All vulnerabilities
CVE-2026-114124GHSA-h3v5-h239-pg29

Electron: Off-screen rendering on macOS trusts GPU-supplied frame geometry

electron electronnpmRuntimes & languages
Open in ThreatlineRecord JSON
CVSS
3.9Low
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.15%Chance of exploitation activity in the next 30 days, higher than 3% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in42.11.6Also 43.7.3, 44.4.3 and 1 moreGitHub
Published21 Oct 2026Updated 23 Oct 2026CVE List

What fixes it

  • 42.11.6electron, npmGitHubnpm install electron@42.11.6
  • 43.7.3electron, npmGitHubnpm install electron@43.7.3
  • 44.4.3electron, npmGitHubnpm install electron@44.4.3
  • 45.0.0-alpha.9electron, npmGitHubnpm install electron@45.0.0-alpha.9

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

Impact

In offscreen rendering mode on macOS, frame data received from the GPU process was not fully validated by the main process. A compromised GPU process could cause the main process to read out-of-bounds memory while producing paint event images, disclosing memory or crashing the app. GHSA-pfmc-3mgc-p6fp covers the same issue on the other capture paths.

Apps are only affected if they use offscreen rendering (webPreferences.offscreen) on macOS and an attacker has separately gained code execution in the GPU process. Apps that do not use offscreen rendering are not affected.

Workarounds

There are no app side workarounds, you must update to a patched version of Electron.

Fixed Versions

  • 45.0.0-alpha.9
  • 44.4.3
  • 43.7.3
  • 42.11.6

For more information

If you have any questions or comments about this advisory, email us at [security@electronjs.org](mailto:security@electronjs.org)

Text from GitHub Advisory Database

Affected versions 12

  • electron, npm< 42.11.6GitHub
  • electron, npm>= 43.0.0-alpha.1, < 43.7.3GitHub
  • electron, npm>= 44.0.0-alpha.1, < 44.4.3GitHub
  • electron, npm>= 45.0.0-alpha.1, < 45.0.0-alpha.9GitHub
  • electronaffected: < 42.11.6CVE List
  • electronaffected: >= 43.0.0-alpha.1, < 43.7.3CVE List
  • electronaffected: >= 44.0.0-alpha.1, < 44.4.3CVE List
  • electronaffected: >= 45.0.0-alpha.1, < 45.0.0-alpha.9CVE List
  • electron, npmfrom first release, fixed in 42.11.6OSV
  • electron, npmfrom 43.0.0-alpha.1, fixed in 43.7.3OSV
  • electron, npmfrom 44.0.0-alpha.1, fixed in 44.4.3OSV
  • electron, npmfrom 45.0.0-alpha.1, fixed in 45.0.0-alpha.9OSV

References 17