,
        "impactScore": 5.9,
        "source": "security-advisories@github.com",
        "type": "Secondary"
      },
      {
        "cvssData": {
          "attackComplexity": "HIGH",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 8.1,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 2.2,
        "impactScore": 5.9,
        "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-34774",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2026-04-07T00:00:00+00:00",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2026-04-04T00:16:18.447",
  "references": [
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://github.com/electron/electron/security/advisories/GHSA-532v-xpq5-8h95"
    },
    {
      "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
      "url": "https://access.redhat.com/security/cve/CVE-2026-34774"
    },
    {
      "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2455026"
    },
    {
      "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-34774.json"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-416"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Primary"
    },
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-825"
        }
      ],
      "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
      "type": "Secondary"
    }
  ]
}

GHSA-532V-XPQ5-8H95

Vulnerability from github – Published: 2026-04-03 02:42 – Updated: 2026-04-06 23:10

Summary

Electron: Use-after-free in offscreen child window paint callback

Details

Impact

Apps that use offscreen rendering and allow child windows via window.open() may be vulnerable to a use-after-free. If the parent offscreen WebContents is destroyed while a child window remains open, subsequent paint frames on the child dereference freed memory, which may lead to a crash or memory corruption.

Apps are only affected if they use offscreen rendering (webPreferences.offscreen: true) and their setWindowOpenHandler permits child windows. Apps that do not use offscreen rendering, or that deny child windows, are not affected.

Workarounds

Deny child window creation from offscreen renderers in your setWindowOpenHandler, or ensure child windows are closed before the parent is destroyed.

Fixed Versions

41.0.0
40.7.0
39.8.1

For more information

If there are any questions or comments about this advisory, please email security@electronjs.org

Severity

8.1 (High)


                  
                    CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "npm",
        "name": "electron"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "39.8.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "npm",
        "name": "electron"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "40.0.0-alpha.1"
            },
            {
              "fixed": "40.7.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "npm",
        "name": "electron"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "41.0.0-alpha.1"
            },
            {
              "fixed": "41.0.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-34774"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-416"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-04-03T02:42:27Z",
    "nvd_published_at": "2026-04-04T00:16:18Z",
    "severity": "HIGH"
  },
  "details": "### Impact\nApps that use offscreen rendering and allow child windows via `window.open()` may be vulnerable to a use-after-free. If the parent offscreen `WebContents` is destroyed while a child window remains open, subsequent paint frames on the child dereference freed memory, which may lead to a crash or memory corruption.\n\nApps are only affected if they use offscreen rendering (`webPreferences.offscreen: true`) and their `setWindowOpenHandler` permits child windows. Apps that do not use offscreen rendering, or that deny child windows, are not affected.\n\n### Workarounds\nDeny child window creation from offscreen renderers in your `setWindowOpenHandler`, or ensure child windows are closed before the parent is destroyed.\n\n### Fixed Versions\n* `41.0.0`\n* `40.7.0`\n* `39.8.1`\n\n### For more information\nIf there are any questions or comments about this advisory, please email [security@electronjs.org](mailto:security@electronjs.org)",
  "id": "GHSA-532v-xpq5-8h95",
  "modified": "2026-04-06T23:10:55Z",
  "published": "2026-04-03T02:42:27Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/electron/electron/security/advisories/GHSA-532v-xpq5-8h95"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-34774"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/electron/electron"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Electron: Use-after-free in offscreen child window paint callback"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

CVE-2026-34774 (GCVE-0-2026-34774)

FKIE_CVE-2026-34774

GHSA-532V-XPQ5-8H95

Impact

Workarounds

Fixed Versions

For more information

Tags

Sightings

Nomenclature