Electron: Context Isolation bypass via contextBridge VideoFrame transfer
Published 3 Apr 2026 · Updated 6 Apr 2026
Affected packages
- Affected
- >=39.0.0-alpha.1 <39.8.0
- Fixed in
- 39.8.0
npm install electron@39.8.0- Affected
- >=40.0.0-alpha.1 <40.7.0
- Fixed in
- 40.7.0
npm install electron@40.7.0- Affected
- >=41.0.0-alpha.1 <41.0.0-beta.8
- Fixed in
- 41.0.0-beta.8
npm install electron@41.0.0-beta.8Details
Impact
Apps that pass VideoFrame objects (from the WebCodecs API) across the contextBridge are vulnerable to a context isolation bypass. An attacker who can execute JavaScript in the main world (for example, via XSS) can use a bridged VideoFrame to gain access to the isolated world, including any Node.js APIs exposed to the preload script.
Apps are only affected if a preload script returns, resolves, or passes a VideoFrame object to the main world via contextBridge.exposeInMainWorld(). Apps that do not bridge VideoFrame objects are not affected.
Workarounds
Do not pass VideoFrame objects across contextBridge. If an app needs to transfer video frame data, serialize it to an ArrayBuffer or ImageBitmap before bridging.
Fixed Versions
41.0.0-beta.840.7.039.8.0
For more information
If there are any questions or comments about this advisory, please email [security@electronjs.org](mailto:security@electronjs.org)
Is GHSA-jfqg-hf23-qpw2 in any of your client repos?
Checking one package by hand is fine. Checking it across forty client projects is not. NPMscan reads the lockfiles in every GitHub repo you pick, finds each project with an affected electron, and gives you the command that fixes it.
References
Advisory data from OSV.dev (opens OSV.dev in a new tab), refreshed daily.