CVE-2026-115570High· 7.4▾ TwilightElectron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 42.11.16, 43.8.1, 44.9.1, and 45.0.0-beta.6, Electron does not block compromised eMudhra intermediate certificates in Chromi…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 40.7 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake. The CVSS score shown above comes from the assigning CNA record, not NVD.
Exploit-prediction probability, daily snapshots since Oct 25.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CVEORG
0.5%
Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 42.11.16, 43.8.1, 44.9.1, and 45.0.0-beta.6, Electron does not block compromised eMudhra intermediate certificates in Chromium networking, Node.js tls, Node.js https, or Node.js fetch. An attacker who holds a certificate issued through one of these intermediates and can intercept network traffic can impersonate a TLS server to an affected application. This issue is fixed in versions 42.11.16, 43.8.1, 44.9.1, and 45.0.0-beta.6.
electron >= 45.0.0-alpha.1, < 45.0.0-beta.6electron >= 44.0.0-alpha.1, < 44.9.1electron >= 43.0.0-alpha.1, < 43.8.1electron < 42.11.16Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Affected packages:
electron >= 45.0.0-alpha.1, < 45.0.0-beta.6electron >= 44.0.0-alpha.1, < 44.9.1electron >= 43.0.0-alpha.1, < 43.8.1electron < 42.11.16Patched in:
electron 45.0.0-beta.6electron 44.9.1electron 43.8.1electron 42.11.16Connected by shared product, vendor, weakness, or advisory.
CVE-2026-114124Low· 3.9Electron: Off-screen rendering on macOS trusts GPU-supplied frame geometry
CVE-2026-113796Medium· 4.2Electron: SameSite cookie restrictions are not applied to windows opened from links
CVE-2026-113797Low· 3.1Electron: Extension tabs.query returns tab URLs and titles without the tabs permission
CVE-2026-113798Medium· 5.4Electron: Pointer lock permission requests can be attributed to the wrong frame
CVE-2026-113800Medium· 5.4Electron: HID and USB permission checks can be attributed to the wrong origin
CVE-2026-114121Medium· 5.4Electron: openExternal permission requests can be attributed to the wrong origin