Executive brief
Electron, a framework used to build desktop applications, contains a security flaw where browser extensions can bypass intended isolation boundaries. A malicious or compromised extension could potentially view or interact with data in other parts of the application that it should not have access to. This risk only applies to applications that load Chrome extensions and attempt to isolate them using separate sessions.
Technical details
A vulnerability in Electron's extension handling allows extension tab and scripting APIs to operate across session boundaries. The root cause is that these APIs were not properly scoped to the extension's own 'session' object. An attacker who successfully loads a malicious extension via 'session.loadExtension' can navigate, script, and read data from windows belonging to entirely different sessions within the same application. This bypasses the security isolation typically provided by Electron sessions. The issue is fixed in versions 39.8.8, 40.9.0, 41.2.1, and 42.0.0-beta.3.
Affected products
- Electron electron < 39.8.8, >= 40.0.0-alpha.1 < 40.9.0, >= 41.0.0-alpha.1 < 41.2.1, >= 42.0.0-alpha.1 < 42.0.0-beta.3
Timeline
- 2026-07-27: disclosed
- 2026-08-05: advisory