Technology · Electron
Electron vulnerabilities
Updated . Rebuilt every hour.
Junglewise Threat Intelligence has tracked 39 vulnerabilities in Electron: 0 in the last 7 days and 9 in the last 90 days, 0 of them critical and 0 exploited in the wild. The most recent, CVE-2026-115570, was published on 23 October 2026. 5 vulnerabilities in the last four weeks, up 25% on the four before (4).
- Last 7 days
- 0
- Last 90 days
- 9
- Critical, all time
- 0
- Exploited in the wild
- 0
Latest Electron vulnerabilities
- CVE-2026-115570: Electron certificate blocklist bypass in Node.js TLShighCVSS 7.4
- CVE-2026-114121: Electron external protocol permission misattributionmediumCVSS 5.4EPSS 0.2%
- CVE-2026-113800: Electron HID/USB permission checks origin spoofing in iframesmediumCVSS 5.4
- CVE-2026-113798: Electron pointer lock permission bypass in cross-origin iframesmediumCVSS 5.4EPSS 0.2%
- CVE-2026-113796: Electron SameSite cookie bypass in cross-site navigationmediumCVSS 4.2EPSS 0.2%
- CVE-2026-102676: Electron webview privilege escalation in Web WorkershighCVSS 8.3
- CVE-2026-102675: Electron protocol handlers cross-origin read bypasshighCVSS 7.4
- CVE-2026-102674: Electron sandbox escape via popup windows in top-level documenthighCVSS 8.2
- CVE-2026-102673: Electron sandbox inheritance bypass for popups from iframeshighCVSS 8.2
- CVE-2026-70612: Electron sandbox bypass via external protocol handlers in iframesmediumCVSS 5.4EPSS 0.4%
- CVE-2026-70611: Electron command injection in DevTools reveal in file managermediumCVSS 6.9EPSS 0.2%
- CVE-2026-70610: Electron prototype pollution in contextBridge object copyingmediumCVSS 5.4EPSS 0.6%
- CVE-2026-70609: Electron JavaScript injection in DevTools via unsanitized dock statemediumCVSS 5.7EPSS 0.5%
- CVE-2026-70608: Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.10…highCVSS 7.2EPSS 0.4%
- CVE-2026-70607: Electron improper input validation in window.open features stringmediumCVSS 5.3EPSS 0.6%
- CVE-2026-70606: Electron cache isolation bypass in ProtocolResponsemediumCVSS 5.9EPSS 0.3%
- CVE-2026-70605: Electron SSRF and local file disclosure via HTTP redirectmediumCVSS 5.9EPSS 0.3%
- CVE-2026-70604: Electron cross-origin read in custom protocol handlershighCVSS 7.4EPSS 0.4%
- CVE-2026-70603: Electron shell.openPath path validation bypass via embedded null bytemediumCVSS 6EPSS 0.1%
- CVE-2026-70602: Electron session isolation bypass in extension tab and scripting APIsmediumCVSS 6.6EPSS 0.3%
- CVE-2026-70601: Electron context isolation bypass via Function.prototype.bind hijackhighCVSS 7.5EPSS 0.3%
- CVE-2026-70600: Electron UI layer restriction bypass in native autofill popuplowCVSS 3.1EPSS 0.2%
- CVE-2026-70599: Electron origin validation error in permission check handlermediumCVSS 5.9EPSS 0.2%
- CVE-2026-70598: Electron out-of-bounds read in off-screen renderinglowCVSS 3.9EPSS 0.1%
- CVE-2026-70597: Electron code-signing bypass in macOS parent process validationmediumCVSS 6.3EPSS 0.1%
Most severe Electron vulnerabilities
Exploited in the wild first, then by severity and CVSS score.
- CVE-2026-102676: Electron webview privilege escalation in Web WorkershighCVSS 8.3
- CVE-2026-102674: Electron sandbox escape via popup windows in top-level documenthighCVSS 8.2
- CVE-2026-102673: Electron sandbox inheritance bypass for popups from iframeshighCVSS 8.2
- CVE-2026-34774: Electron use-after-free in offscreen child window paint callbackhighCVSS 8.1EPSS 0.5%
- CVE-2026-70601: Electron context isolation bypass via Function.prototype.bind hijackhighCVSS 7.5EPSS 0.3%
- CVE-2026-70604: Electron cross-origin read in custom protocol handlershighCVSS 7.4EPSS 0.4%
- CVE-2026-115570: Electron certificate blocklist bypass in Node.js TLShighCVSS 7.4
- CVE-2026-102675: Electron protocol handlers cross-origin read bypasshighCVSS 7.4
- CVE-2026-70608: Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.10…highCVSS 7.2EPSS 0.4%
- CVE-2026-70611: Electron command injection in DevTools reveal in file managermediumCVSS 6.9EPSS 0.2%
Vulnerabilities per week
5 vulnerabilities in the last four weeks, up 25% on the four before (4). The last 13 weeks, by the week each vulnerability was published.
| Week of | Bar | Vulns | Critical |
|---|---|---|---|
| 17 Aug 2026 | 0 | 0 | |
| 24 Aug 2026 | 0 | 0 | |
| 31 Aug 2026 | 0 | 0 | |
| 7 Sep 2026 | 0 | 0 | |
| 14 Sep 2026 | 0 | 0 | |
| 21 Sep 2026 | 0 | 0 | |
| 28 Sep 2026 | 4 | 0 | |
| 5 Oct 2026 | 0 | 0 | |
| 12 Oct 2026 | 0 | 0 | |
| 19 Oct 2026 | 5 | 0 | |
| 26 Oct 2026 | 0 | 0 | |
| 2 Nov 2026 | 0 | 0 | |
| 9 Nov 2026 | 0 | 0 |
Embed a badge
A live badge for a README, a status page or an internal wiki: how many Electron vulnerabilities were published in the last 7 days and how many of them are critical, refreshed hourly.
[](https://junglewise.ai/threats/technologies/electron-electron)<a href="https://junglewise.ai/threats/technologies/electron-electron"><img src="https://junglewise.ai/threats/technologies/electron-electron/badge.svg" alt="Electron vulnerabilities" /></a>How this is built
Junglewise Threat Intelligence collects vulnerabilities from NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories, and matches each one to the technologies and vendors it affects. Dates are the date a vulnerability was published, in UTC.
The pages are rebuilt from the database every hour. Frozen weekly and monthly reports never change once published, so they can be cited.
Use this data
The same data is at https://junglewise.ai/threats/technologies/electron-electron.json, and this page as text at https://junglewise.ai/threats/technologies/electron-electron.md, for scripts and language models. It is free to reuse under CC BY 4.0 with a link back to this page.
Cite as: Junglewise Threat Intelligence, "Electron vulnerabilities", https://junglewise.ai/threats/technologies/electron-electron, 9 November 2026.