All vulnerabilities
CVE-2026-114122GHSA-3qxv-5xgr-q7w9

Electron: Frame subscription trusts GPU-supplied frame geometry

electron electronnpmRuntimes & languages
Open in ThreatlineRecord JSON
CVSS
3.9Low
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.14%Chance of exploitation activity in the next 30 days, higher than 3% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in42.11.6Also 43.7.3, 44.4.3 and 1 moreGitHub
Published21 Oct 2026Updated 22 Oct 2026CVE List

What fixes it

  • 42.11.6electron, npmGitHubnpm install electron@42.11.6
  • 43.7.3electron, npmGitHubnpm install electron@43.7.3
  • 44.4.3electron, npmGitHubnpm install electron@44.4.3
  • 45.0.0-alpha.9electron, npmGitHubnpm install electron@45.0.0-alpha.9

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

Impact

Frame data received from the GPU process for webContents.beginFrameSubscription was not fully validated by the main process. A compromised GPU process could cause the main process to read out-of-bounds memory while producing the captured frame images, disclosing memory or crashing the app.

Apps are only affected if they use webContents.beginFrameSubscription and an attacker has separately gained code execution in the GPU process. Apps that do not subscribe to captured frames are not affected.

Workarounds

There are no app side workarounds, you must update to a patched version of Electron.

Fixed Versions

  • 45.0.0-alpha.9
  • 44.4.3
  • 43.7.3
  • 42.11.6

For more information

If you have any questions or comments about this advisory, email us at [security@electronjs.org](mailto:security@electronjs.org)

Text from GitHub Advisory Database

Affected versions 12

  • electron, npm< 42.11.6GitHub
  • electron, npm>= 43.0.0-alpha.1, < 43.7.3GitHub
  • electron, npm>= 44.0.0-alpha.1, < 44.4.3GitHub
  • electron, npm>= 45.0.0-alpha.1, < 45.0.0-alpha.9GitHub
  • electronaffected: < 42.11.6CVE List
  • electronaffected: >= 43.0.0-alpha.1, < 43.7.3CVE List
  • electronaffected: >= 44.0.0-alpha.1, < 44.4.3CVE List
  • electronaffected: >= 45.0.0-alpha.1, < 45.0.0-alpha.9CVE List
  • electron, npmfrom first release, fixed in 42.11.6OSV
  • electron, npmfrom 43.0.0-alpha.1, fixed in 43.7.3OSV
  • electron, npmfrom 44.0.0-alpha.1, fixed in 44.4.3OSV
  • electron, npmfrom 45.0.0-alpha.1, fixed in 45.0.0-alpha.9OSV

References 17