Is CVE-2026-34774 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-34774 being exploited in the wild.

How severe is CVE-2026-34774?

High severity, with a CVSS score of 8.1, published 4 April 2026.

Which products and versions are affected?

electron (npm) SEMVER:introduced=0,fixed=39.8.1.

Is there a fix for CVE-2026-34774?

Yes. electron (npm): upgrade to 39.8.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-34774 attacked?

It is attacked over the network.

Am I affected by CVE-2026-34774?

Check whether you run electron (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-34774: Electron use-after-free in offscreen child window paint callback

CVE-2026-34774 · Severity: high · CVSS 8.1 · Published 2026-04-04

Electron is a widely-used framework for building desktop applications with web technologies. A use-after-free vulnerability affects applications that use offscreen rendering and permit child windows to be opened. If a parent application window is destroyed while child windows remain open, subsequent paint operations can access freed memory, leading to crashes or potential memory corruption. Affected applications must use the specific offscreen rendering feature and allow child window creation to be vulnerable.

Technologies: electron (npm). Vendors: npm.

Quick answers

Is CVE-2026-34774 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-34774 being exploited in the wild.
How severe is CVE-2026-34774?: High severity, with a CVSS score of 8.1, published 4 April 2026.
Which products and versions are affected?: electron (npm) SEMVER:introduced=0,fixed=39.8.1.
Is there a fix for CVE-2026-34774?: Yes. electron (npm): upgrade to 39.8.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-34774 attacked?: It is attacked over the network.
Am I affected by CVE-2026-34774?: Check whether you run electron (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

electron (npm): upgrade to 39.8.1 or later
```
npm install electron@39.8.1
```

Technical details

This vulnerability is a use-after-free (CWE-416) in Electron's offscreen rendering subsystem. The root cause is improper lifecycle management of WebContents memory when parent offscreen renderers are destroyed while child windows remain open. Paint callback operations on the child window subsequently dereference memory that has been freed, potentially causing a crash or memory corruption. The vulnerability requires specific preconditions: applications must have webPreferences.offscreen set to true and their setWindowOpenHandler must permit child window creation. Network-reachable attack is possible but has high complexity. Patches are available in versions 39.8.1, 40.7.0, and 41.0.0.

Affected products

Electron Electron All versions before 39.8.1, versions 40.0.0-alpha.1 to 40.6.x, versions 41.0.0-alpha.1 to 40.9.x

Identifiers

CVE-2026-34774
GHSA-532v-xpq5-8h95

Timeline

2026-04-03: disclosed: Advisory published
2026-04-03: patched: Patches released in versions 39.8.1, 40.7.0, and 41.0.0

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.