{"schema_version":1,"title":"Electron vulnerabilities","summary":"Junglewise Threat Intelligence has tracked 40 vulnerabilities in Electron: 0 in the last 7 days and 9 in the last 90 days, 0 of them critical and 0 exploited in the wild. The most recent, CVE-2026-115570, was published on 23 October 2026. 5 vulnerabilities in the last four weeks, up 25% on the four before (4). 1 technology has a page of its own.","url":"https://junglewise.ai/threats/vendors/electron","json_url":"https://junglewise.ai/threats/vendors/electron.json","publisher":"Junglewise Threat Intelligence","license":"CC-BY-4.0","license_url":"https://creativecommons.org/licenses/by/4.0/","attribution":"Junglewise Threat Intelligence, https://junglewise.ai/threats/vendors/electron","sources":"NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories","kind":"vendor","thin":false,"counts":{"high":9,"all_time":40,"critical":0,"exploited":0,"last_7_days":0,"last_30_days":5,"last_90_days":9,"last_365_days":28},"latest":[{"cve":"CVE-2026-115570","cvss":7.4,"slug":"cve-2026-115570-electron-is-a-framework-for-writing-cross-platform-desktop","title":"Electron certificate blocklist bypass in Node.js TLS","severity":"high","exploited":false,"published_at":"2026-10-23T19:17:44.47+00:00","url":"https://junglewise.ai/threats/cve-2026-115570-electron-is-a-framework-for-writing-cross-platform-desktop"},{"cve":"CVE-2026-114121","cvss":5.4,"epss":0.0018,"slug":"cve-2026-114121-electron-is-a-framework-for-writing-cross-platform-desktop","title":"Electron external protocol permission misattribution","severity":"medium","exploited":false,"published_at":"2026-10-21T17:18:25.42+00:00","url":"https://junglewise.ai/threats/cve-2026-114121-electron-is-a-framework-for-writing-cross-platform-desktop"},{"cve":"CVE-2026-113800","cvss":5.4,"slug":"cve-2026-113800-electron-hid-and-usb-permission-checks-can-be-attributed-to-the","title":"Electron HID/USB permission checks origin spoofing in iframes","severity":"medium","exploited":false,"published_at":"2026-10-21T17:18:25.27+00:00","url":"https://junglewise.ai/threats/cve-2026-113800-electron-hid-and-usb-permission-checks-can-be-attributed-to-the"},{"cve":"CVE-2026-113798","cvss":5.4,"epss":0.0021,"slug":"cve-2026-113798-electron-is-a-framework-for-writing-cross-platform-desktop","title":"Electron pointer lock permission bypass in cross-origin iframes","severity":"medium","exploited":false,"published_at":"2026-10-21T17:18:24.937+00:00","url":"https://junglewise.ai/threats/cve-2026-113798-electron-is-a-framework-for-writing-cross-platform-desktop"},{"cve":"CVE-2026-113796","cvss":4.2,"epss":0.0018,"slug":"cve-2026-113796-electron-is-a-framework-for-writing-cross-platform-desktop","title":"Electron SameSite cookie bypass in cross-site navigation","severity":"medium","exploited":false,"published_at":"2026-10-21T17:18:24.57+00:00","url":"https://junglewise.ai/threats/cve-2026-113796-electron-is-a-framework-for-writing-cross-platform-desktop"},{"cve":"CVE-2026-102676","cvss":8.3,"slug":"cve-2026-102676-electron-is-a-framework-for-writing-cross-platform-desktop","title":"Electron webview privilege escalation in Web Workers","severity":"high","exploited":false,"published_at":"2026-09-29T17:17:07.973+00:00","url":"https://junglewise.ai/threats/cve-2026-102676-electron-is-a-framework-for-writing-cross-platform-desktop"},{"cve":"CVE-2026-102675","cvss":7.4,"slug":"cve-2026-102675-electron-is-a-framework-for-writing-cross-platform-desktop","title":"Electron protocol handlers cross-origin read bypass","severity":"high","exploited":false,"published_at":"2026-09-29T17:17:07.813+00:00","url":"https://junglewise.ai/threats/cve-2026-102675-electron-is-a-framework-for-writing-cross-platform-desktop"},{"cve":"CVE-2026-102674","cvss":8.2,"slug":"cve-2026-102674-electron-is-a-framework-for-writing-cross-platform-desktop","title":"Electron sandbox escape via popup windows in top-level document","severity":"high","exploited":false,"published_at":"2026-09-29T17:17:07.653+00:00","url":"https://junglewise.ai/threats/cve-2026-102674-electron-is-a-framework-for-writing-cross-platform-desktop"},{"cve":"CVE-2026-102673","cvss":8.2,"slug":"cve-2026-102673-electron-is-a-framework-for-writing-cross-platform-desktop","title":"Electron sandbox inheritance bypass for popups from iframes","severity":"high","exploited":false,"published_at":"2026-09-29T17:17:07.487+00:00","url":"https://junglewise.ai/threats/cve-2026-102673-electron-is-a-framework-for-writing-cross-platform-desktop"},{"cve":"CVE-2026-70612","cvss":5.4,"epss":0.0043,"slug":"cve-2026-70612-electron-sandbox-bypass-via-external-protocol-handlers-in-iframes","title":"Electron sandbox bypass via external protocol handlers in iframes","severity":"medium","exploited":false,"published_at":"2026-08-05T19:17:41.26+00:00","url":"https://junglewise.ai/threats/cve-2026-70612-electron-sandbox-bypass-via-external-protocol-handlers-in-iframes"},{"cve":"CVE-2026-70611","cvss":6.9,"epss":0.0019,"slug":"cve-2026-70611-electron-command-injection-in-devtools-reveal-in-file-manager","title":"Electron command injection in DevTools reveal in file manager","severity":"medium","exploited":false,"published_at":"2026-08-05T18:17:15.613+00:00","url":"https://junglewise.ai/threats/cve-2026-70611-electron-command-injection-in-devtools-reveal-in-file-manager"},{"cve":"CVE-2026-70610","cvss":5.4,"epss":0.0056,"slug":"cve-2026-70610-electron-prototype-pollution-in-contextbridge-object-copying","title":"Electron prototype pollution in contextBridge object copying","severity":"medium","exploited":false,"published_at":"2026-08-05T18:17:15.463+00:00","url":"https://junglewise.ai/threats/cve-2026-70610-electron-prototype-pollution-in-contextbridge-object-copying"},{"cve":"CVE-2026-70609","cvss":5.7,"epss":0.0053,"slug":"cve-2026-70609-electron-javascript-injection-in-devtools-via-unsanitized-dock","title":"Electron JavaScript injection in DevTools via unsanitized dock state","severity":"medium","exploited":false,"published_at":"2026-08-05T18:17:15.307+00:00","url":"https://junglewise.ai/threats/cve-2026-70609-electron-javascript-injection-in-devtools-via-unsanitized-dock"},{"cve":"CVE-2026-70608","cvss":7.2,"epss":0.0043,"slug":"cve-2026-70608-electron-sandbox-bypass-via-openurl-navigation-path","title":"Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.10, 41.10.3, and 42.0.","severity":"high","exploited":false,"published_at":"2026-08-05T18:17:15.16+00:00","url":"https://junglewise.ai/threats/cve-2026-70608-electron-sandbox-bypass-via-openurl-navigation-path"},{"cve":"CVE-2026-70607","cvss":5.3,"epss":0.0056,"slug":"cve-2026-70607-electron-improper-input-validation-in-window-open-features-string","title":"Electron improper input validation in window.open features string","severity":"medium","exploited":false,"published_at":"2026-08-05T17:16:54.687+00:00","url":"https://junglewise.ai/threats/cve-2026-70607-electron-improper-input-validation-in-window-open-features-string"},{"cve":"CVE-2026-70606","cvss":5.9,"epss":0.0026,"slug":"cve-2026-70606-electron-cache-isolation-bypass-in-protocolresponse","title":"Electron cache isolation bypass in ProtocolResponse","severity":"medium","exploited":false,"published_at":"2026-08-05T16:17:04.953+00:00","url":"https://junglewise.ai/threats/cve-2026-70606-electron-cache-isolation-bypass-in-protocolresponse"},{"cve":"CVE-2026-70605","cvss":5.9,"epss":0.0032,"slug":"cve-2026-70605-electron-ssrf-and-local-file-disclosure-via-http-redirect","title":"Electron SSRF and local file disclosure via HTTP redirect","severity":"medium","exploited":false,"published_at":"2026-08-05T16:17:04.8+00:00","url":"https://junglewise.ai/threats/cve-2026-70605-electron-ssrf-and-local-file-disclosure-via-http-redirect"},{"cve":"CVE-2026-70604","cvss":7.4,"epss":0.0035,"slug":"cve-2026-70604-electron-cross-origin-read-in-custom-protocol-handlers","title":"Electron cross-origin read in custom protocol handlers","severity":"high","exploited":false,"published_at":"2026-08-05T16:17:04.617+00:00","url":"https://junglewise.ai/threats/cve-2026-70604-electron-cross-origin-read-in-custom-protocol-handlers"},{"cve":"CVE-2026-70603","cvss":6,"epss":0.0014,"slug":"cve-2026-70603-electron-shell-openpath-path-validation-bypass-via-embedded-null","title":"Electron shell.openPath path validation bypass via embedded null byte","severity":"medium","exploited":false,"published_at":"2026-08-05T16:17:04.47+00:00","url":"https://junglewise.ai/threats/cve-2026-70603-electron-shell-openpath-path-validation-bypass-via-embedded-null"},{"cve":"CVE-2026-70602","cvss":6.6,"epss":0.0026,"slug":"cve-2026-70602-electron-session-isolation-bypass-in-extension-tab-and-scripting","title":"Electron session isolation bypass in extension tab and scripting APIs","severity":"medium","exploited":false,"published_at":"2026-08-05T16:17:04.333+00:00","url":"https://junglewise.ai/threats/cve-2026-70602-electron-session-isolation-bypass-in-extension-tab-and-scripting"},{"cve":"CVE-2026-70601","cvss":7.5,"epss":0.003,"slug":"cve-2026-70601-electron-context-isolation-bypass-via-function-prototype-bind","title":"Electron context isolation bypass via Function.prototype.bind hijack","severity":"high","exploited":false,"published_at":"2026-08-05T16:17:04.203+00:00","url":"https://junglewise.ai/threats/cve-2026-70601-electron-context-isolation-bypass-via-function-prototype-bind"},{"cve":"CVE-2026-70600","cvss":3.1,"epss":0.0022,"slug":"cve-2026-70600-electron-ui-layer-restriction-bypass-in-native-autofill-popup","title":"Electron UI layer restriction bypass in native autofill popup","severity":"low","exploited":false,"published_at":"2026-08-05T16:17:04.067+00:00","url":"https://junglewise.ai/threats/cve-2026-70600-electron-ui-layer-restriction-bypass-in-native-autofill-popup"},{"cve":"CVE-2026-70599","cvss":5.9,"epss":0.0019,"slug":"cve-2026-70599-electron-origin-validation-error-in-permission-check-handler","title":"Electron origin validation error in permission check handler","severity":"medium","exploited":false,"published_at":"2026-08-05T16:17:03.913+00:00","url":"https://junglewise.ai/threats/cve-2026-70599-electron-origin-validation-error-in-permission-check-handler"},{"cve":"CVE-2026-70598","cvss":3.9,"epss":0.0014,"slug":"cve-2026-70598-electron-out-of-bounds-read-in-off-screen-rendering","title":"Electron out-of-bounds read in off-screen rendering","severity":"low","exploited":false,"published_at":"2026-08-05T16:17:03.763+00:00","url":"https://junglewise.ai/threats/cve-2026-70598-electron-out-of-bounds-read-in-off-screen-rendering"},{"cve":"CVE-2026-70597","cvss":6.3,"epss":0.001,"slug":"cve-2026-70597-electron-code-signing-bypass-in-macos-parent-process-validation","title":"Electron code-signing bypass in macOS parent process validation","severity":"medium","exploited":false,"published_at":"2026-08-05T16:17:03.603+00:00","url":"https://junglewise.ai/threats/cve-2026-70597-electron-code-signing-bypass-in-macos-parent-process-validation"}],"vendor":{"hub":true,"name":"Electron","slug":"electron","homepage":"https://www.electronjs.org/","description":"Electron is an open-source project maintained by the OpenJS Foundation and a community of contributors.","url":"https://junglewise.ai/threats/vendors/electron"},"weekly":[{"week":"2026-08-17","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-24","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-31","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-07","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-14","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-21","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-28","critical":0,"exploited":0,"vulnerabilities":4},{"week":"2026-10-05","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-10-12","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-10-19","critical":0,"exploited":0,"vulnerabilities":5},{"week":"2026-10-26","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-11-02","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-11-09","critical":0,"exploited":0,"vulnerabilities":0}],"most_severe":[{"cve":"CVE-2026-102676","cvss":8.3,"slug":"cve-2026-102676-electron-is-a-framework-for-writing-cross-platform-desktop","title":"Electron webview privilege escalation in Web Workers","severity":"high","exploited":false,"published_at":"2026-09-29T17:17:07.973+00:00","url":"https://junglewise.ai/threats/cve-2026-102676-electron-is-a-framework-for-writing-cross-platform-desktop"},{"cve":"CVE-2026-102674","cvss":8.2,"slug":"cve-2026-102674-electron-is-a-framework-for-writing-cross-platform-desktop","title":"Electron sandbox escape via popup windows in top-level document","severity":"high","exploited":false,"published_at":"2026-09-29T17:17:07.653+00:00","url":"https://junglewise.ai/threats/cve-2026-102674-electron-is-a-framework-for-writing-cross-platform-desktop"},{"cve":"CVE-2026-102673","cvss":8.2,"slug":"cve-2026-102673-electron-is-a-framework-for-writing-cross-platform-desktop","title":"Electron sandbox inheritance bypass for popups from iframes","severity":"high","exploited":false,"published_at":"2026-09-29T17:17:07.487+00:00","url":"https://junglewise.ai/threats/cve-2026-102673-electron-is-a-framework-for-writing-cross-platform-desktop"},{"cve":"CVE-2026-34774","cvss":8.1,"epss":0.0055,"slug":"cve-2026-34774-electron-use-after-free-in-offscreen-child-window-paint-callback","title":"Electron use-after-free in offscreen child window paint callback","severity":"high","exploited":false,"published_at":"2026-04-04T00:16:18.447+00:00","url":"https://junglewise.ai/threats/cve-2026-34774-electron-use-after-free-in-offscreen-child-window-paint-callback"},{"cve":"CVE-2026-70601","cvss":7.5,"epss":0.003,"slug":"cve-2026-70601-electron-context-isolation-bypass-via-function-prototype-bind","title":"Electron context isolation bypass via Function.prototype.bind hijack","severity":"high","exploited":false,"published_at":"2026-08-05T16:17:04.203+00:00","url":"https://junglewise.ai/threats/cve-2026-70601-electron-context-isolation-bypass-via-function-prototype-bind"},{"cve":"CVE-2026-70604","cvss":7.4,"epss":0.0035,"slug":"cve-2026-70604-electron-cross-origin-read-in-custom-protocol-handlers","title":"Electron cross-origin read in custom protocol handlers","severity":"high","exploited":false,"published_at":"2026-08-05T16:17:04.617+00:00","url":"https://junglewise.ai/threats/cve-2026-70604-electron-cross-origin-read-in-custom-protocol-handlers"},{"cve":"CVE-2026-115570","cvss":7.4,"slug":"cve-2026-115570-electron-is-a-framework-for-writing-cross-platform-desktop","title":"Electron certificate blocklist bypass in Node.js TLS","severity":"high","exploited":false,"published_at":"2026-10-23T19:17:44.47+00:00","url":"https://junglewise.ai/threats/cve-2026-115570-electron-is-a-framework-for-writing-cross-platform-desktop"},{"cve":"CVE-2026-102675","cvss":7.4,"slug":"cve-2026-102675-electron-is-a-framework-for-writing-cross-platform-desktop","title":"Electron protocol handlers cross-origin read bypass","severity":"high","exploited":false,"published_at":"2026-09-29T17:17:07.813+00:00","url":"https://junglewise.ai/threats/cve-2026-102675-electron-is-a-framework-for-writing-cross-platform-desktop"},{"cve":"CVE-2026-70608","cvss":7.2,"epss":0.0043,"slug":"cve-2026-70608-electron-sandbox-bypass-via-openurl-navigation-path","title":"Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.10, 41.10.3, and 42.0.","severity":"high","exploited":false,"published_at":"2026-08-05T18:17:15.16+00:00","url":"https://junglewise.ai/threats/cve-2026-70608-electron-sandbox-bypass-via-openurl-navigation-path"},{"cve":"CVE-2026-70611","cvss":6.9,"epss":0.0019,"slug":"cve-2026-70611-electron-command-injection-in-devtools-reveal-in-file-manager","title":"Electron command injection in DevTools reveal in file manager","severity":"medium","exploited":false,"published_at":"2026-08-05T18:17:15.613+00:00","url":"https://junglewise.ai/threats/cve-2026-70611-electron-command-injection-in-devtools-reveal-in-file-manager"}],"generated_at":"2026-11-09T03:07:00.176479+00:00","technologies":[{"name":"Electron","slug":"electron-electron","vulnerabilities":39,"url":"https://junglewise.ai/threats/technologies/electron-electron"}]}