Executive brief
Electron, a popular framework used to build desktop applications like Slack and Discord, contains a security flaw in how it handles user permissions for features like fullscreen mode or keyboard access. If an application is designed to process these requests slowly (asynchronously), an attacker could potentially cause the application to crash or corrupt its memory by closing a window or navigating away at a specific moment. This could lead to unpredictable behavior or allow for further malicious activity on the user's computer.
Technical details
A use-after-free vulnerability exists in Electron's WebContents permission handling. The flaw occurs when an application registers an asynchronous 'session.setPermissionRequestHandler()' for fullscreen, pointer-lock, or keyboard-lock requests. If the requesting frame navigates or the window closes while the permission handler is still pending, the subsequent invocation of the stored callback dereferences memory that has already been freed. This race condition can result in memory corruption or a process crash. The vulnerability requires the application to use an asynchronous handler; synchronous handlers are not affected. Patches are available in versions 38.8.6, 39.8.0, 40.7.0, and 41.0.0-beta.8.
Affected products
- ElectronJS Electron < 38.8.6, 39.0.0-alpha.1 to < 39.8.0, 40.0.0-alpha.1 to < 40.7.0, 41.0.0-alpha.1 to < 41.0.0-beta.8
- Red Hat Red Hat Build of Podman Desktop 1
Timeline
- 2026-04-02: advisory: GitHub Security Advisory published by Electron team
- 2026-04-04: disclosed: CVE published to NVD
- 2026-04-04: patched: Fixes released in multiple Electron branches