Is electron 42.3 vulnerable?
npm · 4 releases from 42.3.0 to 42.3.3 · latest electron is 45.2.1 · checked 2 Nov 2026
Yes: 14 known advisories
Yes. electron 42.3.3, the last 42.3 release, is affected by 14 known security advisories (6 high, 5 medium, 3 low), including CVE-2026-115570, CVE-2026-102673, CVE-2026-102674. 1 more affects earlier 42.3.x releases. Upgrade to 42.11.16 or later to fix all of them.
npm install electron@42.11.16Advisories affecting electron 42.3.3
Electron: Mitigation for compromised eMudhra intermediate certificates
- Affected
- >=45.0.0-alpha.1 <45.0.0-beta.6 · >=44.0.0-alpha.1 <44.9.1 · >=43.0.0-alpha.1 <43.8.1 · <42.11.16
- Fixed in
- 42.11.16, 43.8.1, 44.9.1, 45.0.0-beta.6
Electron: SameSite cookie restrictions are not applied to windows opened from links
- Affected
- >=45.0.0-alpha.1 <45.0.0-alpha.6 · >=44.0.0-alpha.1 <44.3.0 · >=43.0.0-alpha.1 <43.7.0 · <42.11.3
- Fixed in
- 42.11.3, 43.7.0, 44.3.0, 45.0.0-alpha.6
Electron: Pointer lock permission requests can be attributed to the wrong frame
- Affected
- >=45.0.0-alpha.1 <45.0.0-alpha.13 · >=44.0.0-alpha.1 <44.5.0 · >=43.0.0-alpha.1 <43.7.6 · <42.11.9
- Fixed in
- 42.11.9, 43.7.6, 44.5.0, 45.0.0-alpha.13
Electron: Extension tabs.query returns tab URLs and titles without the tabs permission
- Affected
- >=45.0.0-alpha.1 <45.0.0-alpha.4 · >=44.0.0-alpha.1 <44.1.1 · >=43.0.0-alpha.1 <43.5.1 · <42.11.1
- Fixed in
- 42.11.1, 43.5.1, 44.1.1, 45.0.0-alpha.4
Electron: Frame subscription trusts GPU-supplied frame geometry
- Affected
- <42.11.6 · >=43.0.0-alpha.1 <43.7.3 · >=44.0.0-alpha.1 <44.4.3 · >=45.0.0-alpha.1 <45.0.0-alpha.9
- Fixed in
- 42.11.6, 43.7.3, 44.4.3, 45.0.0-alpha.9
Electron: Off-screen rendering on macOS trusts GPU-supplied frame geometry
- Affected
- <42.11.6 · >=43.0.0-alpha.1 <43.7.3 · >=44.0.0-alpha.1 <44.4.3 · >=45.0.0-alpha.1 <45.0.0-alpha.9
- Fixed in
- 42.11.6, 43.7.3, 44.4.3, 45.0.0-alpha.9
Electron: openExternal permission requests can be attributed to the wrong origin
- Affected
- <42.11.3 · >=43.0.0-alpha.1 <43.7.0 · >=44.0.0-alpha.1 <44.3.0 · >=45.0.0-alpha.1 <45.0.0-alpha.5
- Fixed in
- 42.11.3, 43.7.0, 44.3.0, 45.0.0-alpha.5
Electron: HID and USB permission checks can be attributed to the wrong origin
- Affected
- >=45.0.0-alpha.1 <45.0.0-alpha.5 · >=44.0.0-alpha.1 <44.3.0 · >=43.0.0-alpha.1 <43.7.0 · <42.11.3
- Fixed in
- 42.11.3, 43.7.0, 44.3.0, 45.0.0-alpha.5
Electron drops inherited HTML sandbox restrictions for popups opened through OpenURLFromTab
- Affected
- <41.10.4 · >=42.0.0-alpha.1 <42.5.2 · >=43.0.0-alpha.1 <43.0.0
- Fixed in
- 41.10.4, 42.5.2, 43.0.0
Electron: Windows opened from a sandboxed top-level document do not inherit its sandbox restrictions
- Affected
- <41.10.6 · >=42.0.0-alpha.1 <42.9.2 · >=43.0.0-alpha.1 <43.4.1 · >=44.0.0-alpha.1 <44.0.0-beta.5
- Fixed in
- 41.10.6, 42.9.2, 43.4.1, 44.0.0-beta.5
Electron: File and HTTP protocol handlers allow cross-origin reads without corsEnabled
- Affected
- <41.10.6 · >=42.0.0-alpha.1 <42.9.2 · >=43.0.0-alpha.1 <43.4.1 · >=44.0.0-alpha.1 <44.0.0-beta.5
- Fixed in
- 41.10.6, 42.9.2, 43.4.1, 44.0.0-beta.5
Electron: <webview> can enable Node.js integration in Web Workers despite embedder restrictions
- Affected
- <41.10.6 · >=42.0.0-alpha.1 <42.9.2 · >=43.0.0-alpha.1 <43.4.1 · >=44.0.0-alpha.1 <44.0.0-beta.5
- Fixed in
- 41.10.6, 42.9.2, 43.4.1, 44.0.0-beta.5
Electron: Sandboxed preload code cache can be poisoned by a compromised renderer
- Affected
- >=42.3.3 <42.10.0 · >=43.0.0-beta.1 <43.5.0 · >=44.0.0-alpha.1 <44.0.0-beta.6
- Fixed in
- 42.10.0, 43.5.0, 44.0.0-beta.6
Electron: ProtocolResponse.url reuses the default session cache instead of the registering session
- Affected
- >=43.0.0-alpha.1 <43.0.0 · >=42.0.0-alpha.1 <42.5.1 · >=41.0.0-alpha.1 <41.9.1 · >=40.0.0-alpha.1 <40.10.6
- Fixed in
- 40.10.6, 41.9.1, 42.5.1, 43.0.0
Fixed within 42.3.x, affecting earlier releases
Electron: Buffer performs incorrect byte length calculations resulting in heap buffer under/overflow
- Affected
- >=42.3.1 <42.3.3
- Fixed in
- 42.3.3
Which of your client projects are still on electron 42.3?
NPMscan reads the lockfiles in every GitHub repo you pick, finds the exact electron version each one installs, and checks it against these advisories. Each finding comes with the command that fixes it.
Other electron versions
Advisory data from OSV.dev (opens OSV.dev in a new tab), which includes the GitHub Advisory Database. Release list from the npm registry. Refreshed daily.