Is electron 34.3 vulnerable?

npm · 5 releases from 34.3.0 to 34.3.4 · latest electron is 45.2.2 · checked 3 Nov 2026

Yes: 46 known advisories

Yes. electron 34.3.4, the last 34.3 release, is affected by 46 known security advisories (12 high, 25 medium, 9 low), including CVE-2026-115570, CVE-2026-102673, CVE-2026-102674. Upgrade to 42.11.16 or later to fix all of them.

Upgrade with:npm install electron@42.11.16

Is your project affected?

Private repo? Upload its lockfile instead, or connect GitHub to check every repo.

Advisories affecting electron 34.3.4

  • HighCVE-2026-115570GHSA-jr5w-w6x2-84p923 Oct 2026

    Electron: Mitigation for compromised eMudhra intermediate certificates

    Affected
    >=45.0.0-alpha.1 <45.0.0-beta.6 · >=44.0.0-alpha.1 <44.9.1 · >=43.0.0-alpha.1 <43.8.1 · <42.11.16
    Fixed in
    42.11.16, 43.8.1, 44.9.1, 45.0.0-beta.6
  • MediumCVE-2026-113796GHSA-2p8c-gr87-267622 Oct 2026

    Electron: SameSite cookie restrictions are not applied to windows opened from links

    Affected
    >=45.0.0-alpha.1 <45.0.0-alpha.6 · >=44.0.0-alpha.1 <44.3.0 · >=43.0.0-alpha.1 <43.7.0 · <42.11.3
    Fixed in
    42.11.3, 43.7.0, 44.3.0, 45.0.0-alpha.6
  • MediumCVE-2026-113798GHSA-x562-297c-g43g22 Oct 2026

    Electron: Pointer lock permission requests can be attributed to the wrong frame

    Affected
    >=45.0.0-alpha.1 <45.0.0-alpha.13 · >=44.0.0-alpha.1 <44.5.0 · >=43.0.0-alpha.1 <43.7.6 · <42.11.9
    Fixed in
    42.11.9, 43.7.6, 44.5.0, 45.0.0-alpha.13
  • LowCVE-2026-113797GHSA-98mx-cjp9-gchm22 Oct 2026

    Electron: Extension tabs.query returns tab URLs and titles without the tabs permission

    Affected
    >=45.0.0-alpha.1 <45.0.0-alpha.4 · >=44.0.0-alpha.1 <44.1.1 · >=43.0.0-alpha.1 <43.5.1 · <42.11.1
    Fixed in
    42.11.1, 43.5.1, 44.1.1, 45.0.0-alpha.4
  • LowCVE-2026-114122GHSA-3qxv-5xgr-q7w922 Oct 2026

    Electron: Frame subscription trusts GPU-supplied frame geometry

    Affected
    <42.11.6 · >=43.0.0-alpha.1 <43.7.3 · >=44.0.0-alpha.1 <44.4.3 · >=45.0.0-alpha.1 <45.0.0-alpha.9
    Fixed in
    42.11.6, 43.7.3, 44.4.3, 45.0.0-alpha.9
  • LowCVE-2026-114124GHSA-h3v5-h239-pg2922 Oct 2026

    Electron: Off-screen rendering on macOS trusts GPU-supplied frame geometry

    Affected
    <42.11.6 · >=43.0.0-alpha.1 <43.7.3 · >=44.0.0-alpha.1 <44.4.3 · >=45.0.0-alpha.1 <45.0.0-alpha.9
    Fixed in
    42.11.6, 43.7.3, 44.4.3, 45.0.0-alpha.9
  • MediumCVE-2026-114121GHSA-997q-gvvc-jwmx22 Oct 2026

    Electron: openExternal permission requests can be attributed to the wrong origin

    Affected
    <42.11.3 · >=43.0.0-alpha.1 <43.7.0 · >=44.0.0-alpha.1 <44.3.0 · >=45.0.0-alpha.1 <45.0.0-alpha.5
    Fixed in
    42.11.3, 43.7.0, 44.3.0, 45.0.0-alpha.5
  • MediumCVE-2026-113800GHSA-fw47-9c62-h3vw21 Oct 2026

    Electron: HID and USB permission checks can be attributed to the wrong origin

    Affected
    >=45.0.0-alpha.1 <45.0.0-alpha.5 · >=44.0.0-alpha.1 <44.3.0 · >=43.0.0-alpha.1 <43.7.0 · <42.11.3
    Fixed in
    42.11.3, 43.7.0, 44.3.0, 45.0.0-alpha.5
  • MediumCVE-2026-102672GHSA-vv43-5jgx-7qv829 Sept 2026

    Electron: Local race condition in Squirrel.Mac update installation on macOS

    Affected
    <39.8.10 · >=40.0.0-alpha.1 <41.10.5 · >=42.0.0-alpha.1 <42.0.0-beta.2
    Fixed in
    39.8.10, 41.10.5, 42.0.0-beta.2
  • HighCVE-2026-102673GHSA-hq2x-r82h-9wj429 Sept 2026

    Electron drops inherited HTML sandbox restrictions for popups opened through OpenURLFromTab

    Affected
    <41.10.4 · >=42.0.0-alpha.1 <42.5.2 · >=43.0.0-alpha.1 <43.0.0
    Fixed in
    41.10.4, 42.5.2, 43.0.0
  • HighCVE-2026-102674GHSA-gr2m-v5gq-v68529 Sept 2026

    Electron: Windows opened from a sandboxed top-level document do not inherit its sandbox restrictions

    Affected
    <41.10.6 · >=42.0.0-alpha.1 <42.9.2 · >=43.0.0-alpha.1 <43.4.1 · >=44.0.0-alpha.1 <44.0.0-beta.5
    Fixed in
    41.10.6, 42.9.2, 43.4.1, 44.0.0-beta.5
  • HighCVE-2026-102675GHSA-j84w-jfhq-vhvj29 Sept 2026

    Electron: File and HTTP protocol handlers allow cross-origin reads without corsEnabled

    Affected
    <41.10.6 · >=42.0.0-alpha.1 <42.9.2 · >=43.0.0-alpha.1 <43.4.1 · >=44.0.0-alpha.1 <44.0.0-beta.5
    Fixed in
    41.10.6, 42.9.2, 43.4.1, 44.0.0-beta.5
  • HighCVE-2026-102676GHSA-9qh4-3jw8-366w29 Sept 2026

    Electron: <webview> can enable Node.js integration in Web Workers despite embedder restrictions

    Affected
    <41.10.6 · >=42.0.0-alpha.1 <42.9.2 · >=43.0.0-alpha.1 <43.4.1 · >=44.0.0-alpha.1 <44.0.0-beta.5
    Fixed in
    41.10.6, 42.9.2, 43.4.1, 44.0.0-beta.5
  • MediumCVE-2026-70612GHSA-p2rr-rvmm-c5fp5 Aug 2026

    Electron: Sandboxed iframes can launch external protocol handlers

    Affected
    <39.8.8 · >=40.0.0-alpha.1 <40.9.0 · >=41.0.0-alpha.1 <41.2.1 · >=42.0.0-alpha.1 <42.0.0-beta.3
    Fixed in
    39.8.8, 40.9.0, 41.2.1, 42.0.0-beta.3
  • MediumCVE-2026-70611GHSA-f2r8-jv7c-xqmp5 Aug 2026

    Electron: DevTools embedder handler executes arbitrary files via shell open

    Affected
    <39.8.9 · >=40.0.0-alpha.1 <40.9.2 · >=41.0.0-alpha.1 <41.2.1 · >=42.0.0-alpha.1 <42.0.0-beta.3
    Fixed in
    39.8.9, 40.9.2, 41.2.1, 42.0.0-beta.3
  • MediumCVE-2026-70610GHSA-ff2p-hmqr-hxm45 Aug 2026

    Electron: contextBridge object copy honors prototype setters

    Affected
    <39.8.9 · >=40.0.0-alpha.1 <40.9.2 · >=41.0.0-alpha.1 <41.2.2 · >=42.0.0-alpha.1 <42.0.0-beta.4
    Fixed in
    39.8.9, 40.9.2, 41.2.2, 42.0.0-beta.4
  • MediumCVE-2026-70609GHSA-4f78-qhmw-8j8m5 Aug 2026

    Electron: DevTools JavaScript Injection via Unsanitized Dock State Parameter

    Affected
    <39.8.7 · >=40.0.0-alpha.1 <40.9.0 · >=41.0.0-alpha.1 <41.2.0 · >=42.0.0-alpha.1 <42.0.0-beta.1
    Fixed in
    39.8.7, 40.9.0, 41.2.0, 42.0.0-beta.1
  • HighCVE-2026-70608GHSA-9f4c-93c8-jc8g5 Aug 2026

    Electron: Sandboxed iframe can bypass the allow-popups restriction via the OpenURL navigation path

    Affected
    >=42.0.0-alpha.1 <42.0.1 · >=40.0.0-alpha.1 <41.10.3 · <39.8.10
    Fixed in
    39.8.10, 41.10.3, 42.0.1
  • MediumCVE-2026-70607GHSA-v93f-fgjr-hjrj5 Aug 2026

    Electron: window.open features string controls some window options considered privileged

    Affected
    <39.8.8 · >=40.0.0-alpha.1 <40.9.0 · >=41.0.0-alpha.1 <41.2.1 · >=42.0.0-alpha.1 <42.0.0-beta.3
    Fixed in
    39.8.8, 40.9.0, 41.2.1, 42.0.0-beta.3
  • MediumCVE-2026-70605GHSA-v64r-4m7r-3mvq5 Aug 2026

    Electron: HTTP redirect followed into local file loader

    Affected
    <39.8.8 · >=40.0.0-alpha.1 <40.9.1 · >=41.0.0-alpha.1 <41.2.1 · >=42.0.0-alpha.1 <42.0.0-beta.3
    Fixed in
    39.8.8, 40.9.1, 41.2.1, 42.0.0-beta.3
  • HighCVE-2026-70604GHSA-v3j7-r9gq-3gjw5 Aug 2026

    Electron: Custom protocol with supportFetchAPI but not corsEnabled allows cross-origin reads

    Affected
    >=42.0.0-alpha.1 <42.0.0 · >=41.0.0-alpha.1 <41.4.0 · >=40.0.0-alpha.1 <40.9.3 · <39.8.10
    Fixed in
    39.8.10, 40.9.3, 41.4.0, 42.0.0
  • MediumCVE-2026-70602GHSA-m55f-7gqj-fr985 Aug 2026

    Electron: Extension tab APIs operate across session boundaries

    Affected
    <39.8.8 · >=40.0.0-alpha.1 <40.9.0 · >=41.0.0-alpha.1 <41.2.1 · >=42.0.0-alpha.1 <42.0.0-beta.3
    Fixed in
    39.8.8, 40.9.0, 41.2.1, 42.0.0-beta.3
  • MediumCVE-2026-70603GHSA-5c9j-mhmv-5xgx5 Aug 2026

    Electron: shell.openPath path validation bypass via embedded null byte

    Affected
    >=42.0.0-alpha.1 <42.0.0-beta.1 · >=41.0.0-alpha.1 <41.1.1 · >=40.0.0-alpha.1 <40.9.0 · <39.8.6
    Fixed in
    39.8.6, 40.9.0, 41.1.1, 42.0.0-beta.1
  • HighCVE-2026-70601GHSA-h7rp-cf8h-j98x5 Aug 2026

    Electron: Context isolation bypass via Function.prototype.bind hijack

    Affected
    <39.8.9 · >=40.0.0-alpha.1 <40.9.2 · >=41.0.0-alpha.1 <41.2.2 · >=42.0.0-alpha.1 <42.0.0-beta.5
    Fixed in
    39.8.9, 40.9.2, 41.2.2, 42.0.0-beta.5
  • LowCVE-2026-70600GHSA-x8rc-wpg4-grpf5 Aug 2026

    Electron: Cross-origin iframe can position native autofill popup

    Affected
    <39.8.8 · >=40.0.0-alpha.1 <40.9.1 · >=41.0.0-alpha.1 <41.2.1 · >=42.0.0-alpha.1 <42.0.0-beta.3
    Fixed in
    39.8.8, 40.9.1, 41.2.1, 42.0.0-beta.3
  • MediumCVE-2026-70599GHSA-9pf5-hg6p-4pwp5 Aug 2026

    Electron: Permission Check Handler Receives Main Frame Origin Instead of Requesting Iframe Origin

    Affected
    <39.8.7 · >=40.0.0-alpha.1 <40.9.0 · >=41.0.0-alpha.1 <41.2.0 · >=42.0.0-alpha.1 <42.0.0-beta.1
    Fixed in
    39.8.7, 40.9.0, 41.2.0, 42.0.0-beta.1
  • LowCVE-2026-70598GHSA-pfmc-3mgc-p6fp5 Aug 2026

    Electron: Off-screen rendering trusts GPU-supplied geometry over shared-memory size

    Affected
    <39.8.10 · >=40.0.0-alpha.1 <40.9.0 · >=41.0.0-alpha.1 <41.2.1 · >=42.0.0-alpha.1 <42.0.0-beta.3
    Fixed in
    39.8.10, 40.9.0, 41.2.1, 42.0.0-beta.3
  • MediumCVE-2026-70597GHSA-jm7p-cc5g-qwxx5 Aug 2026

    Electron: Parent process code-sign check is spoofable

    Affected
    <39.8.8 · >=40.0.0-alpha.1 <40.9.1 · >=41.0.0-alpha.1 <41.2.1 · >=42.0.0-alpha.1 <42.0.0-beta.3
    Fixed in
    39.8.8, 40.9.1, 41.2.1, 42.0.0-beta.3
  • LowCVE-2026-34781GHSA-f37v-82c4-4x647 Apr 2026

    Electron: Crash in clipboard.readImage() on malformed clipboard image data

    Affected
    <39.8.5 · >=40.0.0-alpha.1 <40.8.5 · >=41.0.0-alpha.1 <41.1.0 · >=42.0.0-alpha.1 <42.0.0-alpha.5
    Fixed in
    39.8.5, 40.8.5, 41.1.0, 42.0.0-alpha.5
  • MediumCVE-2026-34765GHSA-f3pv-wv63-48x87 Apr 2026

    Electron: Named window.open targets not scoped to the opener's browsing context

    Affected
    <39.8.5 · >=40.0.0-alpha.1 <40.8.5 · >=41.0.0-alpha.1 <41.1.0 · >=42.0.0-alpha.1 <42.0.0-alpha.5
    Fixed in
    39.8.5, 40.8.5, 41.1.0, 42.0.0-alpha.5
  • LowCVE-2026-34764GHSA-8x5q-pvf5-64mp3 Apr 2026

    Electron: Use-after-free in offscreen shared texture release() callback

    Affected
    >=33.0.0-alpha.1 <39.8.5 · >=40.0.0-alpha.1 <40.8.5 · >=41.0.0-alpha.1 <41.1.0 · >=42.0.0-alpha.1 <42.0.0-alpha.5
    Fixed in
    39.8.5, 40.8.5, 41.1.0, 42.0.0-alpha.5
  • MediumCVE-2026-34779GHSA-5rqw-r77c-jp793 Apr 2026

    Electron: AppleScript injection in app.moveToApplicationsFolder on macOS

    Affected
    <38.8.6 · >=39.0.0-alpha.1 <39.8.1 · >=40.0.0-alpha.1 <40.8.0 · >=41.0.0-alpha.1 <41.0.0-beta.8
    Fixed in
    38.8.6, 39.8.1, 40.8.0, 41.0.0-beta.8
  • MediumCVE-2026-34778GHSA-xj5x-m3f3-5x3h3 Apr 2026

    Electron: Service worker can spoof executeJavaScript IPC replies

    Affected
    <38.8.6 · >=39.0.0-alpha.1 <39.8.1 · >=40.0.0-alpha.1 <40.8.1 · >=41.0.0-alpha.1 <41.0.0
    Fixed in
    38.8.6, 39.8.1, 40.8.1, 41.0.0
  • MediumCVE-2026-34777GHSA-r5p7-gp4j-qhrx3 Apr 2026

    Electron: Incorrect origin passed to permission request handler for iframe requests

    Affected
    <38.8.6 · >=39.0.0-alpha.1 <39.8.1 · >=40.0.0-alpha.1 <40.8.1 · >=41.0.0-alpha.1 <41.0.0
    Fixed in
    38.8.6, 39.8.1, 40.8.1, 41.0.0
  • MediumCVE-2026-34776GHSA-3c8v-cfp5-98853 Apr 2026

    Electron: Out-of-bounds read in second-instance IPC on macOS and Linux

    Affected
    <38.8.6 · >=39.0.0-alpha.1 <39.8.1 · >=40.0.0-alpha.1 <40.8.1 · >=41.0.0-alpha.1 <41.0.0
    Fixed in
    38.8.6, 39.8.1, 40.8.1, 41.0.0
  • MediumCVE-2026-34775GHSA-xwr5-m59h-vwqr3 Apr 2026

    Electron: nodeIntegrationInWorker not correctly scoped in shared renderer processes

    Affected
    <38.8.6 · >=39.0.0-alpha.1 <39.8.4 · >=40.0.0-alpha.1 <40.8.4 · >=41.0.0-alpha.1 <41.0.0
    Fixed in
    38.8.6, 39.8.4, 40.8.4, 41.0.0
  • HighCVE-2026-34774GHSA-532v-xpq5-8h953 Apr 2026

    Electron: Use-after-free in offscreen child window paint callback

    Affected
    <39.8.1 · >=40.0.0-alpha.1 <40.7.0 · >=41.0.0-alpha.1 <41.0.0
    Fixed in
    39.8.1, 40.7.0, 41.0.0
  • MediumCVE-2026-34773GHSA-mwmh-mq4g-g6gr3 Apr 2026

    Electron: Registry key path injection in app.setAsDefaultProtocolClient on Windows

    Affected
    <38.8.6 · >=39.0.0-alpha.1 <39.8.1 · >=40.0.0-alpha.1 <40.8.1 · >=41.0.0-alpha.1 <41.0.0
    Fixed in
    38.8.6, 39.8.1, 40.8.1, 41.0.0
  • MediumCVE-2026-34772GHSA-9w97-2464-87833 Apr 2026

    Electron: Use-after-free in download save dialog callback

    Affected
    <38.8.6 · >=39.0.0-alpha.1 <39.8.0 · >=40.0.0-alpha.1 <40.7.0 · >=41.0.0-alpha.1 <41.0.0-beta.7
    Fixed in
    38.8.6, 39.8.0, 40.7.0, 41.0.0-beta.7
  • HighCVE-2026-34771GHSA-8337-3p73-46f43 Apr 2026

    Electron: Use-after-free in WebContents fullscreen, pointer-lock, and keyboard-lock permission callbacks

    Affected
    <38.8.6 · >=39.0.0-alpha.1 <39.8.0 · >=40.0.0-alpha.1 <40.7.0 · >=41.0.0-alpha.1 <41.0.0-beta.8
    Fixed in
    38.8.6, 39.8.0, 40.7.0, 41.0.0-beta.8
  • HighCVE-2026-34770GHSA-jjp3-mq3x-295m3 Apr 2026

    Electron: Use-after-free in PowerMonitor on Windows and macOS

    Affected
    <38.8.6 · >=39.0.0-alpha.1 <39.8.1 · >=40.0.0-alpha.1 <40.8.0 · >=41.0.0-alpha.1 <41.0.0-beta.8
    Fixed in
    38.8.6, 39.8.1, 40.8.0, 41.0.0-beta.8
  • HighCVE-2026-34769GHSA-9wfr-w7mm-pc7f3 Apr 2026

    Electron: Renderer command-line switch injection via undocumented commandLineSwitches webPreference

    Affected
    <38.8.6 · >=39.0.0-alpha.1 <39.8.0 · >=40.0.0-alpha.1 <40.7.0 · >=41.0.0-alpha.1 <41.0.0-beta.8
    Fixed in
    38.8.6, 39.8.0, 40.7.0, 41.0.0-beta.8
  • LowCVE-2026-34768GHSA-jfqx-fxh3-c62j3 Apr 2026

    Electron: Unquoted executable path in app.setLoginItemSettings on Windows

    Affected
    <38.8.6 · >=39.0.0-alpha.1 <39.8.1 · >=40.0.0-alpha.1 <40.8.0 · >=41.0.0-alpha.1 <41.0.0-beta.8
    Fixed in
    38.8.6, 39.8.1, 40.8.0, 41.0.0-beta.8
  • MediumCVE-2026-34767GHSA-4p4r-m79c-wq3v3 Apr 2026

    Electron: HTTP Response Header Injection in custom protocol handlers and webRequest

    Affected
    <38.8.6 · >=39.0.0-alpha.1 <39.8.3 · >=40.0.0-alpha.1 <40.8.3 · >=41.0.0-alpha.1 <41.0.3
    Fixed in
    38.8.6, 39.8.3, 40.8.3, 41.0.3
  • LowCVE-2026-34766GHSA-9899-m83m-qhpj3 Apr 2026

    Electron: USB device selection not validated against filtered device list

    Affected
    <38.8.6 · >=39.0.0-alpha.1 <39.8.0 · >=40.0.0-alpha.1 <40.7.0 · >=41.0.0-alpha.1 <41.0.0-beta.8
    Fixed in
    38.8.6, 39.8.0, 40.7.0, 41.0.0-beta.8
  • MediumCVE-2025-55305GHSA-vmqv-hx8q-j7mg3 Sept 2025

    Electron has ASAR Integrity Bypass via resource modification

    Affected
    <35.7.5 · >=36.0.0-alpha.1 <36.8.1 · >=37.0.0-alpha.1 <37.3.1 · >=38.0.0-alpha.1 <38.0.0-beta.6
    Fixed in
    35.7.5, 36.8.1, 37.3.1, 38.0.0-beta.6

Which of your client projects are still on electron 34.3?

NPMscan reads the lockfiles in every GitHub repo you pick, finds the exact electron version each one installs, and checks it against these advisories. Each finding comes with the command that fixes it.

Scan a project free, no signupOr connect GitHub to scan every repo

Other electron versions

Advisory data from OSV.dev (opens OSV.dev in a new tab), which includes the GitHub Advisory Database. Release list from the npm registry. Refreshed daily.