Executive brief
Electron, a framework used to build desktop applications with web technologies, is vulnerable to HTTP response header injection attacks. Applications using custom protocol handlers or response header modification features may allow attackers to inject malicious headers that could compromise cookies, bypass security policies, or manipulate cross-origin access controls. Only apps that reflect untrusted user input into response headers are affected.
Technical details
This vulnerability is an HTTP response header injection (CWE-113, CWE-74) affecting Electron's custom protocol handler and webRequest APIs. The root cause is insufficient sanitization of CRLF characters in HTTP header values before they are included in outgoing responses. When applications reflect untrusted input into response header names or values via protocol.handle(), protocol.registerSchemesAsPrivileged(), or webRequest.onHeadersReceived callbacks, attackers can inject newline characters to add arbitrary headers. The attack requires user interaction (UI:R) and network access but no privileges. An attacker who can influence a response header value may inject additional headers to manipulate cookies, content security policies, or cross-origin resource sharing rules. Patches are available in versions 38.8.6, 39.8.3, 40.8.3, and 41.0.3. Mitigation involves validating or sanitizing untrusted input before inclusion in response headers.
Affected products
- Electron Electron < 38.8.6; >= 39.0.0-alpha.1, < 39.8.3; >= 40.0.0-alpha.1, < 40.8.3; >= 41.0.0-alpha.1, < 41.0.3
Timeline
- 2026-04-03: disclosed: GHSA-4p4r-m79c-wq3v advisory published
- 2026-04: patched: Fixed in versions 38.8.6, 39.8.3, 40.8.3, 41.0.3