CVE-2026-102676High· 8.3▾ TwilightElectron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 41.10.6, 42.9.2, 43.4.1, and 44.0.0-beta.5, an Electron <webview> guest could enable nodeIntegrationInWorker for its Web Wor…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 45.7 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake.
Exploit-prediction probability, daily snapshots since Sep 30.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
0.5%
Last analysed / modified upstream
0.5% → 0.5%
Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 41.10.6, 42.9.2, 43.4.1, and 44.0.0-beta.5, an Electron <webview> guest could enable nodeIntegrationInWorker for its Web Workers even when the unsandboxed embedder had Node.js integration disabled, allowing untrusted guest content to create a Node-enabled worker with more privilege than the embedder granted. Applications that do not enable the <webview> tag or that keep the embedder sandboxed are not affected. This issue is fixed in versions 41.10.6, 42.9.2, 43.4.1, and 44.0.0-beta.5.
electron < 41.10.6electron >= 42.0.0, < 42.9.2electron >= 43.0.0, < 43.4.1electron = 44.0.0Upgrade past the affected range:
electron 43.4.1Affected packages:
electron < 41.10.6electron >= 42.0.0-alpha.1, < 42.9.2electron >= 43.0.0-alpha.1, < 43.4.1electron >= 44.0.0-alpha.1, < 44.0.0-beta.5Patched in:
electron 41.10.6electron 42.9.2electron 43.4.1electron 44.0.0-beta.5Source: https://github.com/advisories/GHSA-9qh4-3jw8-366w
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-102674High· 8.2Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS
CVE-2026-102675High· 7.4Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS
CVE-2026-102677High· 7.8Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS
CVE-2026-102673High· 8.2Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS
CVE-2026-115570High· 7.4Electron: Mitigation for compromised eMudhra intermediate certificates
CVE-2026-114124Low· 3.9Electron: Off-screen rendering on macOS trusts GPU-supplied frame geometry