Executive brief
Electron is a framework used to build desktop applications using web technologies. A vulnerability in its off-screen rendering mode could allow a compromised sub-process to access sensitive information from the main application's memory or cause the application to crash. This issue only affects applications specifically configured to use off-screen rendering and requires an attacker to have already compromised the GPU process.
Technical details
An out-of-bounds read vulnerability (CWE-125) exists in Electron's off-screen rendering (OSR) implementation. The main process fails to fully validate frame geometry and data received from the GPU process against the actual size of the shared-memory mapping. An attacker who has already achieved code execution within the GPU process can provide malicious geometry data, forcing the main process to read beyond buffer boundaries during 'paint' event image production. This can lead to the disclosure of sensitive memory contents or an application crash. The vulnerability is fixed in versions 39.8.10, 40.9.0, 41.2.1, and 42.0.0-beta.3.
Affected products
- Electron Electron < 39.8.10, >= 40.0.0-alpha.1, < 40.9.0, >= 41.0.0-alpha.1, < 41.2.1, >= 42.0.0-alpha.1, < 42.0.0-beta.3
Timeline
- 2026-07-27: disclosed
- 2026-08-05: advisory
- 2026-08-05: patched