MediumGHSA-9w97-2464-8783CVE-2026-34772

Electron: Use-after-free in download save dialog callback

Published 3 Apr 2026 · Updated 6 Apr 2026

Affected packages

electronnpm
Affected
<38.8.6
Fixed in
38.8.6
Update to the fixed version for your release line, for example:npm install electron@38.8.6
electronnpm
Affected
>=39.0.0-alpha.1 <39.8.0
Fixed in
39.8.0
Update to the fixed version for your release line, for example:npm install electron@39.8.0
electronnpm
Affected
>=40.0.0-alpha.1 <40.7.0
Fixed in
40.7.0
Update to the fixed version for your release line, for example:npm install electron@40.7.0
electronnpm
Affected
>=41.0.0-alpha.1 <41.0.0-beta.7
Fixed in
41.0.0-beta.7
Update to the fixed version for your release line, for example:npm install electron@41.0.0-beta.7

Details

Impact

Apps that allow downloads and programmatically destroy sessions may be vulnerable to a use-after-free. If a session is torn down while a native save-file dialog is open for a download, dismissing the dialog dereferences freed memory, which may lead to a crash or memory corruption.

Apps that do not destroy sessions at runtime, or that do not permit downloads, are not affected.

Workarounds

Avoid destroying sessions while a download save dialog may be open. Cancel pending downloads before session teardown.

Fixed Versions

  • 41.0.0-beta.7
  • 40.7.0
  • 39.8.0
  • 38.8.6

For more information

If there are any questions or comments about this advisory, please email [security@electronjs.org](mailto:security@electronjs.org)

Is GHSA-9w97-2464-8783 in any of your client repos?

Checking one package by hand is fine. Checking it across forty client projects is not. NPMscan reads the lockfiles in every GitHub repo you pick, finds each project with an affected electron, and gives you the command that fixes it.

Scan a project free, no signupOr connect GitHub to scan every repo

References

Advisory data from OSV.dev (opens OSV.dev in a new tab), refreshed daily.