CVE-2026-34778: Electron spoofing vulnerability in executeJavaScript IPC channel

CVE-2026-34778 · Severity: medium · CVSS 5.9 · Published 2026-04-04

Electron is a popular framework used to build desktop applications like Slack, Discord, and VS Code. A vulnerability exists where a background script (service worker) can trick the main application into accepting fake data as a legitimate response from a web page. If the application relies on these responses to make security decisions, an attacker could bypass security controls or manipulate application behavior.

Technologies: electron (npm). Vendors: npm.

Quick answers

Is CVE-2026-34778 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-34778 being exploited in the wild.
How severe is CVE-2026-34778?
Medium severity, with a CVSS score of 5.9, published 4 April 2026.
Which products and versions are affected?
electron (npm) SEMVER:introduced=0,fixed=38.8.6.
Is there a fix for CVE-2026-34778?
Yes. electron (npm): upgrade to 38.8.6 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-34778 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-34778?
Check whether you run electron (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • electron (npm): upgrade to 38.8.6 or later
    npm install electron@38.8.6

Technical details

This vulnerability is classified as an authentication bypass by spoofing (CWE-290) and insufficient verification of data authenticity (CWE-345). It resides in the internal Inter-Process Communication (IPC) channel used by Electron's executeJavaScript methods. A malicious or compromised service worker can intercept and spoof reply messages, leading the main process to resolve promises with attacker-controlled data instead of the actual execution result. Exploitation requires the application to have service workers registered and to use the return values of executeJavaScript for security-sensitive logic. The issue is addressed in Electron versions 38.8.6, 39.8.1, 40.8.1, and 41.0.0.

Affected products

  • ElectronJS Electron < 38.8.6, >= 39.0.0-alpha.1 < 39.8.1, >= 40.0.0-alpha.1 < 40.8.1, >= 41.0.0-alpha.1 < 41.0.0

Identifiers

  • CVE-2026-34778
  • GHSA-xj5x-m3f3-5x3h

Timeline

  • 2026-04-02: advisory: GitHub Advisory GHSA-xj5x-m3f3-5x3h published
  • 2026-04-03: disclosed: CVE-2026-34778 published to NVD
  • 2026-04-04: patched: Fixes available in versions 38.8.6, 39.8.1, 40.8.1, and 41.0.0

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.