Executive brief
Electron is a popular framework for building cross-platform desktop applications. Applications using Electron's single-instance lock feature on macOS and Linux can be manipulated by local attackers running as the same user to trigger a memory leak exposure. While this requires local access and elevated privileges relative to a standard user, it could lead to information disclosure or service disruption on affected systems.
Technical details
This vulnerability is a CWE-125 out-of-bounds read in Electron's inter-process communication (IPC) layer handling second-instance messages. The flaw occurs when an application calls app.requestSingleInstanceLock() on macOS or Linux and receives a specially crafted second-instance message. An attacker running with the same user privileges can trigger parsing of malformed IPC data, causing the vulnerable code to read beyond the allocated buffer. Leaked heap memory is then delivered to the application's second-instance event handler, potentially exposing sensitive data. The attack vector is local with high complexity; requires low privileges (same user); no user interaction needed; and affects confidentiality (high) and availability (low). Patches are available in Electron versions 38.8.6, 39.8.1, 40.8.1, and 41.0.0.
Affected products
- Electron Electron < 38.8.6; 39.0.0-alpha.1 through < 39.8.1; 40.0.0-alpha.1 through < 40.8.1; 41.0.0-alpha.1 through < 41.0.0
Timeline
- 2026-04-03: disclosed
- 2026-04-03: patched: Fixed in versions 38.8.6, 39.8.1, 40.8.1, and 41.0.0