All vulnerabilities
CVE-2026-102677GHSA-qmv3-fv6v-rmhq

Electron: Sandboxed preload code cache can be poisoned by a compromised renderer

electron electronnpmRuntimes & languages
Open in ThreatlineRecord JSON
CVSS
7.8High
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.10%Chance of exploitation activity in the next 30 days, higher than 0% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in42.10.0Also 43.5.0, 44.0.0-beta.6GitHub
Published29 Sep 2026Updated 2 Oct 2026CVE List

What fixes it

  • 42.10.0electron, npmGitHubnpm install electron@42.10.0
  • 43.5.0electron, npmGitHubnpm install electron@43.5.0
  • 44.0.0-beta.6electron, npmGitHubnpm install electron@44.0.0-beta.6

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

Impact

The cache Electron keeps for sandboxed preload scripts did not verify that a cached entry matched the preload it was served for. A compromised renderer could use this to run its own code in the preload context on a later load.

Apps are only affected if they load untrusted content. Apps that do not load untrusted content are not affected.

Workarounds

There are no app side workarounds, you must update to a patched version of Electron.

Fixed Versions

  • 44.0.0-beta.6
  • 43.5.0
  • 42.10.0

For more information

If you have any questions or comments about this advisory, email us at [security@electronjs.org](mailto:security@electronjs.org)

Text from GitHub Advisory Database

Affected versions 9

  • electron, npm>= 42.3.3, < 42.10.0GitHub
  • electron, npm>= 43.0.0-beta.1, < 43.5.0GitHub
  • electron, npm>= 44.0.0-alpha.1, < 44.0.0-beta.6GitHub
  • electronaffected: >= 42.3.3, < 42.10.0CVE List
  • electronaffected: >= 43.0.0-beta.1, < 43.5.0CVE List
  • electronaffected: >= 44.0.0-alpha.1, < 44.0.0-beta.6CVE List
  • electron, npmfrom 42.3.3, fixed in 42.10.0OSV
  • electron, npmfrom 43.0.0-beta.1, fixed in 43.5.0OSV
  • electron, npmfrom 44.0.0-alpha.1, fixed in 44.0.0-beta.6OSV

References 10