Electron: Use-after-free in offscreen shared texture release() callback
Published 3 Apr 2026 · Updated 6 Apr 2026
Affected packages
- Affected
- >=33.0.0-alpha.1 <39.8.5
- Fixed in
- 39.8.5
npm install electron@39.8.5- Affected
- >=40.0.0-alpha.1 <40.8.5
- Fixed in
- 40.8.5
npm install electron@40.8.5- Affected
- >=41.0.0-alpha.1 <41.1.0
- Fixed in
- 41.1.0
npm install electron@41.1.0- Affected
- >=42.0.0-alpha.1 <42.0.0-alpha.5
- Fixed in
- 42.0.0-alpha.5
npm install electron@42.0.0-alpha.5Details
Impact
Apps that use offscreen rendering with GPU shared textures may be vulnerable to a use-after-free. Under certain conditions, the release() callback provided on a paint event texture can outlive its backing native state, and invoking it after that point dereferences freed memory in the main process, which may lead to a crash or memory corruption.
Apps are only affected if they use offscreen rendering with webPreferences.offscreen: { useSharedTexture: true }. Apps that do not enable shared-texture offscreen rendering are not affected.
Workarounds
Ensure texture.release() is called promptly after the texture has been consumed, before the texture object becomes unreachable.
Fixed Versions
42.0.0-alpha.541.1.040.8.539.8.5
For more information
If there are any questions or comments about this advisory, send an email to [security@electronjs.org](mailto:security@electronjs.org)
Is GHSA-8x5q-pvf5-64mp in any of your client repos?
Checking one package by hand is fine. Checking it across forty client projects is not. NPMscan reads the lockfiles in every GitHub repo you pick, finds each project with an affected electron, and gives you the command that fixes it.
References
Advisory data from OSV.dev (opens OSV.dev in a new tab), refreshed daily.