# CVE-2026-34772: Electron use-after-free in download save dialog callback

Source: https://junglewise.ai/threats/cve-2026-34772-electron-use-after-free-in-download-save-dialog-callback  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-04-04. Updated: 2026-07-25  
License: CC BY 4.0 with a link back

CVE-2026-34772 · Severity: medium · CVSS 5.8 · Published 2026-04-04

Electron is a popular framework used to build desktop applications like Slack, Discord, and VS Code. A flaw has been identified where applications that allow file downloads and programmatically close user sessions may crash or suffer from memory corruption. This occurs if a session is closed while a user still has a 'Save File' window open, potentially allowing for unauthorized data access or application instability.

Technologies: [electron (npm)](https://junglewise.ai/threats/technologies/electron). Vendors: [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2026-34772 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-34772 being exploited in the wild.

**How severe is CVE-2026-34772?** Medium severity, with a CVSS score of 5.8, published 4 April 2026.

**Which products and versions are affected?** electron (npm) SEMVER:introduced=0,fixed=38.8.6.

**Is there a fix for CVE-2026-34772?** Yes. electron (npm): upgrade to 38.8.6 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-34772 attacked?** It is attacked with local access, in a software library.

**Am I affected by CVE-2026-34772?** Check whether you run electron (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- electron (npm): upgrade to 38.8.6 or later

  ```sh
  npm install electron@38.8.6
  ```


## Technical details

A use-after-free vulnerability (CWE-416) exists in Electron's session management and download handling. The root cause is a race condition where a session is programmatically destroyed while a native save-file dialog remains active; dismissing this dialog subsequently triggers a dereference of the already-freed session memory. Exploitation requires local access and specific user interaction (dismissing the dialog) under high-complexity conditions. Successful exploitation can lead to memory corruption, application crashes, or potential information disclosure. The issue is patched in versions 38.8.6, 39.8.0, 40.7.0, and 41.0.0-beta.8.

## Affected products

- ElectronJS Electron < 38.8.6, >= 39.0.0-alpha.1 < 39.8.0, >= 40.0.0-alpha.1 < 40.7.0, >= 41.0.0-alpha.1 < 41.0.0-beta.8

## Identifiers

- CVE-2026-34772
- GHSA-9w97-2464-8783

## Timeline

- 2026-04-02: advisory: GitHub Advisory GHSA-9w97-2464-8783 published
- 2026-04-04: disclosed: NVD publication date
- 2026-04-02: patched: Fixes released in multiple branches

## References

- [https://github.com/electron/electron/security/advisories/GHSA-9w97-2464-8783](https://github.com/electron/electron/security/advisories/GHSA-9w97-2464-8783)

## Related threats

- [Electron certificate blocklist bypass in Node.js TLS](https://junglewise.ai/threats/cve-2026-115570-electron-is-a-framework-for-writing-cross-platform-desktop)
- [Electron: Off-screen rendering on macOS trusts GPU-supplied frame geometry](https://junglewise.ai/threats/cve-2026-114124-electron-is-a-framework-for-writing-cross-platform-desktop)
- [Electron: Frame subscription trusts GPU-supplied frame geometry](https://junglewise.ai/threats/cve-2026-114122-electron-is-a-framework-for-writing-cross-platform-desktop)
- [Electron external protocol permission misattribution](https://junglewise.ai/threats/cve-2026-114121-electron-is-a-framework-for-writing-cross-platform-desktop)
- [Electron HID/USB permission checks origin spoofing in iframes](https://junglewise.ai/threats/cve-2026-113800-electron-hid-and-usb-permission-checks-can-be-attributed-to-the)