Executive brief
Electron is a popular framework used to build desktop applications like Slack, Discord, and VS Code. A vulnerability exists where a background script (service worker) can trick the main application into accepting fake data as a legitimate response from a web page. If the application relies on these responses to make security decisions, an attacker could bypass security controls or manipulate application behavior.
Technical details
This vulnerability is classified as an authentication bypass by spoofing (CWE-290) and insufficient verification of data authenticity (CWE-345). It resides in the internal Inter-Process Communication (IPC) channel used by Electron's executeJavaScript methods. A malicious or compromised service worker can intercept and spoof reply messages, leading the main process to resolve promises with attacker-controlled data instead of the actual execution result. Exploitation requires the application to have service workers registered and to use the return values of executeJavaScript for security-sensitive logic. The issue is addressed in Electron versions 38.8.6, 39.8.1, 40.8.1, and 41.0.0.
Affected products
- ElectronJS Electron < 38.8.6, >= 39.0.0-alpha.1 < 39.8.1, >= 40.0.0-alpha.1 < 40.8.1, >= 41.0.0-alpha.1 < 41.0.0
Timeline
- 2026-04-02: advisory: GitHub Advisory GHSA-xj5x-m3f3-5x3h published
- 2026-04-03: disclosed: CVE-2026-34778 published to NVD
- 2026-04-04: patched: Fixes available in versions 38.8.6, 39.8.1, 40.8.1, and 41.0.0