All vulnerabilities
CVE-2026-113797GHSA-98mx-cjp9-gchm

Electron: Extension tabs.query returns tab URLs and titles without the tabs permission

electron electronnpmRuntimes & languages
Open in ThreatlineRecord JSON
CVSS
3.1Low
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.49%Chance of exploitation activity in the next 30 days, higher than 40% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in45.0.0-alpha.4Also 44.1.1, 43.5.1 and 1 moreGitHub
Published21 Oct 2026Updated 22 Oct 2026CVE List

What fixes it

  • 45.0.0-alpha.4electron, npmGitHubnpm install electron@45.0.0-alpha.4
  • 44.1.1electron, npmGitHubnpm install electron@44.1.1
  • 43.5.1electron, npmGitHubnpm install electron@43.5.1
  • 42.11.1electron, npmGitHubnpm install electron@42.11.1

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

Impact

chrome.tabs.query() returned each tab's url and title to extensions that held neither the tabs permission nor matching host permissions, so any loaded extension could read the URL and title of every webContents in its session.

Apps are only affected if they load extensions (session.extensions.loadExtension) that they do not fully trust. Apps that load no extensions, or only trusted ones, are not affected.

Workarounds

Do not load untrusted or unvalidated extensions. In general you should only load trusted extensions.

Fixed Versions

  • 45.0.0-alpha.4
  • 44.1.1
  • 43.5.1
  • 42.11.1

For more information

If you have any questions or comments about this advisory, email us at [security@electronjs.org](mailto:security@electronjs.org)

Text from GitHub Advisory Database

Affected versions 12

  • electron, npm>= 45.0.0-alpha.1, < 45.0.0-alpha.4GitHub
  • electron, npm>= 44.0.0-alpha.1, < 44.1.1GitHub
  • electron, npm>= 43.0.0-alpha.1, < 43.5.1GitHub
  • electron, npm< 42.11.1GitHub
  • electronaffected: < 42.11.1CVE List
  • electronaffected: >= 43.0.0-alpha.1, < 43.5.1CVE List
  • electronaffected: >= 44.0.0-alpha.1, < 44.1.1CVE List
  • electronaffected: >= 45.0.0-alpha.1, < 45.0.0-alpha.4CVE List
  • electron, npmfrom 45.0.0-alpha.1, fixed in 45.0.0-alpha.4OSV
  • electron, npmfrom 44.0.0-alpha.1, fixed in 44.1.1OSV
  • electron, npmfrom 43.0.0-alpha.1, fixed in 43.5.1OSV
  • electron, npmfrom first release, fixed in 42.11.1OSV

References 17