electron has 11 CVEs on record. Disclosure cadence is accelerating: 10 in the last 90 days against 1 in the 90 before. The busiest recent month was October 2026 with 9. The median CVSS is 5.4 (medium), with 1 rated critical. None have a confirmed exploitation report. The most common weakness class is CWE-346 (4).
CVEs per month
Last 12 months, by publish date
- Exploited share
- 0% vs 1% corpus
- Median CVSS
- 5.4
- Publish → KEV
- —
- Last 90 days
- 10 prev 1
Worst active — by depth score
CVE-2026-54257CriticalElectron: Buffer performs incorrect byte length calculations resulting in heap buffer under/overflow52CVE-2026-115570High· 7.4Electron: Mitigation for compromised eMudhra intermediate certificates41CVE-2026-102675High· 7.4Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS41CVE-2026-102672Medium· 6.7Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS37CVE-2026-114121Medium· 5.4Electron: openExternal permission requests can be attributed to the wrong origin30
electron vulnerabilities
CVEs affecting electron, newest first. Open any entry for full detail, references, and exploit status.
11 CVEsRSS
CVE-2026-115570High· 7.4Electron: Mitigation for compromised eMudhra intermediate certificates
Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 42.11.16, 43.8.1, 44.9.1, and 45.0.0-beta.6, Electron does not block compromised eMudhra intermediate certificates in Chromi…
CVE-2026-113797Low· 3.1Electron: Extension tabs.query returns tab URLs and titles without the tabs permission
Electron: Extension tabs.query returns tab URLs and titles without the tabs permission
CVE-2026-113798Medium· 5.4Electron: Pointer lock permission requests can be attributed to the wrong frame
Electron: Pointer lock permission requests can be attributed to the wrong frame
CVE-2026-114121Medium· 5.4Electron: openExternal permission requests can be attributed to the wrong origin
Electron: openExternal permission requests can be attributed to the wrong origin
CVE-2026-114122Low· 3.9Electron: Frame subscription trusts GPU-supplied frame geometry
Electron: Frame subscription trusts GPU-supplied frame geometry
CVE-2026-114124Low· 3.9Electron: Off-screen rendering on macOS trusts GPU-supplied frame geometry
Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to versions 42.11.6, 43.7.3, 44.4.3, and 45.0.0-alpha.9, frame data received from the GPU process for macOS offscreen rendering…
CVE-2026-113796Medium· 4.2Electron: SameSite cookie restrictions are not applied to windows opened from links
Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to versions 42.11.3, 43.7.0, 44.3.0, and 45.0.0-alpha.6, Electron treated pages opened into a new window from links as applicat…
CVE-2026-113800Medium· 5.4Electron: HID and USB permission checks can be attributed to the wrong origin
Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to versions 42.11.3, 43.7.0, 44.3.0, and 45.0.0-alpha.5, hid and usb permission checks made from an iframe caused setPermission…
CVE-2026-102672Medium· 6.7Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS
Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.10, 41.10.5, and 42.0.0-beta.2, Electron applications on macOS that use Squirrel.Mac-based automatic updates are vulner…
CVE-2026-102675High· 7.4Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS
Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 41.10.6, 42.9.2, 43.4.1, and 44.0.0-beta.5, responses served through protocol.registerFileProtocol or protocol.registerHttpP…
CVE-2026-54257CriticalElectron: Buffer performs incorrect byte length calculations resulting in heap buffer under/overflow
Electron: Buffer performs incorrect byte length calculations resulting in heap buffer under/overflow