Executive brief
Electron is a popular framework used to build desktop applications like Slack, Discord, and VS Code. A flaw has been identified where applications that allow file downloads and programmatically close user sessions may crash or suffer from memory corruption. This occurs if a session is closed while a user still has a 'Save File' window open, potentially allowing for unauthorized data access or application instability.
Technical details
A use-after-free vulnerability (CWE-416) exists in Electron's session management and download handling. The root cause is a race condition where a session is programmatically destroyed while a native save-file dialog remains active; dismissing this dialog subsequently triggers a dereference of the already-freed session memory. Exploitation requires local access and specific user interaction (dismissing the dialog) under high-complexity conditions. Successful exploitation can lead to memory corruption, application crashes, or potential information disclosure. The issue is patched in versions 38.8.6, 39.8.0, 40.7.0, and 41.0.0-beta.8.
Affected products
- ElectronJS Electron < 38.8.6, >= 39.0.0-alpha.1 < 39.8.0, >= 40.0.0-alpha.1 < 40.7.0, >= 41.0.0-alpha.1 < 41.0.0-beta.8
Timeline
- 2026-04-02: advisory: GitHub Advisory GHSA-9w97-2464-8783 published
- 2026-04-04: disclosed: NVD publication date
- 2026-04-02: patched: Fixes released in multiple branches