CVE-2026-102677High· 7.8▾ TwilightElectron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. From 42.3.3 until 42.10.0, 43.5.0, and 44.0.0-beta.6, Electron's sandboxed preload code cache did not verify that a cached entry matc…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 42.9 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake.
Exploit-prediction probability, daily snapshots since Sep 30.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
0.09%
Last analysed / modified upstream
0.09% → 0.10%
Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. From 42.3.3 until 42.10.0, 43.5.0, and 44.0.0-beta.6, Electron's sandboxed preload code cache did not verify that a cached entry matched the preload it was served for. A compromised renderer could write attacker-controlled cache data and cause Electron to reuse it for a later load, executing the renderer's code in the more privileged preload context. The issue affects applications that load untrusted content. This issue is fixed in versions 42.10.0, 43.5.0, and 44.0.0-beta.6.
electron >= 42.3.3, <= 42.10.0electron >= 43.0.0, < 43.4.2electron = 44.0.0Upgrade past the affected range:
electron 43.4.2Affected packages:
electron >= 42.3.3, < 42.10.0electron >= 43.0.0-beta.1, < 43.5.0electron >= 44.0.0-alpha.1, < 44.0.0-beta.6Patched in:
electron 42.10.0electron 43.5.0electron 44.0.0-beta.6Source: https://github.com/advisories/GHSA-qmv3-fv6v-rmhq
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-102676High· 8.3Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS
CVE-2026-102673High· 8.2Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS
CVE-2026-102674High· 8.2Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS
CVE-2026-102675High· 7.4Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS
CVE-2026-70603Medium· 6.0Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS
CVE-2026-70607Medium· 5.3Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS