Is CVE-2026-34780 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-34780 being exploited in the wild.

How severe is CVE-2026-34780?

High severity, with a CVSS score of 8.3, published 4 April 2026.

Which products and versions are affected?

electron (npm) SEMVER:introduced=39.0.0-alpha.1,fixed=39.8.0; Red Hat Build of Podman Desktop 1.

Is there a fix for CVE-2026-34780?

Yes. electron (npm): upgrade to 39.8.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-34780 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-34780?

Check whether you run electron (npm) or Red Hat Build of Podman Desktop at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-34780: Electron context isolation bypass via VideoFrame transfer

CVE-2026-34780 · Severity: high · CVSS 8.3 · Published 2026-04-04

Electron, a popular framework for building desktop applications like Slack and Discord, is vulnerable to a security bypass. If an application handles video data in a specific way, an attacker could potentially break out of the restricted web environment to access sensitive system-level functions. This could lead to full control over the user's application or data if they interact with malicious content.

Technologies: electron (npm), Red Hat Build of Podman Desktop. Vendors: npm, Red Hat.

Quick answers

Is CVE-2026-34780 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-34780 being exploited in the wild.
How severe is CVE-2026-34780?: High severity, with a CVSS score of 8.3, published 4 April 2026.
Which products and versions are affected?: electron (npm) SEMVER:introduced=39.0.0-alpha.1,fixed=39.8.0; Red Hat Build of Podman Desktop 1.
Is there a fix for CVE-2026-34780?: Yes. electron (npm): upgrade to 39.8.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-34780 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-34780?: Check whether you run electron (npm) or Red Hat Build of Podman Desktop at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

electron (npm): upgrade to 39.8.0 or later
```
npm install electron@39.8.0
```

Technical details

A context isolation bypass exists in Electron when VideoFrame objects from the WebCodecs API are passed across the contextBridge. The vulnerability occurs if a preload script returns, resolves, or passes a VideoFrame object to the main world via contextBridge.exposeInMainWorld(). An attacker who can execute JavaScript in the main world (e.g., via XSS) can leverage the bridged VideoFrame to access the isolated world and any Node.js APIs exposed to the preload script. This issue is tracked as CWE-668 and CWE-501. Patches are available in versions 39.8.0, 40.7.0, and 41.0.0-beta.8.

Affected products

ElectronJS Electron >= 39.0.0-alpha.1, < 39.8.0; >= 40.0.0-alpha.1, < 40.7.0; >= 41.0.0-alpha.1, < 41.0.0-beta.8
Red Hat Red Hat Build of Podman Desktop 1

Identifiers

CVE-2026-34780
GHSA-jfqg-hf23-qpw2

Timeline

2026-04-02: advisory: GitHub advisory published by Electron maintainers
2026-04-04: disclosed: CVE published to NVD
2026-04-04: patched: Patched versions released

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.