Electron: ProtocolResponse.url reuses the default session cache instead of the registering session
Published 5 Aug 2026 · Updated 5 Aug 2026
Affected packages
- Affected
- >=43.0.0-alpha.1 <43.0.0
- Fixed in
- 43.0.0
npm install electron@43.0.0- Affected
- >=42.0.0-alpha.1 <42.5.1
- Fixed in
- 42.5.1
npm install electron@42.5.1- Affected
- >=41.0.0-alpha.1 <41.9.1
- Fixed in
- 41.9.1
npm install electron@41.9.1- Affected
- >=40.0.0-alpha.1 <40.10.6
- Fixed in
- 40.10.6
npm install electron@40.10.6Details
Impact
When a custom protocol handler returned a ProtocolResponse with a url and no session, Electron made the upstream request through defaultSession instead of the session that handled the protocol. A cached response could then be reused across otherwise isolated session partitions.
Apps that use ProtocolResponse.url, omit ProtocolResponse.session, and rely on separate sessions to isolate content are affected. Apps that set an explicit session, or that do not isolate content across sessions, are not affected.
Workarounds
Set ProtocolResponse.session explicitly so the request uses the intended session's cache.
Fixed Versions
43.0.042.5.141.9.140.10.6
For more information
If you have any questions or comments about this advisory, email Electron at [security@electronjs.org](mailto:security@electronjs.org)
Is GHSA-r4w5-6pfg-jxp5 in any of your client repos?
Checking one package by hand is fine. Checking it across forty client projects is not. NPMscan reads the lockfiles in every GitHub repo you pick, finds each project with an affected electron, and gives you the command that fixes it.
References
Advisory data from OSV.dev (opens OSV.dev in a new tab), refreshed daily.