Executive brief
Electron is a framework used to build desktop applications like Slack, Discord, and VS Code. A flaw in how it handles custom network protocols could allow data from one user session to be accidentally shared with or reused by another session. This could lead to a breach of privacy or data isolation in applications that rely on separate sessions to keep user data partitioned.
Technical details
A vulnerability exists in Electron's custom protocol handling mechanism (CWE-668). When a custom protocol handler returns a ProtocolResponse containing a 'url' but omits the 'session' property, Electron incorrectly defaults to using the 'defaultSession' for the upstream request. This behavior allows cached responses to be shared across session partitions that were intended to be isolated. Attackers could potentially exploit this to access sensitive cached data from a different session context. The issue is fixed in versions 43.0.0, 42.5.1, 41.9.1, and 40.10.6. Developers can work around this by explicitly setting the 'session' property in ProtocolResponse.
Affected products
- Electron electron >= 43.0.0-alpha.1, < 43.0.0; >= 42.0.0-alpha.1, < 42.5.1; >= 41.0.0-alpha.1, < 41.9.1; >= 40.0.0-alpha.1, < 40.10.6
Timeline
- 2026-07-27: disclosed
- 2026-08-05: advisory: GitHub Advisory published
- 2026-08-05: patched