Technology · npm
electron (npm) vulnerabilities
Updated . Rebuilt every hour.
Junglewise Threat Intelligence has tracked 77 vulnerabilities in electron (npm): 0 in the last 7 days and 14 in the last 90 days, 4 of them critical and 3 exploited in the wild. The most recent, CVE-2026-115570, was published on 23 October 2026. 9 vulnerabilities in the last four weeks, up 80% on the four before (5).
- Last 7 days
- 0
- Last 90 days
- 14
- Critical, all time
- 4
- Exploited in the wild
- 3
About electron (npm)
Electron is a framework for building desktop applications using JavaScript, HTML, and CSS.
Latest electron (npm) vulnerabilities
- CVE-2026-115570: Electron certificate blocklist bypass in Node.js TLShighCVSS 7.4
- CVE-2026-114124: Electron: Off-screen rendering on macOS trusts GPU-supplied frame geometrylowCVSS 3.9EPSS 0.1%
- CVE-2026-114122: Electron: Frame subscription trusts GPU-supplied frame geometrylowCVSS 3.9EPSS 0.1%
- CVE-2026-114121: Electron external protocol permission misattributionmediumCVSS 5.4EPSS 0.2%
- CVE-2026-113800: Electron HID/USB permission checks origin spoofing in iframesmediumCVSS 5.4
- CVE-2026-113798: Electron pointer lock permission bypass in cross-origin iframesmediumCVSS 5.4EPSS 0.2%
- CVE-2026-113797: Electron: Extension tabs.query returns tab URLs and titles without the tabs permissionlowCVSS 3.1EPSS 0.5%
- CVE-2026-113796: Electron SameSite cookie bypass in cross-site navigationmediumCVSS 4.2EPSS 0.2%
- CVE-2026-102672: Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.10…mediumCVSS 6.7EPSS 0.1%
- CVE-2026-102677: Electron preload code cache privilege escalationhighCVSS 7.8
- CVE-2026-102676: Electron webview privilege escalation in Web WorkershighCVSS 8.3
- CVE-2026-102675: Electron protocol handlers cross-origin read bypasshighCVSS 7.4
- CVE-2026-102674: Electron sandbox escape via popup windows in top-level documenthighCVSS 8.2
- CVE-2026-102673: Electron sandbox inheritance bypass for popups from iframeshighCVSS 8.2
- CVE-2026-70612: Electron sandbox bypass via external protocol handlers in iframesmediumCVSS 5.4EPSS 0.4%
- CVE-2026-70611: Electron command injection in DevTools reveal in file managermediumCVSS 6.9EPSS 0.2%
- CVE-2026-70610: Electron prototype pollution in contextBridge object copyingmediumCVSS 5.4EPSS 0.6%
- CVE-2026-70609: Electron JavaScript injection in DevTools via unsanitized dock statemediumCVSS 5.7EPSS 0.5%
- CVE-2026-70608: Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.10…highCVSS 7.2EPSS 0.4%
- CVE-2026-70607: Electron improper input validation in window.open features stringmediumCVSS 5.3EPSS 0.6%
- CVE-2026-70606: Electron cache isolation bypass in ProtocolResponsemediumCVSS 5.9EPSS 0.3%
- CVE-2026-70605: Electron SSRF and local file disclosure via HTTP redirectmediumCVSS 5.9EPSS 0.3%
- CVE-2026-70604: Electron cross-origin read in custom protocol handlershighCVSS 7.4EPSS 0.4%
- CVE-2026-70603: Electron shell.openPath path validation bypass via embedded null bytemediumCVSS 6EPSS 0.1%
- CVE-2026-70602: Electron session isolation bypass in extension tab and scripting APIsmediumCVSS 6.6EPSS 0.3%
Most severe electron (npm) vulnerabilities
Exploited in the wild first, then by severity and CVSS score.
- CVE-2023-4863: RUSTSEC-2023-0060 - libwebp: OOB write in BuildHuffmanTablecriticalexploited in the wildCVSS 3.1EPSS 100.0%
- CVE-2023-5217: Electron heap buffer overflow in libvpx vp8 encodingcriticalexploited in the wildCVSS 3.1EPSS 49.0%
- CVE-2022-4135: Google Chrome heap buffer overflow in GPUcriticalexploited in the wildCVSS 3.1EPSS 31.9%
- CVE-2026-54257: Electron heap buffer overflow in Node.js Buffer APIcriticalCVSS 4EPSS 0.4%
- CVE-2026-34780: Electron context isolation bypass via VideoFrame transferhighCVSS 8.3EPSS 0.4%
- CVE-2026-102676: Electron webview privilege escalation in Web WorkershighCVSS 8.3
- CVE-2026-102674: Electron sandbox escape via popup windows in top-level documenthighCVSS 8.2
- CVE-2026-102673: Electron sandbox inheritance bypass for popups from iframeshighCVSS 8.2
- CVE-2026-34774: Electron use-after-free in offscreen child window paint callbackhighCVSS 8.1EPSS 0.5%
- CVE-2026-102677: Electron preload code cache privilege escalationhighCVSS 7.8
Vulnerabilities per week
9 vulnerabilities in the last four weeks, up 80% on the four before (5). The last 13 weeks, by the week each vulnerability was published.
| Week of | Bar | Vulns | Critical |
|---|---|---|---|
| 17 Aug 2026 | 0 | 0 | |
| 24 Aug 2026 | 0 | 0 | |
| 31 Aug 2026 | 0 | 0 | |
| 7 Sep 2026 | 0 | 0 | |
| 14 Sep 2026 | 0 | 0 | |
| 21 Sep 2026 | 0 | 0 | |
| 28 Sep 2026 | 5 | 0 | |
| 5 Oct 2026 | 0 | 0 | |
| 12 Oct 2026 | 1 | 0 | |
| 19 Oct 2026 | 8 | 0 | |
| 26 Oct 2026 | 0 | 0 | |
| 2 Nov 2026 | 0 | 0 | |
| 9 Nov 2026 | 0 | 0 |
Embed a badge
A live badge for a README, a status page or an internal wiki: how many electron (npm) vulnerabilities were published in the last 7 days and how many of them are critical, refreshed hourly.
[](https://junglewise.ai/threats/technologies/electron)<a href="https://junglewise.ai/threats/technologies/electron"><img src="https://junglewise.ai/threats/technologies/electron/badge.svg" alt="electron (npm) vulnerabilities" /></a>How this is built
Junglewise Threat Intelligence collects vulnerabilities from NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories, and matches each one to the technologies and vendors it affects. Dates are the date a vulnerability was published, in UTC.
The pages are rebuilt from the database every hour. Frozen weekly and monthly reports never change once published, so they can be cited.
Use this data
The same data is at https://junglewise.ai/threats/technologies/electron.json, and this page as text at https://junglewise.ai/threats/technologies/electron.md, for scripts and language models. It is free to reuse under CC BY 4.0 with a link back to this page.
Cite as: Junglewise Threat Intelligence, "electron (npm) vulnerabilities", https://junglewise.ai/threats/technologies/electron, 13 November 2026.