Is CVE-2026-34765 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-34765 being exploited in the wild.

How severe is CVE-2026-34765?

Medium severity, with a CVSS score of 6, published 7 April 2026.

Which products and versions are affected?

electron (npm) SEMVER:introduced=0,fixed=39.8.5.

Is there a fix for CVE-2026-34765?

Yes. electron (npm): upgrade to 39.8.5 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-34765 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-34765?

Check whether you run electron (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-34765: Electron incorrect window scoping in window.open

CVE-2026-34765 · Severity: medium · CVSS 6 · Published 2026-04-07

Electron is a popular framework used to build desktop applications like Slack, Discord, and VS Code. A security flaw allowed different parts of an application to incorrectly access windows opened by other parts of the app if they shared the same name. In specific configurations, this could allow less-trusted content to hijack a window with higher privileges, potentially leading to unauthorized data access or, in extreme cases, full control over the user's computer.

Technologies: electron (npm). Vendors: npm.

Quick answers

Is CVE-2026-34765 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-34765 being exploited in the wild.
How severe is CVE-2026-34765?: Medium severity, with a CVSS score of 6, published 7 April 2026.
Which products and versions are affected?: electron (npm) SEMVER:introduced=0,fixed=39.8.5.
Is there a fix for CVE-2026-34765?: Yes. electron (npm): upgrade to 39.8.5 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-34765 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-34765?: Check whether you run electron (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

electron (npm): upgrade to 39.8.5 or later
```
npm install electron@39.8.5
```

Technical details

A vulnerability in Electron's window management arises because window.open() lookups for named targets were not correctly scoped to the opener's browsing context group. An attacker-controlled renderer can navigate a child window created by a different, unrelated renderer by using a matching target name. If the target child window was configured with elevated webPreferences (such as privileged preload scripts or disabled sandboxing) via setWindowOpenHandler, the newly navigated content inherits these elevated permissions. This can lead to privilege escalation or arbitrary code execution if nodeIntegration is enabled or the sandbox is disabled. The issue is fixed in versions 39.8.5, 40.8.5, 41.1.0, and 42.0.0-alpha.5.

Affected products

ElectronJS Electron < 39.8.5, 40.x < 40.8.5, 41.x < 41.1.0, 42.0.0-alpha.1 < 42.0.0-alpha.5

Identifiers

CVE-2026-34765
GHSA-f3pv-wv63-48x8

Timeline

2026-04-06: advisory: GitHub Advisory GHSA-f3pv-wv63-48x8 published
2026-04-07: disclosed: CVE-2026-34765 published

References

https://github.com/electron/electron/security/advisories/GHSA-f3pv-wv63-48x8

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.