Executive brief
Electron is a popular framework used to build desktop applications like Slack, Discord, and VS Code. A security flaw in how some applications handle configuration settings could allow an attacker to bypass critical security protections, such as the 'sandbox' that keeps the application isolated from the rest of the computer. This could lead to unauthorized access to sensitive data or full control over the user's system if the application processes untrusted configuration data.
Technical details
A vulnerability exists in Electron due to an undocumented 'commandLineSwitches' property within the webPreferences object. When an application constructs this object by spreading untrusted or external configuration data without proper validation, an attacker can inject arbitrary switches into the renderer process command line. This can be used to disable the Chromium sandbox ('--no-sandbox') or other web security features. The attack requires the application to be designed in a way that it accepts and spreads untrusted input into the BrowserWindow or webContents configuration. The issue is addressed in versions 38.8.6, 39.8.0, 40.7.0, and 41.0.0-beta.8.
Affected products
- ElectronJS Electron < 38.8.6, 39.0.0-alpha.1 to < 39.8.0, 40.0.0-alpha.1 to < 40.7.0, 41.0.0-alpha.1 to < 41.0.0-beta.8
Timeline
- 2026-04-02: advisory: GitHub Security Advisory published
- 2026-04-03: disclosed: CVE published to NVD
- 2026-04-04: patched: Patch availability confirmed in advisory