# CVE-2026-102676: Electron webview privilege escalation in Web Workers

Source: https://junglewise.ai/threats/cve-2026-102676-electron-is-a-framework-for-writing-cross-platform-desktop  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-29. Updated: 2026-09-29  
License: CC BY 4.0 with a link back

CVE-2026-102676 · Severity: high · CVSS 8.3 · Published 2026-09-29

Electron is a framework for building cross-platform desktop applications using web technologies. A flaw in Electron's webview component allows untrusted content running in Web Workers to gain Node.js integration privileges even when the host application explicitly disabled them. An attacker could exploit this to execute arbitrary code with full system access on affected systems if the application loads untrusted content in a webview.

Technologies: [Electron](https://junglewise.ai/threats/technologies/electron-electron), [GitHub Electron](https://junglewise.ai/threats/technologies/github-electron), [electron (npm)](https://junglewise.ai/threats/technologies/electron). Vendors: [Electron](https://junglewise.ai/threats/vendors/electron), [GitHub](https://junglewise.ai/threats/vendors/github), [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2026-102676 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-102676 being exploited in the wild.

**How severe is CVE-2026-102676?** High severity, with a CVSS score of 8.3, published 29 September 2026.

**Which products and versions are affected?** Electron Before 41.10.6, 42.9.2, 43.4.1, and 44.0.0-beta.5; GitHub Electron < 41.10.6; >= 42.0.0-alpha.1 and < 42.9.2; >= 43.0.0-alpha.1 and < 43.4.1; >= 44.0.0-alpha.1 and < 44.0.0-beta.5; electron (npm) SEMVER:introduced=0,fixed=41.10.6.

**Is there a fix for CVE-2026-102676?** Yes. electron (npm): upgrade to 41.10.6 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-102676 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-102676?** Check whether you run Electron, GitHub Electron or electron (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- electron (npm): upgrade to 41.10.6 or later

  ```sh
  npm install electron@41.10.6
  ```


## Technical details

The vulnerability exists in the webview sandboxing mechanism where nodeIntegrationInWorker can be enabled in guest preferences despite the embedder having Node.js integration disabled, violating the intended privilege boundary. This affects only unsandboxed embedders that enable the webview tag. An attacker with control over webview content can spawn Web Workers with full Node.js access, bypassing sandbox restrictions. Patches are available in versions 41.10.6, 42.9.2, 43.4.1, and 44.0.0-beta.5 or later.

## Affected products

- GitHub Electron < 41.10.6; >= 42.0.0-alpha.1 and < 42.9.2; >= 43.0.0-alpha.1 and < 43.4.1; >= 44.0.0-alpha.1 and < 44.0.0-beta.5

## Identifiers

- CVE-2026-102676
- GHSA-9qh4-3jw8-366w

## Timeline

- 2026-08-29: disclosed
- 2026-08-29: patched

## References

- [https://api.github.com/users/XlabAITeam](https://api.github.com/users/XlabAITeam)

## Related threats

- [Electron certificate blocklist bypass in Node.js TLS](https://junglewise.ai/threats/cve-2026-115570-electron-is-a-framework-for-writing-cross-platform-desktop)
- [Electron: Off-screen rendering on macOS trusts GPU-supplied frame geometry](https://junglewise.ai/threats/cve-2026-114124-electron-is-a-framework-for-writing-cross-platform-desktop)
- [Electron: Frame subscription trusts GPU-supplied frame geometry](https://junglewise.ai/threats/cve-2026-114122-electron-is-a-framework-for-writing-cross-platform-desktop)
- [Electron external protocol permission misattribution](https://junglewise.ai/threats/cve-2026-114121-electron-is-a-framework-for-writing-cross-platform-desktop)
- [Electron HID/USB permission checks origin spoofing in iframes](https://junglewise.ai/threats/cve-2026-113800-electron-hid-and-usb-permission-checks-can-be-attributed-to-the)